* why is sk->skb->sk_socket->file NULL on incoming packets?
@ 2004-09-10 0:45 Luke Kenneth Casson Leighton
2004-09-10 1:20 ` Chris Wright
0 siblings, 1 reply; 3+ messages in thread
From: Luke Kenneth Casson Leighton @ 2004-09-10 0:45 UTC (permalink / raw)
To: linux-kernel; +Cc: coreteam
hi, simple question - if a userspace ip_queue program (fireflier)
can determine the pid of an incoming packet, why can't ipt_owner.c
do the same?
how do i force, even by using a userspace thing which asks the
packet to be "re-examined", the skb->sk->sk_socket->file to be
set?
i _need_ this to work!
_yes_ i have a modified version of ipt_owner.c which can track down
the full path name of the program.
_yes_ i'm happy with creating more than one per-executable-program-name
rule for instances where sockets are shared between executables
(e.g. they're passed over unix-domain-sockets).
help, help!
l.
--
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love. If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net"> lkcl.net </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: why is sk->skb->sk_socket->file NULL on incoming packets?
2004-09-10 0:45 why is sk->skb->sk_socket->file NULL on incoming packets? Luke Kenneth Casson Leighton
@ 2004-09-10 1:20 ` Chris Wright
2004-09-10 1:36 ` Luke Kenneth Casson Leighton
0 siblings, 1 reply; 3+ messages in thread
From: Chris Wright @ 2004-09-10 1:20 UTC (permalink / raw)
To: Luke Kenneth Casson Leighton; +Cc: linux-kernel, coreteam
* Luke Kenneth Casson Leighton (lkcl@lkcl.net) wrote:
> hi, simple question - if a userspace ip_queue program (fireflier)
> can determine the pid of an incoming packet, why can't ipt_owner.c
> do the same?
>
> how do i force, even by using a userspace thing which asks the
> packet to be "re-examined", the skb->sk->sk_socket->file to be
> set?
I assume the netfilter hook you come in on is NF_IP_LOCAL_IN? This is
at ip level. The sock (sk) is protocol specific, and hasn't been
looked up yet. Look at the protocols' input handlers (i.e. udp_rcv or
tcp_v4_rcv), they do this lookup (i.e. udp_v4_lookup or __tcp_v4_lookup).
The sk_filter() point is probably the first time you have an association
between the skb (inbound) and the sock it's going to be queued to.
LSM modules use security_sock_rcv_skb at this point.
thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: why is sk->skb->sk_socket->file NULL on incoming packets?
2004-09-10 1:20 ` Chris Wright
@ 2004-09-10 1:36 ` Luke Kenneth Casson Leighton
0 siblings, 0 replies; 3+ messages in thread
From: Luke Kenneth Casson Leighton @ 2004-09-10 1:36 UTC (permalink / raw)
To: Chris Wright; +Cc: linux-kernel, coreteam
On Thu, Sep 09, 2004 at 06:20:54PM -0700, Chris Wright wrote:
> * Luke Kenneth Casson Leighton (lkcl@lkcl.net) wrote:
> > hi, simple question - if a userspace ip_queue program (fireflier)
> > can determine the pid of an incoming packet, why can't ipt_owner.c
> > do the same?
> >
> > how do i force, even by using a userspace thing which asks the
> > packet to be "re-examined", the skb->sk->sk_socket->file to be
> > set?
>
> I assume the netfilter hook you come in on is NF_IP_LOCAL_IN? This is
> at ip level. The sock (sk) is protocol specific, and hasn't been
> looked up yet. Look at the protocols' input handlers (i.e. udp_rcv or
> tcp_v4_rcv), they do this lookup (i.e. udp_v4_lookup or __tcp_v4_lookup).
> The sk_filter() point is probably the first time you have an association
> between the skb (inbound) and the sock it's going to be queued to.
> LSM modules use security_sock_rcv_skb at this point.
oooo *wide-eyed*. thanks
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-09-10 1:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-09-10 0:45 why is sk->skb->sk_socket->file NULL on incoming packets? Luke Kenneth Casson Leighton
2004-09-10 1:20 ` Chris Wright
2004-09-10 1:36 ` Luke Kenneth Casson Leighton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.