Re: [PATCH nf-next] netfilter: xt_socket: add XT_SOCKET_MATCHSOCKMARK flag and mark fields

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Jun 12, 2015 at 04:39:55PM -0600, Harout Hedeshian wrote:
> xt_socket is useful for matching sockets with IP_TRANSPARENT and
> taking some action on the matching packets. However, it lacks the
> ability to match only a small subset of transparent sockets.
>
> Suppose there are 2 applications, each with its own set of transparent
> sockets. The first application wants all matching packets dropped,
> while the second application wants them forwarded somewhere else.
>
> Add the ability to match sockets based on the socket mark.
>
> Now the 2 hypothetical applications can differentiate their sockets
> based on a mark value set with SO_MARK.
>
> iptables -t mangle -I PREROUTING -m socket --transparent --mark 10 -J act1
> iptables -t mangle -I PREROUTING -m socket --transparent --mark 11 -J act2

Wouldn't it be better to restore the sk_mark to skb->mark? I mean:

        iptables -t mangle -I PREROUTING \
                -m socket --transparent --restore-skmark -j myskchain

Thus, you can use -m mark from the 'myskchain' without having to fetch
and inspect the sk over and over again as it happens with this
extension.