Re: xt_owner-xt_socket plans

[Laszlo Attila Toth <panther@balabit.hu>]

Jan Engelhardt írta:
> On January 21 2008 10:11, Laszlo Attila Toth wrote:
>> Jan Engelhardt wrote:
>>> I just remembered that xt_socket (from tproxy) does an (explicit) socket
>>> lookup. xt_owner on the other hand, takes the socket pointer from the skb --
>>> which of course only works in the output path.
>>>
>>> xt_owner is still in the 2.6.25 development queue, and because the two
>>> modules are similar, I thought that maybe xt_owner could be merged with
>>> xt_socket (doing a rename to xt_socket in the current net-2.6.25),
>>> because they are quite close in their task.
>>>
>>> That would also allow xt_owner to be used in the input path.
>>>
>>> Opinions?
>> Hello,
>>
>> That sounds great.
>>
>> Note that the socket match depends on tproxy core, also the tproxy would be
>> partially merged into the net-2.25 tree. [...]
> 
> Here is what I had in mind, please have a look.
> http://dev.computergmbh.de/gitweb.cgi?p=linux;h=dev-xtsocket;a=shortlog
> 


The following snippet of socket_mt_get() should be in socket_mt():

        if (sk != NULL)
                  nf_tproxy_put_sock(sk);

The socket buffer is first referenced by nf_tproxy_get_v4() then 
immediately released (put back) also it is not garanteed that the socket 
is valid. Furthermore I don't know whether the sk->sk_socket is valid 
through the whole function in a multiprocessor environment (the program, 
that opened it, may close the socket).


The tproxy lookup only works with tcp and udp, and afaik the original 
owner match also limited to these protocols, also it can be tested in 
socket_mt4_check()

I noticed that you forgot rename the match to "socket" in socket_mt_reg[].

Except these the patch is ok.

-- 
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html