Re: SMACK netfilter smacklabel socket match

[Tilman Baumann <tilman.baumann@collax.com>]

Paul Moore wrote:

> [NOTE: you may notice the above code changing slightly in future 
> kernels, it turns out that skb->sk == NULL is not a true indicator of a 
> non-local sender, see my labeled networking patches for 2.6.28 or 
> linux-next for the revised approach]

Can you give me a pointer where to look?

Will this mean that skb->sk may be invalid or that it will point to a a 
context based on the network label the packet has?
In the later case, being able to match remote labels in my match would 
just give added benefit. (Though a netlabel (CIPSO) match would probably 
be more sane than a smack specific match.)
One would just have more choices where to put a rule like this. Like in 
the FORWARD chain.
If non local packets are of no interest, one could put the rule in the 
right chain.

But i think i just misunderstood you here. Since having a socket for non 
local packets is probably not what you meant.

Regards
  Tilman
-- 
Tilman Baumann
Software Developer
Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

p: +49 (0) 89-990157-0
f: +49 (0) 89-990157-11

Geschaeftsfuehrer: William K. Hite / Boris Nalbach
AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942