From: Daniel Mack <daniel@zonque.org>
To: Jan Engelhardt <jengelh@inai.de>
Cc: Florian Westphal <fw@strlen.de>,
pablo@netfilter.org, daniel@iogearbox.net,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
balazs.scheidler@balabit.com
Subject: Re: [PATCH RFC 3/7] netfilter: add NF_INET_LOCAL_SOCKET_IN chain type
Date: Wed, 30 Sep 2015 10:54:29 +0200 [thread overview]
Message-ID: <560BA345.40504@zonque.org> (raw)
In-Reply-To: <alpine.LSU.2.20.1509300938060.9960@nerf40.vanv.qr>
On 09/30/2015 09:40 AM, Jan Engelhardt wrote:
>
> On Wednesday 2015-09-30 09:24, Daniel Mack wrote:
>>
>>> Drop? Makes no sense, else application would not be running in the first
>>> place.
>>
>> Of course you can drop certain packets at this point, depending on other
>> details. Say, for instance, you want to match all packets that are
>> received by a certain task [...]
>> Another use case is accounting. If you want to know how much traffic a
>> certain service or application in your system has caused
>
> But the sk info would be available in INPUT already, would it not?
No, only for established connections, as those are subject to early
demux which sets skb->sk. For all other packets, netfilter callbacks are
called with skb->sk == NULL.
That's the whole point of this patch set ;)
Daniel
next prev parent reply other threads:[~2015-09-30 8:54 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-29 11:12 [PATCH RFC 0/7] netfilter: introduce new chain type for local socket input Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 1/7] netfilter: add socket to struct nft_pktinfo Daniel Mack
2015-09-29 18:25 ` Eric W. Biederman
2015-09-29 11:12 ` [PATCH RFC 2/7] netfilter: nft_meta: look at pkt->sk rather than skb->sk Daniel Mack
2015-09-29 13:37 ` kbuild test robot
2015-09-29 11:12 ` [PATCH RFC 3/7] netfilter: add NF_INET_LOCAL_SOCKET_IN chain type Daniel Mack
2015-09-29 21:19 ` Florian Westphal
2015-09-30 7:24 ` Daniel Mack
2015-09-30 7:40 ` Jan Engelhardt
2015-09-30 8:54 ` Daniel Mack [this message]
2015-09-30 21:48 ` Florian Westphal
2015-10-01 9:04 ` Daniel Mack
2015-10-01 17:13 ` Marcelo Ricardo Leitner
2015-10-01 21:07 ` Daniel Mack
2015-10-01 21:34 ` Marcelo Ricardo Leitner
2015-10-02 11:07 ` Pablo Neira Ayuso
2015-10-02 13:52 ` Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 4/7] net: tcp_ipv4, udp_ipv4: hook up LOCAL_SOCKET_IN netfilter chains Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 5/7] net: tcp_ipv6, udp_ipv6: " Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 6/7] net: sctp: " Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 7/7] net: dccp: " Daniel Mack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=560BA345.40504@zonque.org \
--to=daniel@zonque.org \
--cc=balazs.scheidler@balabit.com \
--cc=daniel@iogearbox.net \
--cc=fw@strlen.de \
--cc=jengelh@inai.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.