Re: 2.6.20: ipt_owner match and INPUT chain

[Thomas Jarosch <thomas.jarosch@intra2net.com>]

Hello Patrick,

On Friday, 2. March 2007, Patrick McHardy wrote:
> > the ipt_owner match of 2.6.20 is not allowed to be used in the INPUT
> > chain.
> >
> > The .hooks entry looks like this:
> > .hooks          = (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING)
> >
> > Back in the days it was allowed to be used in the INPUT chain for
> > TCP/UDP. I've searched the mailinglist archive but couldn't find anything
> > useful. What's the reason behind the change?
>
> The mainline kernel never supported this, you're thinking of the
> owner socketlookup patch, which had multiple issues and was never
> merged.

Thanks for your reply. You're right, on 2.4 I've applied the socketlookup 
patch. I use it to accept incoming connections for a socks v5 proxy.

Socks allows a client to bind a port on the external IP of the server
and then wait for an incoming connection. Would it make sense to write a 
conntrack module which parses the communication between socks client and 
server and then adds the incoming connection to conntrack?

The easier solution would be to patch the socks server to execute a script
if the client requests to bind a port on the server. The connection could be 
added via the userspace conntrack tool, right?

Cheers,
Thomas