Re: 2.6.20: ipt_owner match and INPUT chain

[Thomas Jarosch <thomas.jarosch@intra2net.com>]

Hello Patrick,

On Monday, 5. March 2007, you wrote:
> > I'm not sure if I understand you correctly, shouldn't it already be
> > possible to add an expectation via "conntrack -I expect"?
>
> Yes, but currently expectations always need a master connection
> with a helper assigned.

Thanks for clearing this up. Is this change easy to do, like it would
take you ten minutes or is it a more complex task?

> > Another idea came to my mind today: If the socks server needs to be
> > patched anyway, would it be useful to set a connmark via an ioctl on the
> > socket?
>
> connmark isn't possible since the sending side of the socket
> only deals with packets before the have been associated with
> a conntrack entry. But you could use normal marks, IIRC
> Balazs Scheidler <bazsi@balabit.hu> posted a patch for this
> to netdev about 1.5 years ago.

I was unable to find the patch, too bad the lovely patchwork system wasn't in 
place at that time. Anyway, ipt_owner works for outgoing connections so after 
giving it another thought it a) already works b) is one patch less to the 
socks proxy -> ipt_owner is fine for this.

> > Normal firewall rules could then be used for incoming and especially
> > outgoing connections from the socks server.
>
> Incoming connections don't work, the receiving socket is not known
> while the packet is handled by netfilter.

Ok, thanks.

I'm still wondering how other people are running a socks server
together with an iptables firewall. I can't imagine
they leave all incoming ports open...

Cheers,
Thomas