From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [PATCH nf-next] netfilter: xt_socket: add XT_SOCKET_NOWILDCARD flag Date: Thu, 20 Jun 2013 11:55:00 +0200 Message-ID: <20130620095500.GB698@localhost> References: <1370300249.24311.190.camel@edumazet-glaptop> <1371717515.3252.392.camel@edumazet-glaptop> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev , netfilter-devel@vger.kernel.org, Jesper Dangaard Brouer , Patrick McHardy To: Eric Dumazet Return-path: Received: from mail.us.es ([193.147.175.20]:34882 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757310Ab3FTJzH (ORCPT ); Thu, 20 Jun 2013 05:55:07 -0400 Content-Disposition: inline In-Reply-To: <1371717515.3252.392.camel@edumazet-glaptop> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Thu, Jun 20, 2013 at 01:38:35AM -0700, Eric Dumazet wrote: > On Mon, 2013-06-03 at 15:57 -0700, Eric Dumazet wrote: > > From: Eric Dumazet > > > > xt_socket module can be a nice replacement to conntrack module > > in some cases (SYN filtering for example) > > > > But it lacks the ability to match the 3rd packet of TCP > > handshake (ACK coming from the client). > > > > Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism > > > > iptables -I INPUT -p tcp --syn -j SYN_CHAIN > > iptables -I INPUT -m socket -j ACCEPT > > > > > > Signed-off-by: Eric Dumazet > > Cc: Patrick McHardy > > Cc: Jesper Dangaard Brouer > > --- > > Hi Pablo, is there any problem with this patch ? user-space part is missing (or at least I didn't manage to find the patch). We've been adding new revision for such a changes. I know it's a bit too much, but we want to make sure that a user does not set this option from user-space and it's silently ignored by iptables.