Re: [PATCH nf-next 0/3] netfilter: socket lookup function refactoring, cgroup match fixes

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jun 17, 2015 at 02:08:09AM +0200, Daniel Mack wrote:
> This series is based on work done by Daniel Borkmann a little while ago:
> 
>   http://article.gmane.org/gmane.comp.security.firewalls.netfilter.devel/56877
> 
> I addressed the feedback from that thread and factored out the socket
> lookup code into own modules, one for ipv4, one for ipv6. These modules
> are now selected in kbuild by code that uses it.
> 
> Also, a patch was added to fix nft_meta cgroup match rules in a similar
> fashion as it's now done for xt_cgroup.

Then, you probably missed these:

http://permalink.gmane.org/gmane.comp.security.firewalls.netfilter.devel/56879

That means that we will not take any rework of the existing socket
infrastructure in netfilter/iptables. The socket match was designed
for TPROXY, not for firewalling as it will only work under very
specific assumptions.

The possible ideas that we (Patrick and me) have discussed boil down to:

1) Placing the INPUT hook at later stage, from the layer 4 protocols.

or

2) Add a new socket hook in the path from layer 4 protocols.

In both cases, the idea is that we're always 100% sure that we have a
valid sk in place, including UDP multicast.