Re: 2.6.20: ipt_owner match and INPUT chain

[Patrick McHardy <kaber@trash.net>]

Thomas Jarosch wrote:
> On Saturday, 3. March 2007, Patrick McHardy wrote:
> 
>>>The easier solution would be to patch the socks server to execute a
>>>script if the client requests to bind a port on the server. The
>>>connection could be added via the userspace conntrack tool, right?
>>
>>That should work. We could also add support for helperless expectations
>>for this, which will properly deal with NAT automatically.
> 
> 
> I'm not sure if I understand you correctly, shouldn't it already be possible 
> to add an expectation via "conntrack -I expect"?

Yes, but currently expectations always need a master connection
with a helper assigned.

> Another idea came to my mind today: If the socks server needs to be patched 
> anyway, would it be useful to set a connmark via an ioctl on the socket?

connmark isn't possible since the sending side of the socket
only deals with packets before the have been associated with
a conntrack entry. But you could use normal marks, IIRC
Balazs Scheidler <bazsi@balabit.hu> posted a patch for this
to netdev about 1.5 years ago.

> Normal firewall rules could then be used for incoming and especially
> outgoing connections from the socks server.

Incoming connections don't work, the receiving socket is not known
while the packet is handled by netfilter.