From: Daniel Mack <daniel@zonque.org>
To: Jan Engelhardt <jengelh@inai.de>
Cc: Florian Westphal <fw@strlen.de>,
pablo@netfilter.org, daniel@iogearbox.net,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
balazs.scheidler@balabit.com
Subject: Re: [PATCH RFC 3/7] netfilter: add NF_INET_LOCAL_SOCKET_IN chain type
Date: Wed, 30 Sep 2015 10:54:29 +0200 [thread overview]
Message-ID: <560BA345.40504@zonque.org> (raw)
In-Reply-To: <alpine.LSU.2.20.1509300938060.9960@nerf40.vanv.qr>
On 09/30/2015 09:40 AM, Jan Engelhardt wrote:
>
> On Wednesday 2015-09-30 09:24, Daniel Mack wrote:
>>
>>> Drop? Makes no sense, else application would not be running in the first
>>> place.
>>
>> Of course you can drop certain packets at this point, depending on other
>> details. Say, for instance, you want to match all packets that are
>> received by a certain task [...]
>> Another use case is accounting. If you want to know how much traffic a
>> certain service or application in your system has caused
>
> But the sk info would be available in INPUT already, would it not?
No, only for established connections, as those are subject to early
demux which sets skb->sk. For all other packets, netfilter callbacks are
called with skb->sk == NULL.
That's the whole point of this patch set ;)
Daniel
next prev parent reply other threads:[~2015-09-30 8:54 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-29 11:12 [PATCH RFC 0/7] netfilter: introduce new chain type for local socket input Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 1/7] netfilter: add socket to struct nft_pktinfo Daniel Mack
2015-09-29 18:25 ` Eric W. Biederman
2015-09-29 11:12 ` [PATCH RFC 2/7] netfilter: nft_meta: look at pkt->sk rather than skb->sk Daniel Mack
2015-09-29 13:37 ` kbuild test robot
2015-09-29 11:12 ` [PATCH RFC 3/7] netfilter: add NF_INET_LOCAL_SOCKET_IN chain type Daniel Mack
2015-09-29 21:19 ` Florian Westphal
2015-09-30 7:24 ` Daniel Mack
2015-09-30 7:40 ` Jan Engelhardt
2015-09-30 8:54 ` Daniel Mack [this message]
2015-09-30 21:48 ` Florian Westphal
2015-10-01 9:04 ` Daniel Mack
2015-10-01 17:13 ` Marcelo Ricardo Leitner
2015-10-01 21:07 ` Daniel Mack
2015-10-01 21:34 ` Marcelo Ricardo Leitner
2015-10-02 11:07 ` Pablo Neira Ayuso
2015-10-02 13:52 ` Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 4/7] net: tcp_ipv4, udp_ipv4: hook up LOCAL_SOCKET_IN netfilter chains Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 5/7] net: tcp_ipv6, udp_ipv6: " Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 6/7] net: sctp: " Daniel Mack
2015-09-29 11:12 ` [PATCH RFC 7/7] net: dccp: " Daniel Mack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=560BA345.40504@zonque.org \
--to=daniel@zonque.org \
--cc=balazs.scheidler@balabit.com \
--cc=daniel@iogearbox.net \
--cc=fw@strlen.de \
--cc=jengelh@inai.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).