[lkml]   [1999]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Which PID is a packet going to/coming from?
In message <> you write:
> I'm working on an addition to ipchains to allow filtering on local UIDs -
> allowing rules like 'Only EUIDs less than 1000 may make outgoing
> connections to an SMTP server'. One thing has me beat:

Hi Alistair,

Early in the netfilter development, I implemented incoming and
outgoing UID checking. It gets difficult, and it turns out that to be
at all useful, it needs to have a userspace component. In practice,
people want to enable and disable certain ids at certain times, etc.

It's also a bitch to implement the lookup (eg. multiple
receivers are possible).

The answer, I concluded, was to filter SYN packets through
userspace, and do the lookup there (look up what process has that
source/dest socket, figure out whether it's OK or not), and then set
up an in-kernel rule to handle the rest of the packets and replies.
Of course, there's no nice way of reinjecting the packet if you decide
it's OK in linux 2.2 (hence netfilter for 2.3); if you can handle a
one second delay, then you can simply drop the packet.

Tridge, Raster, DaveM, Cort, maddog... Where will you be 9-11 July 1999?

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.024 / U:8.112 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site