[lkml]   [1999]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Which PID is a packet going to/coming from?
    In message <> you write:
    > I'm working on an addition to ipchains to allow filtering on local UIDs -
    > allowing rules like 'Only EUIDs less than 1000 may make outgoing
    > connections to an SMTP server'. One thing has me beat:

    Hi Alistair,

    Early in the netfilter development, I implemented incoming and
    outgoing UID checking. It gets difficult, and it turns out that to be
    at all useful, it needs to have a userspace component. In practice,
    people want to enable and disable certain ids at certain times, etc.

    It's also a bitch to implement the lookup (eg. multiple
    receivers are possible).

    The answer, I concluded, was to filter SYN packets through
    userspace, and do the lookup there (look up what process has that
    source/dest socket, figure out whether it's OK or not), and then set
    up an in-kernel rule to handle the rest of the packets and replies.
    Of course, there's no nice way of reinjecting the packet if you decide
    it's OK in linux 2.2 (hence netfilter for 2.3); if you can handle a
    one second delay, then you can simply drop the packet.

    Tridge, Raster, DaveM, Cort, maddog... Where will you be 9-11 July 1999?

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:51    [W:0.020 / U:4.232 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site