[lkml]   [1999]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectNETLINK and discerning input vs output packets

Perhaps an easy question: consider ipchains configured with
CONFIG_IP_FIREWALL_NETLINK and the following rules:

Chain input (policy ACCEPT):
target prot opt source destination ports
- tcp -----o 1000 -> 2000
Chain forward (policy ACCEPT):
Chain output (policy ACCEPT):
target prot opt source destination ports
- tcp -----o any any any -> any

Now, as you know the -o option pushes the data down to /dev/fwdata. Well, the
question is how do I tell what rule caused the packet to be dropped to
userspace? I don't need to know the ipchain name or such, but whether it is
coming INTO or going OUT OF the system. The box may be a router, so checking
the source/destination vs the machine's IP isn't going to work.

Is there anything I can look at inside the iphdr or tcphdr of a packet that
will tell me which direction it's moving?

[ more details ]
In reality what I am doing is writing a stateful/heuristic packet filter with
ipchains. I thought it would be neat that instead of putting a timeout value
on holes opened up, I could examine the incoming packets (that match my
dynamically added ACCEPT rules) and use _that_ flow to keep-alive the accept
rule. (SPF 1.1, which inspired me, watches only outgoing data to determine if
a port needs to be kept open. A unidirectional data flow with UDP, for
example, would get shutdown with that method after its timeout as the inside
box isn't sending back data to keep spf aware that the port needs to remain

-- n i c h o l a s j l e o n
elegance through simplicity
good fortune through truth icq#2170994

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:52    [W:0.039 / U:15.432 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site