[lkml]   [2006]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 1/1][RFC] ipt_owner: inode match supporting both incoming and outgoing packets
    James Morris wrote:
    > Have a look at my skfilter patches:
    > These implement a scheme for matching incoming packets against sockets by
    > adding a new hook in the socket layer.
    > For upstream merge, the issues are:
    > - should the new socket hook be used for all incoming packets?
    > - ensure IP queuing still works
    > Patrick: any other issues?

    Confirmation of conntrack entries. They shouldn't be confirmed before
    packets have passed the socket hooks. This is the tricky part because
    we don't know if packets will be delivered to a raw socket or not
    when calling the regular LOCAL_IN hook. The only way to solve this
    seems to be to use the socket hooks for all incoming packets, that
    way we can defer confirmation unconditionally. The nicest way would
    be to just move the regular LOCAL_IN hook to the socket hooks, but
    this doesn't work with SNAT in LOCAL_IN because the socket lookup
    needs the already NATed address.

    I'll probably continue to work on this soon unless someone beats
    me to the punch.
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-02-20 17:46    [W:0.020 / U:4.528 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site