[lkml]   [2008]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: SMACK netfilter smacklabel socket match
Paul Moore wrote:

> [NOTE: you may notice the above code changing slightly in future
> kernels, it turns out that skb->sk == NULL is not a true indicator of a
> non-local sender, see my labeled networking patches for 2.6.28 or
> linux-next for the revised approach]

Can you give me a pointer where to look?

Will this mean that skb->sk may be invalid or that it will point to a a
context based on the network label the packet has?
In the later case, being able to match remote labels in my match would
just give added benefit. (Though a netlabel (CIPSO) match would probably
be more sane than a smack specific match.)
One would just have more choices where to put a rule like this. Like in
the FORWARD chain.
If non local packets are of no interest, one could put the rule in the
right chain.

But i think i just misunderstood you here. Since having a socket for non
local packets is probably not what you meant.

Tilman Baumann
Software Developer
Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

p: +49 (0) 89-990157-0
f: +49 (0) 89-990157-11

Geschaeftsfuehrer: William K. Hite / Boris Nalbach
AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942

 \ /
  Last update: 2008-09-26 14:37    [W:0.147 / U:3.036 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site