Messages in this thread |  | | | Date | Fri, 26 Sep 2008 14:35:12 +0200 | | From | Tilman Baumann <> | | Subject | Re: SMACK netfilter smacklabel socket match |
| |
Paul Moore wrote:
> [NOTE: you may notice the above code changing slightly in future > kernels, it turns out that skb->sk == NULL is not a true indicator of a > non-local sender, see my labeled networking patches for 2.6.28 or > linux-next for the revised approach]
Can you give me a pointer where to look?
Will this mean that skb->sk may be invalid or that it will point to a a context based on the network label the packet has? In the later case, being able to match remote labels in my match would just give added benefit. (Though a netlabel (CIPSO) match would probably be more sane than a smack specific match.) One would just have more choices where to put a rule like this. Like in the FORWARD chain. If non local packets are of no interest, one could put the rule in the right chain.
But i think i just misunderstood you here. Since having a socket for non local packets is probably not what you meant.
Regards Tilman -- Tilman Baumann Software Developer Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany
p: +49 (0) 89-990157-0 f: +49 (0) 89-990157-11
Geschaeftsfuehrer: William K. Hite / Boris Nalbach AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942
|  |