[lkml]   [2008]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: SMACK netfilter smacklabel socket match
    Paul Moore wrote:

    > [NOTE: you may notice the above code changing slightly in future
    > kernels, it turns out that skb->sk == NULL is not a true indicator of a
    > non-local sender, see my labeled networking patches for 2.6.28 or
    > linux-next for the revised approach]

    Can you give me a pointer where to look?

    Will this mean that skb->sk may be invalid or that it will point to a a
    context based on the network label the packet has?
    In the later case, being able to match remote labels in my match would
    just give added benefit. (Though a netlabel (CIPSO) match would probably
    be more sane than a smack specific match.)
    One would just have more choices where to put a rule like this. Like in
    the FORWARD chain.
    If non local packets are of no interest, one could put the rule in the
    right chain.

    But i think i just misunderstood you here. Since having a socket for non
    local packets is probably not what you meant.

    Tilman Baumann
    Software Developer
    Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

    p: +49 (0) 89-990157-0
    f: +49 (0) 89-990157-11

    Geschaeftsfuehrer: William K. Hite / Boris Nalbach
    AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942

     \ /
      Last update: 2008-09-26 14:37    [W:0.042 / U:9.020 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site