All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: valentina.giusti@bmw-carit.de
Cc: netfilter-devel@vger.kernel.org,
	Patrick McHardy <kaber@trash.net>,
	Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
	"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH] xt_owner: enable xt_owner on INPUT chain
Date: Wed, 4 Sep 2013 14:34:59 +0200	[thread overview]
Message-ID: <20130904123459.GA4900@localhost> (raw)
In-Reply-To: <1377866623-25948-2-git-send-email-valentina.giusti@bmw-carit.de>

On Fri, Aug 30, 2013 at 02:43:43PM +0200, valentina.giusti@bmw-carit.de wrote:
> From: Valentina Giusti <valentina.giusti@bmw-carit.de>
> 
> Since (41063e9 ipv4: Early TCP socket demux), we can apply the owner
> extension on the INPUT chain and match established TCP sockets.
> However, because of the same commit, we can have skb->sk pointing to a
> timewait socket, in which case accessing skb->sk->sk_socket is invalid.

This only works for established TCP sockets. Thus, this rule:

-A INPUT -m owner --socket-exists -j ACCEPT
-A OUTPUT -m owner --socket-exists -j ACCEPT

are semantically different depending on the path.

  reply	other threads:[~2013-09-04 12:35 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-08-30 12:43 [PATCH] [RFC] xt_owner: enable xt_owner on INPUT chain valentina.giusti
2013-08-30 12:43 ` [PATCH] " valentina.giusti
2013-09-04 12:34   ` Pablo Neira Ayuso [this message]
2013-09-04 12:58     ` Valentina Giusti
2013-08-30 14:54 ` [PATCH] [RFC] " Phil Oester
2013-08-30 15:08   ` Florian Westphal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130904123459.GA4900@localhost \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=kaber@trash.net \
    --cc=kadlec@blackhole.kfki.hu \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=valentina.giusti@bmw-carit.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.