All of lore.kernel.org
 help / color / mirror / Atom feed
From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: valentina.giusti@bmw-carit.de, netfilter-devel@vger.kernel.org,
	Patrick McHardy <kaber@trash.net>,
	Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
	"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH] xt_owner: enable xt_owner on INPUT chain
Date: Wed, 04 Sep 2013 14:58:13 +0200	[thread overview]
Message-ID: <52272E65.5070208@oss.bmw-carit.de> (raw)
In-Reply-To: <20130904123459.GA4900@localhost>

Hi Pablo,

thanks for having a look at this patch.

On 09/04/2013 02:34 PM, Pablo Neira Ayuso wrote:
> On Fri, Aug 30, 2013 at 02:43:43PM +0200, valentina.giusti@bmw-carit.de wrote:
>> From: Valentina Giusti <valentina.giusti@bmw-carit.de>
>>
>> Since (41063e9 ipv4: Early TCP socket demux), we can apply the owner
>> extension on the INPUT chain and match established TCP sockets.
>> However, because of the same commit, we can have skb->sk pointing to a
>> timewait socket, in which case accessing skb->sk->sk_socket is invalid.
> This only works for established TCP sockets. Thus, this rule:
>
> -A INPUT -m owner --socket-exists -j ACCEPT
> -A OUTPUT -m owner --socket-exists -j ACCEPT
>
> are semantically different depending on the path.

True, in fact my idea is to enable early demultiplexing also for other 
kinds of sockets - as mentioned in the cover letter to this patch: 
http://marc.info/?l=netfilter-devel&m=137786715327396&w=2.

Sorry, I should probably have made it clear that also this patch was 
part of the [RFC], since of course I didn't mean to have it applied now.

> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


  reply	other threads:[~2013-09-04 13:07 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-08-30 12:43 [PATCH] [RFC] xt_owner: enable xt_owner on INPUT chain valentina.giusti
2013-08-30 12:43 ` [PATCH] " valentina.giusti
2013-09-04 12:34   ` Pablo Neira Ayuso
2013-09-04 12:58     ` Valentina Giusti [this message]
2013-08-30 14:54 ` [PATCH] [RFC] " Phil Oester
2013-08-30 15:08   ` Florian Westphal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=52272E65.5070208@oss.bmw-carit.de \
    --to=valentina.giusti@oss.bmw-carit.de \
    --cc=davem@davemloft.net \
    --cc=kaber@trash.net \
    --cc=kadlec@blackhole.kfki.hu \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=valentina.giusti@bmw-carit.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.