Jan Engelhardt írta:
On January 21 2008 10:11, Laszlo Attila Toth wrote:
Jan Engelhardt wrote:
I just remembered that xt_socket (from tproxy) does an (explicit) socket
lookup. xt_owner on the other hand, takes the socket pointer from the skb --
which of course only works in the output path.
xt_owner is still in the 2.6.25 development queue, and because the two
modules are similar, I thought that maybe xt_owner could be merged with
xt_socket (doing a rename to xt_socket in the current net-2.6.25),
because they are quite close in their task.
That would also allow xt_owner to be used in the input path.
Opinions?
Hello,
That sounds great.
Note that the socket match depends on tproxy core, also the tproxy would be
partially merged into the net-2.25 tree. [...]
Here is what I had in mind, please have a look.
http://dev.computergmbh.de/gitweb.cgi?p=linux;h=dev-xtsocket;a=shortlog
The following snippet of socket_mt_get() should be in socket_mt():
if (sk != NULL)
nf_tproxy_put_sock(sk);
The socket buffer is first referenced by nf_tproxy_get_v4() then
immediately released (put back) also it is not garanteed that the socket
is valid. Furthermore I don't know whether the sk->sk_socket is valid
through the whole function in a multiprocessor environment (the program,
that opened it, may close the socket).
The tproxy lookup only works with tcp and udp, and afaik the original
owner match also limited to these protocols, also it can be tested in
socket_mt4_check()
I noticed that you forgot rename the match to "socket" in socket_mt_reg[].
Except these the patch is ok.
--
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
