On 03/25/2015 10:34 PM, Daniel Borkmann wrote: > On 03/25/2015 09:26 PM, Pablo Neira Ayuso wrote: >> So this is basically needed when early demux is disabled? >> >> This is a rather large rework, I would like to know what scenarios >> we're not currently catching with the existing code. > > Hm, perhaps Daniel can elaborate better, what I have seen in my > testing when xt_cgroup fails to match the cgroup on ingress traffic > is i) early demux sysctl disabled, ii) udp on unconnected sockets > (which I understand is the majority of udp traffic), iii) tcp and > udp (any kind) on localhost communications. Daniel's original report > can be found here [1]. Currently, ingress matching fails if the xt_cgroup module's match callback is called with skb->sk == NULL, which is the case in the scenarios described above. Also, according to Cong, this is as well always the case if the ingress network device is 'lo'. We want to use xt_cgroup to realize a per-application firewall for both filtering and accounting. For this, being able to catch every network packet that is destined for or originated by a task that is assigned to a certain net_cls CGroup controller is essential. Also, the match has to be effective regardless of the network interface in use. In my tests, Daniel's patches work perfectly fine. Thanks, Daniel -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
