On Fri, Jun 12, 2015 at 04:39:55PM -0600, Harout Hedeshian wrote:
> xt_socket is useful for matching sockets with IP_TRANSPARENT and
> taking some action on the matching packets. However, it lacks the
> ability to match only a small subset of transparent sockets.
>
> Suppose there are 2 applications, each with its own set of transparent
> sockets. The first application wants all matching packets dropped,
> while the second application wants them forwarded somewhere else.
>
> Add the ability to match sockets based on the socket mark.
>
> Now the 2 hypothetical applications can differentiate their sockets
> based on a mark value set with SO_MARK.
>
> iptables -t mangle -I PREROUTING -m socket --transparent --mark 10 -J act1
> iptables -t mangle -I PREROUTING -m socket --transparent --mark 11 -J act2
Wouldn't it be better to restore the sk_mark to skb->mark? I mean:
iptables -t mangle -I PREROUTING \
-m socket --transparent --restore-skmark -j myskchain
Thus, you can use -m mark from the 'myskchain' without having to fetch
and inspect the sk over and over again as it happens with this
extension.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
