> -----Original Message----- > From: Pablo Neira Ayuso [mailto:pablo@xxxxxxxxxxxxx] > Sent: Monday, June 15, 2015 10:23 AM > To: Harout Hedeshian > Cc: netfilter-devel@xxxxxxxxxxxxxxx; Lorenzo Colitti > Subject: Re: [PATCH nf-next] netfilter: xt_socket: add > XT_SOCKET_MATCHSOCKMARK flag and mark fields > > On Fri, Jun 12, 2015 at 04:39:55PM -0600, Harout Hedeshian wrote: > > xt_socket is useful for matching sockets with IP_TRANSPARENT and > > taking some action on the matching packets. However, it lacks the > > ability to match only a small subset of transparent sockets. > > > > Suppose there are 2 applications, each with its own set of transparent > > sockets. The first application wants all matching packets dropped, > > while the second application wants them forwarded somewhere else. > > > > Add the ability to match sockets based on the socket mark. > > > > Now the 2 hypothetical applications can differentiate their sockets > > based on a mark value set with SO_MARK. > > > > iptables -t mangle -I PREROUTING -m socket --transparent --mark 10 -J > > act1 iptables -t mangle -I PREROUTING -m socket --transparent --mark > > 11 -J act2 > > Wouldn't it be better to restore the sk_mark to skb->mark? I mean: > > iptables -t mangle -I PREROUTING \ > -m socket --transparent --restore-skmark -j myskchain > > Thus, you can use -m mark from the 'myskchain' without having to fetch > and inspect the sk over and over again as it happens with this > extension. Yes, I think that can work. Let me try that out and I'll submit a new patch. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
