On Wed, Jun 17, 2015 at 02:08:09AM +0200, Daniel Mack wrote: > This series is based on work done by Daniel Borkmann a little while ago: > > http://article.gmane.org/gmane.comp.security.firewalls.netfilter.devel/56877 > > I addressed the feedback from that thread and factored out the socket > lookup code into own modules, one for ipv4, one for ipv6. These modules > are now selected in kbuild by code that uses it. > > Also, a patch was added to fix nft_meta cgroup match rules in a similar > fashion as it's now done for xt_cgroup. Then, you probably missed these: http://permalink.gmane.org/gmane.comp.security.firewalls.netfilter.devel/56879 That means that we will not take any rework of the existing socket infrastructure in netfilter/iptables. The socket match was designed for TPROXY, not for firewalling as it will only work under very specific assumptions. The possible ideas that we (Patrick and me) have discussed boil down to: 1) Placing the INPUT hook at later stage, from the layer 4 protocols. or 2) Add a new socket hook in the path from layer 4 protocols. In both cases, the idea is that we're always 100% sure that we have a valid sk in place, including UDP multicast. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
