On Wed, Jun 17, 2015 at 11:06:02AM +0200, Daniel Mack wrote: > Hi Pablo, > > Thanks a lot for the feedback! > > On 06/17/2015 03:03 AM, Pablo Neira Ayuso wrote: [...] > > Yeah, right. The thing is that cgroup matching is an incredible useful > feature. It's a pity it isn't currently usable for ingress packets. > > > The possible ideas that we (Patrick and me) have discussed boil down to: > > > > 1) Placing the INPUT hook at later stage, from the layer 4 protocols. > > That would be great, but the consequences for other matching functions > are beyond my current knowledge of the netfilter code. > > > or > > > > 2) Add a new socket hook in the path from layer 4 protocols. > > > > In both cases, the idea is that we're always 100% sure that we have a > > valid sk in place, including UDP multicast. > > That sounds reasonable too. That option would at least work for nft > then, right? Is anyone working on that yet? Not yet, but Daniel Borkmann will likely bring up this issue during the Netfilter Workshop that will happen the next week. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
