On 09/30/2015 09:40 AM, Jan Engelhardt wrote: > > On Wednesday 2015-09-30 09:24, Daniel Mack wrote: >> >>> Drop? Makes no sense, else application would not be running in the first >>> place. >> >> Of course you can drop certain packets at this point, depending on other >> details. Say, for instance, you want to match all packets that are >> received by a certain task [...] >> Another use case is accounting. If you want to know how much traffic a >> certain service or application in your system has caused > > But the sk info would be available in INPUT already, would it not? No, only for established connections, as those are subject to early demux which sets skb->sk. For all other packets, netfilter callbacks are called with skb->sk == NULL. That's the whole point of this patch set ;) Daniel -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
