On Fri, Nov 18, 2016 at 01:37:32PM +0100, Pablo Neira Ayuso wrote:
> On Thu, Nov 17, 2016 at 07:27:08PM +0100, Daniel Mack wrote:
> [...]
> > @@ -312,6 +314,12 @@ int ip_mc_output(struct net *net, struct sock *sk,
> > struct sk_buff *skb)
> > skb->dev = dev;
> > skb->protocol = htons(ETH_P_IP);
> >
> > + ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
> > + if (ret) {
> > + kfree_skb(skb);
> > + return ret;
> > + }
> > +
> > /*
> > * Multicasts are looped back for other local users
> > */
> > @@ -364,12 +372,19 @@ int ip_mc_output(struct net *net, struct sock *sk,
> > struct sk_buff *skb)
> > int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> > {
> > struct net_device *dev = skb_dst(skb)->dev;
> > + int ret;
> >
> > IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
> >
> > skb->dev = dev;
> > skb->protocol = htons(ETH_P_IP);
> >
> > + ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
> > + if (ret) {
> > + kfree_skb(skb);
> > + return ret;
> > + }
> > +
> > return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> > net, sk, skb, NULL, dev,
> > ip_finish_output,
>
> Please, place this after the netfilter hook.
>
> Since this new hook may mangle output packets, any mangling
> potentially interfers and breaks conntrack.
actually this hook cannot mangle the packets, so no conntrack concerns.
Also this was brought up by Lorenzo earlier
and consensus was that it's cleaner to leave it in this order.
My reply:
http://www.spinics.net/lists/cgroups/msg16675.html
and Daniel's:
http://www.spinics.net/lists/cgroups/msg16677.html
and the rest of that thread.
Thanks
