I'm re-addressing the issue of matching socket meta information for non-established sockets that has been discussed a while ago:
http://article.gmane.org/gmane.comp.security.firewalls.netfilter.devel/56877 Being able to reliably match on net_cls cgroup ids is crucial in order to build a per-application or per-container firewall rules which don't leak ingress packets. Such a feature would be very useful to have. A previous attempt to fix the currently existing issues was to call out to the early demuxing helper functions from the meta matching callbacks, but that doesn't suffice because it doesn't address the case of multicast UDP and other, more complex lookup methods implemented in various protocol handlers. This patch set outlines a different approach by adding a flag to 'struct sk_buff' called 'nf_postponed'. This flag is set by nft_meta_get_eval() in case a decision cannot be made due to a missing skb->sk. skbs flagged that way will then be ran through the netfilter chain processor again after the protocol handlers did the real socket lookup. A small addition to 'struct nft_pktinfo' is needed so that the matching callbacks can access the socket that was passed into nf_hook(). Note that the new flag does not actually bloat 'struct skb_buff', because it still fits into the 'flags1' bitfield. Also, the extra netfilter chain iteration will not be done by any subsequent packet in the same stream, as for those, the early demux code will set skb->sk. The patch set is obviously not yet finished, because a lot more protocol handlers need to be patched. Right now, I only addressed tcp_ipv4. Before I do that, I want to get some feedback on the approach, so please let me know what you think. Thanks, Daniel Daniel Mack (3): netfilter: add socket to struct nft_pktinfo netfilter: nft_meta: mark skbs for postponed filter processing net: tcp_ipv4: re-run netfilter chains for marked skbs include/linux/skbuff.h | 3 ++- include/net/netfilter/nf_tables.h | 2 ++ net/ipv4/tcp_ipv4.c | 10 ++++++++++ net/netfilter/nft_meta.c | 9 ++++++--- 4 files changed, 20 insertions(+), 4 deletions(-) -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
