From: Daniel Borkmann <daniel@iogearbox•net>
To: Daniel Mack <daniel@zonque•org>, Florian Westphal <fw@strlen•de>
Cc: Alexey Perevalov <a.perevalov@samsung•com>,
Pablo Neira Ayuso <pablo@netfilter•org>,
netdev <netdev@vger•kernel.org>
Subject: Re: cgroup matches in INPUT chain
Date: Fri, 20 Mar 2015 21:18:28 +0100 [thread overview]
Message-ID: <550C8094.5000508@iogearbox.net> (raw)
In-Reply-To: <550C4901.4070001@zonque.org>
On 03/20/2015 05:21 PM, Daniel Mack wrote:
> On 03/20/2015 05:11 PM, Florian Westphal wrote:
>> Daniel Mack <daniel@zonque•org> wrote:
>>> In my simple test setup, when skbs are dequeued by process_backlog(),
>>> they have skb->_skb_refdst set, and hence ip_rcv_finish() does not call
>>> into early_demux() prior to iterating the INPUT chain:
>>
>> Yes, because we already have a route set.
>>
>> Are we talking about loopback?
>
> I'm testing this on the lookback device, but I've seen similar behavior
> on external interfaces too. However, I fail to see a pattern in that.
>
>> What are you trying to do?
>
> Basically, I have a simple server that listens to a TCP port, accepts a
> connection, writes out a short string and closes the connection again.
> The process is put into a netcls cgroup controller, and a classid is
> assigned to it, and I'm trying catch all traffic sent to it (regardless
> of the interface in use) with a netfilter rule.
>
> However, that doesn't work, because under the described circumstances,
> the match callback of the cgroup netfilter module is always called with
> an skb that has no sk set.
Thanks for the report Daniel. I see the same here, so let me look
closer into it on Monday and get back to you. Looks like commit
a00e76349f3564bb is not sufficient.
Cheers,
Daniel
next prev parent reply other threads:[~2015-03-20 20:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-19 18:41 cgroup matches in INPUT chain Daniel Mack
2015-03-19 18:58 ` Florian Westphal
2015-03-20 13:57 ` Daniel Mack
2015-03-20 16:11 ` Florian Westphal
2015-03-20 16:21 ` Daniel Mack
2015-03-20 20:18 ` Daniel Borkmann [this message]
2015-03-20 20:55 ` Cong Wang
2015-03-20 22:07 ` Daniel Mack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=550C8094.5000508@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=a.perevalov@samsung$(echo .)com \
--cc=daniel@zonque$(echo .)org \
--cc=fw@strlen$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox