summaryrefslogtreecommitdiffstats
path: root/extensions/GNUmakefile.in
diff options
context:
space:
mode:
authorHarout Hedeshian <harouth@codeaurora.org>2015-06-15 18:41:19 -0600
committerPablo Neira Ayuso <pablo@netfilter.org>2015-06-30 17:26:37 +0200
commit16964a99a61ff1d7cb0c260ed50b9f91f7b7a783 (patch)
treea7a3f106bad9b4e1438224248a799c1300babd38 /extensions/GNUmakefile.in
parent311a6d743df6062246fa0b90cc90e5f6e947b336 (diff)
extensions: libxt_socket: add --restore-skmark option
xt_socket is useful for matching sockets with IP_TRANSPARENT and taking some action on the matching packets. However, it lacks the ability to match only a small subset of transparent sockets. Suppose there are 2 applications, each with its own set of transparent sockets. The first application wants all matching packets dropped, while the second application wants them forwarded somewhere else. Add the ability to retore the skb->mark from the sk_mark. The mark is only restored if a matching socket is found and the transparent / nowildcard conditions are satisfied. Now the 2 hypothetical applications can differentiate their sockets based on a mark value set with SO_MARK. iptables -t mangle -I PREROUTING -m socket --transparent \ --restore-skmark -j action iptables -t mangle -A action -m mark --mark 10 -j action2 iptables -t mangle -A action -m mark --mark 11 -j action3 Signed-off-by: Harout Hedeshian <harouth@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/GNUmakefile.in')
0 files changed, 0 insertions, 0 deletions