How to find origin PID of a sk_buff in iptables match?

[Markku Savela]

Again playing with ubuntu kernel 2.6.24.

I'm trying to write a match rule for iptables, in this case for OUTPUT
direction, and need to know the PID of the process that originates the
packet (or something).

It seems that "skb->sk->sk_peercred.pid" is always zero.

Also, I noticed that in my match code in OUTPUT chain, the current
task seemed to the originator I want (ping test). However, I'm not
quite sure whether this is always true?

If I truly wanted to associate each packet with some specific process,
what are my options?

- I expect the solution is easier for outbound packets originating
  from this host (e.g. possibly the OUTPUT chain is always executed in
  the context of the sending process?)

- for INPUT the problem is probably pretty hard to solve. I would need
  some IPTABLES rule to be run after the packet has been assinged to a
  receiving user socket and get the PID of the receiving process,
  which may be fuzzy as socket can have multiple reading processes?

ps. I did notice the iptables xt_owner match, and the comment there
saying that support for PID and SID match is not there.



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/