On Thu, Dec 06, 2012 at 04:12:10PM -0500, Willem de Bruijn wrote: > On Thu, Dec 6, 2012 at 12:22 AM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Wed, Dec 05, 2012 at 09:00:36PM +0100, Jan Engelhardt wrote: > >> On Wednesday 2012-12-05 20:28, Willem de Bruijn wrote: > >> > >> >Somehow, the first part of this email went missing. Not critical, > >> >but for completeness: > >> > > >> >These two patches each add an xtables match. > >> > > >> >The xt_priority match is a straighforward addition in the style of > >> >xt_mark, adding the option to filter on one more sk_buff field. I > >> >have an immediate application for this. The amount of code (in > >> >kernel + userspace) to add a single check proved quite large. > >> > >> Hm so yeah, can't we just place this in xt_mark.c? > > > > I don't feel this belongs to xt_mark at all. > > Do you have other concerns, or can I resubmit as is for merging in a > few days if no one raises additional issues? In nftables we have the 'meta' extension that allows to match all skbuff fields (among other things): http://1984.lsi.us.es/git/nf-next/tree/net/netfilter/nft_meta.c?h=nf_tables8 I think it's the way to go so we stop adding small matches for each skbuff field. I don't mind the name if it's xt_skbuff or xt_meta. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
