On Fri, Dec 7, 2012 at 8:20 AM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Thu, Dec 06, 2012 at 04:12:10PM -0500, Willem de Bruijn wrote: >> On Thu, Dec 6, 2012 at 12:22 AM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: >> > On Wed, Dec 05, 2012 at 09:00:36PM +0100, Jan Engelhardt wrote: >> >> On Wednesday 2012-12-05 20:28, Willem de Bruijn wrote: >> >> >> >> >Somehow, the first part of this email went missing. Not critical, >> >> >but for completeness: >> >> > >> >> >These two patches each add an xtables match. >> >> > >> >> >The xt_priority match is a straighforward addition in the style of >> >> >xt_mark, adding the option to filter on one more sk_buff field. I >> >> >have an immediate application for this. The amount of code (in >> >> >kernel + userspace) to add a single check proved quite large. >> >> >> >> Hm so yeah, can't we just place this in xt_mark.c? >> > >> > I don't feel this belongs to xt_mark at all. >> >> Do you have other concerns, or can I resubmit as is for merging in a >> few days if no one raises additional issues? > > In nftables we have the 'meta' extension that allows to match all > skbuff fields (among other things): > > http://1984.lsi.us.es/git/nf-next/tree/net/netfilter/nft_meta.c?h=nf_tables8 > > I think it's the way to go so we stop adding small matches for each > skbuff field. > > I don't mind the name if it's xt_skbuff or xt_meta. Okay. I'll respin right now with one more field to select the skb field to match on, as a patch against tree nf-next, and will send that to netfilter-devel. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
