Hi Bart, On Thu, Dec 05, 2013 at 10:15:46PM +0100, Bart De Schuymer wrote: > Pablo Neira Ayuso schreef op 5/12/2013 9:24: > >On Wed, Dec 04, 2013 at 04:11:18PM +0100, Arturo Borrero Gonzalez wrote: > >>On 4 December 2013 12:48, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > >>>Hi, > >>> > >>>The iptables-nftables tree [1] currently stores the iptables over > >>>nftables compatibility support. This allows you to run iptables > >>>commands using the nftables kernel infrastructure. > >>> > >>>JFYI, my plan is to merge the iptables-nftables into iptables at some > >>>point of this week given that it contains stuff that is scheduled for > >>>3.13. After that merge, the iptables-nftables will be disabled. > >>> > >>>[1] http://git.netfilter.org/iptables-nftables/ > >>Could you give some hints about releases of userspace stuff? > >>(libnftables, nft, new iptables...) > >> > >>Is 3.13 a deadline for releases? > >The initial release of the userspace libraries and tools will happen > >by when the Linux kernel 3.13 is released, that should happen by the > >beginning of 2014. > > > >The nftables compatibility layer (the so-called iptables-nftables) > >will be included in regular iptables releases, since it will be part > >of that package. > > Nice to see this progress. What are the plans/obstacles (if any?) > for migrating ebtables/arptables to nftables? We already have a working compatibility layer for iptables, ip6tables and arptables. Regarding arptables, there's still one limitation that we have to resolve as it only allows EUI-64 addresses (which should be the most common case), the arptables kernel code seems to support variable length hardware addresses up to 128 bytes long IIRC. Tomasz has been working on that for a while. Regarding ebtables, Giuseppe Longo have several patches to bootstrap the ebtables compatibility, so it's work in progress. In any case, we will still need the native {arp,eb,ip,ip6}tables tools for a while, those will co-exist with the compatibility tools. At some point in the future, distributors may decide to switch to the compatibility tools transparently, the idea is that users won't notice any change from the syntax point of view and they won't be forced to drop their scripts. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
