Hi Patrick,
I'd appreciate your feedback on some small design issue on TEE for
nftables.
Basically, the initial patcheset allows this:
nft add rule ... tee gateway 1.2.3.4
and
nft add rule ... tee oifname eth0 gateway 1.2.3.4
then, internally, this takes a NFTA_TEE_GATEWAY attribute that
contains the inet address.
The question is if it's worth passing a register instead to indicate
the gateway, ie. NFTA_TEE_GATEWAY_SREG. Thus, we can use maps to set
this, eg.
nft add rule ... tee gateway ip saddr map { 4.3.2.1 : 1.2.3.4 }
Then, we have interfaces, but we actually need to subscribe to netdev
events to make sure the pointer to net_device is still valid.
Do you think it's worth the effort? I've been spinning on this when I
remember about nft_queue and I think it would be good to get support
done so we can use maps there too.
Let me know, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
