On Thu, Jan 10, 2019 at 01:16:08PM +0800, wenxu@xxxxxxxxx wrote: > From: wenxu <wenxu@xxxxxxxxx> > > This patch allows us to match on the tunnel metadata that is available > of the packet. We can use this to validate if the packet comes from/goes > to tunnel and the corresponding tunnel ID in the iptables. One more question, we already have support for this in nft_tunnel.c, would it be good if we just add the missing pieces to userspace there? I have some patches here I need to push out for this...
