Máté Eckl <eckl...@gmail.com> wrote:
> +socket_stmt          :       SOCKET  EXISTS /* with the actual 
> implementation we cannot match abscence */

I think we should go for a native expression.

I'll leave it up to you what you'd like to do next.
There are a few options:
1. First go for TPROXY in nft (i.e. finish userspace syntax first)
2. add socket expression for nf_tables.
3. add support for SYNPROXY (outside of your original proposal,
   but this can be done via nft_compat without loss of functionality).

I think 1 or 2 would make most sense, let me know.

In case you go for #2, i would go for net/netfilter/nft_socket.c,
you'll need a way to serialize the socket_stmt data via new netlink

You can look at 2fa841938c648fe4359691f41e8e1f37ff1a3aa2 for
a commit that added a new expression.
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to