Máté Eckl <eckl...@gmail.com> wrote:
> +socket_stmt : SOCKET EXISTS /* with the actual
> implementation we cannot match abscence */
I think we should go for a native expression.
I'll leave it up to you what you'd like to do next.
There are a few options:
1. First go for TPROXY in nft (i.e. finish userspace syntax first)
2. add socket expression for nf_tables.
3. add support for SYNPROXY (outside of your original proposal,
but this can be done via nft_compat without loss of functionality).
I think 1 or 2 would make most sense, let me know.
In case you go for #2, i would go for net/netfilter/nft_socket.c,
you'll need a way to serialize the socket_stmt data via new netlink
You can look at 2fa841938c648fe4359691f41e8e1f37ff1a3aa2 for
a commit that added a new expression.
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html