Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2024-02-05 Thread Felix Huettner
> > > > > > Hi, Felix and Pablo. > > > > > > I was looking through the code and the following part is bothering me: > > > > > > diff --git a/net/netfilter/nf_conntrack_netlink.c > > > b/net/netfilter/nf_conntrack_netlink.c > > > index fb0ae15e96df..4e9133f61251 100644 > > > --- a/net/netfilt

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2024-02-02 Thread Felix Huettner
On Fri, Feb 02, 2024 at 12:12:03PM +0100, Pablo Neira Ayuso wrote: > On Fri, Feb 02, 2024 at 12:04:35PM +0100, Ilya Maximets wrote: > > On 12/22/23 13:01, Pablo Neira Ayuso wrote: > > > On Mon, Nov 27, 2023 at 11:49:16AM +, Felix Huettner wrote: > > >> conntrack zones are heavily used by tools

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2024-02-02 Thread Pablo Neira Ayuso
On Fri, Feb 02, 2024 at 12:04:35PM +0100, Ilya Maximets wrote: > On 12/22/23 13:01, Pablo Neira Ayuso wrote: > > On Mon, Nov 27, 2023 at 11:49:16AM +, Felix Huettner wrote: > >> conntrack zones are heavily used by tools like openvswitch to run > >> multiple virtual "routers" on a single machine

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2024-02-02 Thread Ilya Maximets
On 12/22/23 13:01, Pablo Neira Ayuso wrote: > On Mon, Nov 27, 2023 at 11:49:16AM +, Felix Huettner wrote: >> conntrack zones are heavily used by tools like openvswitch to run >> multiple virtual "routers" on a single machine. In this context each >> conntrack zone matches to a single router, th

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2023-12-22 Thread Pablo Neira Ayuso
On Mon, Nov 27, 2023 at 11:49:16AM +, Felix Huettner wrote: > conntrack zones are heavily used by tools like openvswitch to run > multiple virtual "routers" on a single machine. In this context each > conntrack zone matches to a single router, thereby preventing > overlapping IPs from becoming

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2023-12-05 Thread Felix Huettner
Hi, > > > > Please, extend libnetfilter_conntrack to support for this feature, > > there is a filter API that can be used for this purpose. > > I will do that and post it here (or in the next version) once i am done. > A patch for this is now on netfilter-devel at [1]. [1]: https://marc.info/

Re: [PATCH net-next v2] net: ctnetlink: support filtering by zone

2023-11-27 Thread Pablo Neira Ayuso
Hi, On Mon, Nov 27, 2023 at 11:49:16AM +, Felix Huettner wrote: > conntrack zones are heavily used by tools like openvswitch to run > multiple virtual "routers" on a single machine. In this context each > conntrack zone matches to a single router, thereby preventing > overlapping IPs from beco