From: Florian Westphal <fw@strlen.de>
To: David Ahern <dsahern@gmail.com>
Cc: Florian Westphal <fw@strlen.de>,
netfilter-devel@vger.kernel.org,
Martin Willi <martin@strongswan.org>,
David Ahern <dsahern@kernel.org>,
Shrijeet Mukherjee <shrijeet@gmail.com>,
Roopa Prabhu <roopa@cumulusnetworks.com>,
Benjamin Poirier <bpoirier@cumulusnetworks.com>
Subject: Re: [PATCH nf-next 9/9] netfilter: nft_meta: add support for slave device ifindex matching
Date: Thu, 19 Dec 2019 18:08:15 +0100 [thread overview]
Message-ID: <20191219170815.GD795@breakpoint.cc> (raw)
In-Reply-To: <ce5758ce-7541-3b6b-d61c-ae59219ef898@gmail.com>
David Ahern <dsahern@gmail.com> wrote:
> On 12/18/19 4:05 AM, Florian Westphal wrote:
> > Allow to match on vrf slave ifindex or name.
> >
> > In case there was no slave interface involved, store 0 in the
> > destination register just like existing iif/oif matching.
> >
> > sdif(name) is restricted to the ipv4/ipv6 input and forward hooks,
> > as it depends on ip(6) stack parsing/storing info in skb->cb[].
> >
> > Cc: Martin Willi <martin@strongswan.org>
> > Cc: David Ahern <dsahern@kernel.org>
> > Cc: Shrijeet Mukherjee <shrijeet@gmail.com>
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > ---
> > include/uapi/linux/netfilter/nf_tables.h | 4 ++
> > net/netfilter/nft_meta.c | 76 +++++++++++++++++++++---
> > 2 files changed, 73 insertions(+), 7 deletions(-)
> >
>
> do you have an example that you can share?
nft add rule inet filter input meta sdifname "eth0" accept
so its similar to existing iif(name) that test for the input device.
This is the nft equivalent for the "slavedev" match that Martin proposed
here:
http://patchwork.ozlabs.org/patch/1211435/
next prev parent reply other threads:[~2019-12-19 17:08 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-18 11:05 [PATCH nf-next 0/9] netfilter: nft_meta: add support for slave device matching Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 1/9] netfilter: nft_meta: move time handling to helper Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 2/9] netfilter: nft_meta: move pkttype " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 3/9] netfilter: nft_meta: move sk uid/git " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 4/9] netfilter: nft_meta: move cgroup " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 5/9] netfilter: nft_meta: move interface kind " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 6/9] netfilter: nft_meta: move all interface related keys " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 7/9] netfilter: nft_meta: place prandom handling in a helper Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 8/9] netfilter: nft_meta: place rtclassid " Florian Westphal
2019-12-18 11:05 ` [PATCH nf-next 9/9] netfilter: nft_meta: add support for slave device ifindex matching Florian Westphal
2019-12-19 16:46 ` David Ahern
2019-12-19 17:08 ` Florian Westphal [this message]
2019-12-20 1:27 ` David Ahern
2019-12-26 16:42 ` [PATCH nf-next 0/9] netfilter: nft_meta: add support for slave device matching Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191219170815.GD795@breakpoint.cc \
--to=fw@strlen.de \
--cc=bpoirier@cumulusnetworks.com \
--cc=dsahern@gmail.com \
--cc=dsahern@kernel.org \
--cc=martin@strongswan.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=roopa@cumulusnetworks.com \
--cc=shrijeet@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).