lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CA+FuTSduAv4JdzzOE4tVWQCL-00jruPDwcUxuYvPizQkkKrBbg@mail.gmail.com> Date: Fri, 7 Dec 2012 12:26:34 -0500 From: Willem de Bruijn <willemb@...gle.com> To: Pablo Neira Ayuso <pablo@...filter.org> Cc: Jan Engelhardt <jengelh@...i.de>, netfilter-devel <netfilter-devel@...r.kernel.org>, netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>, David Miller <davem@...emloft.net>, Patrick McHardy <kaber@...sh.net> Subject: Re: [PATCH rfc] netfilter: two xtables matches On Fri, Dec 7, 2012 at 8:20 AM, Pablo Neira Ayuso <pablo@...filter.org> wrote: > On Thu, Dec 06, 2012 at 04:12:10PM -0500, Willem de Bruijn wrote: >> On Thu, Dec 6, 2012 at 12:22 AM, Pablo Neira Ayuso <pablo@...filter.org> wrote: >> > On Wed, Dec 05, 2012 at 09:00:36PM +0100, Jan Engelhardt wrote: >> >> On Wednesday 2012-12-05 20:28, Willem de Bruijn wrote: >> >> >> >> >Somehow, the first part of this email went missing. Not critical, >> >> >but for completeness: >> >> > >> >> >These two patches each add an xtables match. >> >> > >> >> >The xt_priority match is a straighforward addition in the style of >> >> >xt_mark, adding the option to filter on one more sk_buff field. I >> >> >have an immediate application for this. The amount of code (in >> >> >kernel + userspace) to add a single check proved quite large. >> >> >> >> Hm so yeah, can't we just place this in xt_mark.c? >> > >> > I don't feel this belongs to xt_mark at all. >> >> Do you have other concerns, or can I resubmit as is for merging in a >> few days if no one raises additional issues? > > In nftables we have the 'meta' extension that allows to match all > skbuff fields (among other things): > > http://1984.lsi.us.es/git/nf-next/tree/net/netfilter/nft_meta.c?h=nf_tables8 > > I think it's the way to go so we stop adding small matches for each > skbuff field. > > I don't mind the name if it's xt_skbuff or xt_meta. Okay. I'll respin right now with one more field to select the skb field to match on, as a patch against tree nf-next, and will send that to netfilter-devel. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists