netdev - Re: [PATCH netfilter/iptables] Add new slavedev match extension

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <83ada82dbc93439d794c2407e3c91dd1b69bcbaa.camel@strongswan.org>
Date:   Fri, 10 Jan 2020 17:34:12 +0100
From:   Martin Willi <martin@...ongswan.org>
To:     Pablo Neira Ayuso <pablo@...filter.org>,
        Florian Westphal <fw@...len.de>
Cc:     netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        David Ahern <dsahern@...il.com>
Subject: Re: [PATCH netfilter/iptables] Add new slavedev match extension

Pablo,

> This patchset introduces a new Netfilter match extension to match
> input interfaces that are associated to a layer 3 master device. The
> first patch adds the new match to the kernel, the other provides an
> extension to userspace iptables to make use of the new match.

These patches have been marked as superseded in patchworks, likely due
to Florian's nftables version that has been merged.

While I very much appreciate the addition of VRF interface matching to
nftables, some users still depend on plain iptables for filtering. So I
guess there is some value in these patches for those users to extend
their filtering with VRF support.

Is there a chance of bringing in slavedev matching for iptables, or do
we have a policy to implement new features in nftables, only?

Thanks,
Martin