Máté Eckl <eckl...@gmail.com> wrote: > +socket_stmt : SOCKET EXISTS /* with the actual > implementation we cannot match abscence */
I think we should go for a native expression. I'll leave it up to you what you'd like to do next. There are a few options: 1. First go for TPROXY in nft (i.e. finish userspace syntax first) 2. add socket expression for nf_tables. 3. add support for SYNPROXY (outside of your original proposal, but this can be done via nft_compat without loss of functionality). I think 1 or 2 would make most sense, let me know. In case you go for #2, i would go for net/netfilter/nft_socket.c, you'll need a way to serialize the socket_stmt data via new netlink attributes. You can look at 2fa841938c648fe4359691f41e8e1f37ff1a3aa2 for a commit that added a new expression. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
