Re: [PATCH nft] Introduce socket matching

Máté Eckl wrote: > On Mon, May 28, 2018 at 05:43:18PM +0200, Florian Westphal wrote: > > Máté Eckl wrote: > > > > +const struct socket_template socket_templates[] = { > > > > + [NFT_SOCKET_TRANSPARENT]= {.token = "transparent", > > > > +

Re: [PATCH nft] Introduce socket matching

On Mon, May 28, 2018 at 05:43:18PM +0200, Florian Westphal wrote: > Máté Eckl wrote: > > > +const struct socket_template socket_templates[] = { > > > + [NFT_SOCKET_TRANSPARENT]= {.token = "transparent", > > > +.dtype = _type, > > > +

Re: [PATCH nft] Introduce socket matching

Máté Eckl wrote: > > +const struct socket_template socket_templates[] = { > > + [NFT_SOCKET_TRANSPARENT]= {.token = "transparent", > > + .dtype = _type, > > + .len = 1 * BITS_PER_BYTE, > > I

Re: [PATCH nft] Introduce socket matching

> +const struct socket_template socket_templates[] = { > + [NFT_SOCKET_TRANSPARENT]= {.token = "transparent", > +.dtype = _type, > +.len = 1 * BITS_PER_BYTE, I wanted to use len = 1 here to only make 0 and

[PATCH nft] Introduce socket matching

For now it can only match sockets with IP(V6)_TRANSPARENT socket option set. Example: table inet sockin { chain sockchain { type filter hook prerouting priority -150; policy accept; socket transparent 1 mark set 0x0001 nftrace set 1 counter packets 0