From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: tgraf@suug.ch, challa@noironetworks.com, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf-next v2 3/3] netfilter: nf_conntrack: add efficient mark to zone mapping
Date: Mon, 20 Jul 2015 19:03:27 +0200 [thread overview]
Message-ID: <20150720170327.GA22681@salvia> (raw)
In-Reply-To: <55AD1F6F.1090607@iogearbox.net>
On Mon, Jul 20, 2015 at 06:18:55PM +0200, Daniel Borkmann wrote:
[...]
> The current approach implemented here that I found so far most appealing
> and having the least complexity, was to just have a /single/ template and to
> overwrite the zone->id with skb->mark on the ptr we have sitting on the stack.
> It avoids all the issues mentioned. But perhaps you mean something entirely
> different and I just seem to misinterpret your answer, hmm.
You mean something that from command line would look like:
iptables -A PREROUTING -t raw -j CT --zone mark
So we set the zone ID in the CT target based on the existing mark,
right?
next prev parent reply other threads:[~2015-07-20 16:57 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-11 1:14 [PATCH nf-next v2 0/3] Netfilter zone directions Daniel Borkmann
2015-07-11 1:14 ` [PATCH nf-next v2 1/3] netfilter: nf_conntrack: push zone object into functions Daniel Borkmann
2015-07-15 17:35 ` Pablo Neira Ayuso
2015-07-15 19:16 ` Daniel Borkmann
2015-07-11 1:14 ` [PATCH nf-next v2 2/3] netfilter: nf_conntrack: add direction support for zones Daniel Borkmann
2015-07-11 1:14 ` [PATCH nf-next v2 3/3] netfilter: nf_conntrack: add efficient mark to zone mapping Daniel Borkmann
2015-07-15 17:50 ` Pablo Neira Ayuso
2015-07-15 20:04 ` Daniel Borkmann
2015-07-20 16:18 ` Daniel Borkmann
2015-07-20 17:03 ` Pablo Neira Ayuso [this message]
2015-07-20 17:27 ` Daniel Borkmann
2015-07-20 18:24 ` Pablo Neira Ayuso
2015-07-20 20:05 ` Daniel Borkmann
2015-07-21 7:37 ` Pablo Neira Ayuso
2015-07-21 9:08 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150720170327.GA22681@salvia \
--to=pablo@netfilter.org \
--cc=challa@noironetworks.com \
--cc=daniel@iogearbox.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=tgraf@suug.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.