Re: [iptables-compat PATCH 0/3] ebtables compat layer

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Aug 22, 2014 at 11:29:12AM +0200, Giuseppe Longo wrote:
> Hi Pablo,
> the btables-compat is almost ready,

At quick glance the approach looks correct to me. The parser and the
specific bridge code is well-encapsulated.

> I've fixed the issues with flags, there are two small issues
> to be fixed yet:
> 
> - rules with logical interfaces are not deleted
> - when listing rule, the mask is printed when it's not set
> 
> The filter table is working properly except these issues,
> that I'm going to fix in these days.

Great, I'm looking forward to having fixes for these. Please, let us
know if we can help.

On top of that, please, also rebase your patches to use the new
nft_xt_ctx structure so it remains consistent with the ip, ip6 and arp
compat code.

I'd like to see a v2 round soon.

> There is no support yet for nat and brouting,
> I'm working on checksum expr.

OK, I guess you mean the enhancement for payload to mangle packets.

> I would know what you have in mind for these patches,
> if you want to accept them when the issues are fixed
> even if there is no nat support yet or or what else?

I would like to see the filter code already in mainstream.

The bridge "NAT" (which is actually a simple stateless packet
mangling) will have to wait until we have support for this in the
kernel anyway.

> So I can organize the work to do.
> 
> There are still some extensions that have to be moved
> to libxtables.

Please, make a short summary of those.

Thanks for your work.