On Tue, Jul 29, 2014 at 12:35:00PM -0400, Willem de Bruijn wrote:

On Tue, Jul 29, 2014 at 12:05 PM, Pablo Neira Ayuso [off-list ref] wrote:

quoted

On Tue, Jul 29, 2014 at 11:43:57AM -0400, Willem de Bruijn wrote:

quoted

quoted

In e6f30c7 ("netfilter: x_tables: add xt_bpf match"), the internal
linux/filter.h header slipped through in the user exposed xt_bpf.h
header as included file.

is that true? #include <linux/filter.h> should include
include/uapi/linux/filter.h in userspace builds.

You're right. I'm going to send a v2.

Thanks for fixing my bug. I agree that it's better to do this
independent of the sk_filter/bpf_prog patch.

quoted

We should also cache the linux/filter.h header in the iptables
sources, would you send a patch for that? Thanks.

Will do.  Should I just import the latest version of the file, or is
there a sync policy, such as that all kernel headers come from the
same kernel release?

Right. The kernel header which is available after make headers_install.
Thanks.