Bug 197916 - FutureFeature policy match
FutureFeature policy match
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Riek
Brian Brock
: FutureFeature
Depends On:
  Show dependency treegraph
Reported: 2006-07-07 07:54 EDT by xoleron
Modified: 2010-06-07 01:28 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-06-07 01:28:42 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Steffen Mann 2006-07-07 07:54:26 EDT
Description of problem:
Customer and customers customers, wish to have 'policy match' available for

Internal Prio3
Customer Prio2
Comment 1 Steffen Mann 2006-07-07 08:09:45 EDT
Target Milestone RHEL4.5

Why is this feature or bug fix required?:

Client is a large Telecom (T-Systems) 
they currently run following setup:
2xRHEL vpn -> client site (client requires that T-Systems only uses assigned
trusted addresses

However as IPSec is involved also they need to translate theis addreses with

Additionally both VPN-GW are in a Trusted Net that requires NAT-Traversal 

What is the impact (customer impact, revenue impact) of NOT providing this
feature or bug fix?
Potentially they would loose a lot of client that would go for a RHEL solution.
Is a workaround available? Well, yes, use two physical boxes and route the
traffic in between them, this comes in as additional cost HW & SW.

iptables from Version 1.3.5 onwards integrates 'Policy-Match', kernel also
requires a patch from Patrick McHardy that's already in upstream in kernel2.6.16
as well as in FC5 in 2.6.15.
Description for policy to be found here:


Comment 2 Thomas Woerner 2006-07-07 14:41:41 EDT
At first this has to make it into the kernel, second the header file has to get
integrated into glibc-kernheaders, then it can be enabled in iptables.

Assigning to kernel for now. 

Please assign to glibc-kernheaders afterwards and if it is done for these
packages, reassign to iptables.
Comment 4 Oliver Schulze L. 2007-07-12 10:23:17 EDT
any update on this bug?
Comment 6 Red Hat Bugzilla 2008-07-30 02:16:13 EDT
Adding fdechery@redhat.com to the cc list as the manager of the disabled user xoleron@redhat.com who reported this bug

Note You need to log in before you can comment on or make changes to this bug.