Re: ipt_time fixes (resend, sorry)

[Brad Fisher <brad@info-link.net>]

Samuel Jean wrote:

>Hi!
>
>On Thu, January 20, 2005 12:18 pm, Krzysztof Oledzki said:
>
>..snip..
>
>  
>
>>On Thu, 20 Jan 2005, Brad Fisher wrote:
>>    
>>
>>>To match 20:00 - 4:00 you currently need 2 rules:
>>>1) match 20:00 - 23:59
>>>2) match 0:00 - 4:00
>>>What I'm proposing is to allow this to be reduced to one rule.
>>>      
>>>
>
>What Brad proposes makes so much sense, IMHO. I haven't looked at this
>code yet (ipt_time) but I thought it already behaves that way. Apperently
>not, since you both complain about it.
>
>  
>
>>So, again.. You need something like invert flag in -m like in the -p:
>>
>>iptables -A something ! -m time --timestart 4:01 --timestop 19:59 -j
>>DoSomething
>>
>>This one should match 20:00-20:59 and 0:00-4:00, true?
>>    
>>
>
>I wasn't aware you can negate --match options. Are you sure we can do this ?
>
>  
>

I haven't found any generic capability to negate matches.  I could see 
this being possibly useful, and could reduce the need for every 
individual match to implement some sort of negation internally.  Of 
course, it may not make sense to be able to negate some types of matches 
(no examples come to mind though).

>>Right now you can use:
>>
>>iptables -N Match20_4
>>iptables -A Match20_4 -m time --timestart 4:01 --timestop 19:59 -j RETURN
>>iptables -A Match20_4 -j DoSomething
>>
>>This one should match 20:00-20:59 and 0:00-4:00, true?
>>    
>>
>
>Yes, but rather ugly :) I strongly suggest adding support to it. As Brad
>did mention, another 'if' condition produces less latency than superfluous
>packet iteration.
>  
>
It also makes the ruleset more complex by adding a custom chain and two 
rules where I'd like to only have one rule.  Your example may work fine 
and not add much complexity when multiple rules may jump to the new 
chain, but if you need to match multiple time ranges this way, it could 
really bulk up your ruleset for no real reason.  It'd just be nice if 
the time match handled this in a way that doesn't require such 
workarounds in the first place.

>>Best regards,
>>
>> 			Krzysztof Olêdzki
>>    
>>
>
>Cheers!
>
>Samuel
>  
>
-Brad