Re: [PATCH 2/2] Interface group match - netfilter part

[Patrick McHardy <kaber@trash.net>]

Laszlo Attila Toth wrote:
> Patrick McHardy írta:
>
>> The input interface is only valid in PREROUTING, INPUT and FORWARD.
>> Why don't you support output-interface matching?
>>
> 
> The new version supports output-interface, currently I'm rewriting 
> iptables part. But I'm not sure what to do with the forward chain 
> because both input and output interface are valid here. My idea is that 
> the ifgroup_match function checks ifgroup values of both input and 
> output interfaces if they are set. An example:
> 
> iptables -A FORWARD -m ifgroup --in-ifgroup 4 --out-ifgroup 5/0x0f -j 
> ACCEPT
> 
> The packet's input interface must be in group 4 and output interface 
> must be in group 5 but only lower 4 bits are checked. If one of these 
> assumptions fails the match fails.
> 
> Is it ok, or only one of them should be checked as in xt_policy: if 
> input side matches, other one is not checked?


xt_policy is a special case because the policy structure is so
large I decided the user should better use the match twice if
he really needs it (its also a quite uncommon use). For the
ifgroup match I think it should behave exactly as the -i and -o
matches: allow matching both in FORWARD, input device in
PREROUTING and INPUT and output device in OUTPUT and POSTROUTING.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html