Re: [PATCH v2 3/3] ipset: change 'iface' part in hash:net,iface set

[Mr Dash Four <mr.dash.four@googlemail.com>]

  

>> There is a flip side to that particular coin - I could argue that since 
>> in/out *is* allowed to be used in hash:net,iface, why can't it be used 
>> in list:set where I could have hash:net,iface type sets accepted as 
>> members? You are imposing an unnecessary restriction where none is 
>> needed.
>>     
>
> Both a. and b. must satisfy that the result must not depend on the syntax. 
> If "in/out" is allowed in a rule then replacing by "src/dst" the result of 
> the iptables rule must remain the same. Whatever sets are in a list:set.
>   
I fail to see how your answer addresses my point above, which I raised 
in response to the restriction imposed by "solution a." of not allowing 
in/out in a list:set where there could be hash:net,iface members 
registered.

You know very well that by allowing in/out alongside src/dst in a 
list:set this *will* produce the same members match - that was your 
previous objection for not allowing in/out to be used alongside src/dst 
in list:set, until I found you this solution and then you swiftly moved 
the goalposts, again!

> I don't favour b. Ugly like hell, a. were much cleaner.
>   
You couldn't make this up! I mean, really Jozsef?

In a couple of hours yesterday, you went from:

"Solution b. is also acceptable but it's more controversial", then

"Therefore I'm not really happy with solution b. but I can stomach it", 
and finally, the above answer, not to mention that you started all of 
this with you being "unhappy" with users being "forced" to use src/dst 
only on list:set types.

In other words - you have gone full circle - twice - in a space of just 
a couple of days. I see that "debating" with you is becoming a bit of a 
pointless exercise.