Re: [patch] RFC: matching interface groups

["Gerd v. Egidy" <lists@egidy.de>]

Hi,

> > > Since in this scenario userspace is able to determine ppp vs pptp,
> > > could you not also do something like have an inbound_ppp and
> > > inbound_pptp chain, then jump to the appropriate chain depending on
> > > type?  If you need per-interface rules, then create an inbound_pppX
> > > chain, populate it with rules, then jump to that chain if -i pppX.  In
> > > ip-down, just delete the chain as well as the jump.
> >
> > if I understood Balazs correctly, one of the things he wanted to
> > avoid is addition/deletion of iptables rules on every pppX interface
> > up/down
>
> Exactly.

We faced a similar problem: we wanted to not only differentiate between ppp 
and pptp interfaces but even between different providers connected via ppp 
and pptp.

We ended up predefining all possible providers in the rules and differentiate 
between them using the ipt_condition module. This module is not very 
well-loved in the netfilter community but there are usecases like this where 
it comes in handy.

Maybe this is a solution for you too.

> > as this would require the complete chain (say, INPUT or
> > OUTPUT) to be "downloaded" to userspace, modified and then again
> > "uploaded" to the kernel. At least until iptables redesign to
> > allow replacement/insertion/deletion of single rules is completed
> > which if started at all will take quite some more time :-)
>
> Iptables operates on a per-table basis, so it is not only the INPUT or
> OUTPUT chain that needs to be down and uploaded, but the whole filter
> table.

The problem with the current solution is not only speed and maintainability 
but also locking: if two device up/down events happen at the same time in 
this scenario, the tabels will become wrong until you develop some kind of 
userspace locking.

Kind regards,

Gerd