Re: [PATCH 2/2] Interface group match - netfilter part

[Laszlo Attila Toth <panther@balabit.hu>]

Patrick McHardy írta:
> Laszlo Attila Toth wrote:
>> +static int match(const struct sk_buff *skb,
>> +      const struct net_device *in,
>> +      const struct net_device *out,
>> +      const struct xt_match *match,
>> +      const void *matchinfo,
>> +      int offset,
>> +      unsigned int protoff,
>> +      int *hotdrop)
>> +{
>> +    const struct xt_ifgroup_info *info = matchinfo;
>> +
>> +    return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
> 
> The input interface is only valid in PREROUTING, INPUT and FORWARD.
> Why don't you support output-interface matching?
> 

The new version supports output-interface, currently I'm rewriting 
iptables part. But I'm not sure what to do with the forward chain 
because both input and output interface are valid here. My idea is that 
the ifgroup_match function checks ifgroup values of both input and 
output interfaces if they are set. An example:

iptables -A FORWARD -m ifgroup --in-ifgroup 4 --out-ifgroup 5/0x0f -j ACCEPT

The packet's input interface must be in group 4 and output interface 
must be in group 5 but only lower 4 bits are checked. If one of these 
assumptions fails the match fails.

Is it ok, or only one of them should be checked as in xt_policy: if 
input side matches, other one is not checked?

-- 
Attila