From: Patrick McHardy <kaber@trash.net>
To: Laszlo Attila Toth <panther@balabit.hu>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 2/2] Addrtype match extension: limit addrtype check on the packet's interface
Date: Thu, 18 Oct 2007 11:16:49 +0200 [thread overview]
Message-ID: <47172481.601@trash.net> (raw)
In-Reply-To: <11921980402033-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> +static bool match_v1(const struct sk_buff *skb,
> const struct net_device *in, const struct net_device *out,
> const struct xt_match *match, const void *matchinfo,
> int offset, unsigned int protoff, bool *hotdrop)
> {
> const struct ipt_addrtype_info *info = matchinfo;
> const struct iphdr *iph = ip_hdr(skb);
> + const struct net_device *limit_dev = (info->flags & IPT_ADDRTYPE_LIMIT_IFACE) ? in : NULL;
The match can be used on any hook, using the incoming interface
is a bit unflexible. How about using the incoming interface for
src-address and outgoing interface for destination address matches?
Alternatively add two flags to specify which device to use. You'll
need to add proper checks of course to make sure the interface is
valid for the hook the match is used in.
next prev parent reply other threads:[~2007-10-18 9:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-12 14:03 [PATCH 0/2] address type match limited to incoming interface Laszlo Attila Toth
2007-10-12 14:07 ` [PATCH 1/2] Find address type on a specific or on any interface Laszlo Attila Toth
2007-10-12 14:07 ` [PATCH 2/2] Addrtype match extension: limit addrtype check on the packet's interface Laszlo Attila Toth
2007-10-18 9:16 ` Patrick McHardy [this message]
2007-10-18 11:34 ` Laszlo Attila Toth
2007-10-20 14:50 ` Laszlo Attila Toth
2007-10-18 9:13 ` [PATCH 1/2] Find address type on a specific or on any interface Patrick McHardy
-- strict thread matches above, loose matches on Subject: below --
2007-10-05 15:20 Tóth László Attila
2007-10-05 15:23 ` [PATCH 2/2] Addrtype match extension: limit addrtype check on the packet's interface Tóth László Attila
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47172481.601@trash.net \
--to=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=panther@balabit.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).