Re: [PATCH 2/2] Addrtype match extension: limit addrtype check on the packet's interface

[Laszlo Attila Toth <panther@balabit.hu>]

Patrick McHardy írta:
> Laszlo Attila Toth wrote:
>> +static bool match_v1(const struct sk_buff *skb,
>>            const struct net_device *in, const struct net_device *out,
>>            const struct xt_match *match, const void *matchinfo,
>>            int offset, unsigned int protoff, bool *hotdrop)
>>  {
>>      const struct ipt_addrtype_info *info = matchinfo;
>>      const struct iphdr *iph = ip_hdr(skb);
>> +    const struct net_device *limit_dev = (info->flags & 
>> IPT_ADDRTYPE_LIMIT_IFACE) ? in : NULL;
> 
> 
> The match can be used on any hook, using the incoming interface
> is a bit unflexible. How about using the incoming interface for
> src-address and outgoing interface for destination address matches?
> Alternatively add two flags to specify which device to use. You'll
> need to add proper checks of course to make sure the interface is
> valid for the hook the match is used in.

Two flags would be better because the forward chain can be handled 
specially. For all the others two different options arn't necessary.
In the forward chain both src and the dst addrtypes would be checked 
twice in this case, once on the input interface and once on the output.

-- 
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html