From: Anand Raj Manickam <anandrm@gmail.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>, netfilter-devel@vger.kernel.org
Subject: Re: [RFC PATCH nft] src: add support for interface wildcard name
Date: Wed, 16 Oct 2013 18:48:04 +0530 [thread overview]
Message-ID: <CAEyr1FTnZV0tr4qCYSbW3MUotUXLUqMhs7k6zZO3_ip9WTn12A@mail.gmail.com> (raw)
In-Reply-To: <20131016130154.GA10886@localhost>
On Wed, Oct 16, 2013 at 6:31 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Oct 16, 2013 at 02:58:39PM +0200, Pablo Neira Ayuso wrote:
>> On Wed, Oct 16, 2013 at 01:00:43PM +0200, Florian Westphal wrote:
>> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> > > On Tue, Oct 15, 2013 at 04:23:13PM +0200, Florian Westphal wrote:
>> > > > Uses same syntax as iptables: itfname+.
>> > >
>> > > Good you're bringing up this issue, we've been discussing this for a
>> > > while with recent Anand's patch.
>> > >
>> > > > The '+' suffix is not stored on the kernel side; this approach
>> > > > is the same as the one used by iptables-nftables.
>> > >
>> > > Hm, it seems current iptables-nftables seems broken by:
>> > >
>> > > 73ea1cc nft: convert rule into a command state structure
>> >
>> > I tested with latest ipt-nft (42531b3a6) -- admittingly, I did only
>> > test xt-save output, which adds '+' postfix in the no-trailing-nul case.
>> >
>> > > > Caveats:
>> > > > - I am not convinced '+' is a good idea -- it is ambiguous since
>> > > > 'foo+' is a legal interface name.
>> > >
>> > > I think we can remove the '+' in nft, so we match exactly what we
>> > > pass for the ifname case, eg. iifname "eth".
>> >
>> > Hm. "iifname eth1": Should it match eth1? Yes. But what about eth10,
>> > eth1.42, etc? I think we need an explicit way to resolve the ambiguity;
>>
>> I think "iffname eth1" should mean match "eth1\0".
>
> Oh I see, the ambiguity comes from nft syntax, then we do need some
> the wildcard character, yes.
>
> We can add "ifname-mask eth0", thus,
>
> ifname-mask eth1 means match "eth1", including eth1, eth1.0, etc.
> ifname eth1 means match "eth1\0".
iptables use the mask in kernel (ip_packet_match) to do the wildcard match.
Currently ipt-nft does use the MASK for the rule validation and with
patch submitted earlier , it should now help us to ADD/DELETE rules.
The opinion here is to push the offset/mask validation on the
nft_meta_eval in kernel ?
next prev parent reply other threads:[~2013-10-16 13:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-15 14:23 [RFC PATCH nft] src: add support for interface wildcard name Florian Westphal
2013-10-16 10:39 ` Pablo Neira Ayuso
2013-10-16 11:00 ` Florian Westphal
2013-10-16 11:02 ` Patrick McHardy
2013-10-16 12:58 ` Pablo Neira Ayuso
2013-10-16 13:01 ` Pablo Neira Ayuso
2013-10-16 13:18 ` Anand Raj Manickam [this message]
2013-10-20 11:49 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAEyr1FTnZV0tr4qCYSbW3MUotUXLUqMhs7k6zZO3_ip9WTn12A@mail.gmail.com \
--to=anandrm@gmail.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).