From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Bligh Subject: Re: [ANNOUNCE] ipset 6.13 released Date: Tue, 10 Jul 2012 17:27:59 +0100 Message-ID: References: <4FF02A93.8080603@googlemail.com> <4FF04038.4080306@googlemail.com> <4FF04647.7060807@googlemail.com> <4FF04DDA.3020609@googlemail.com> Reply-To: Alex Bligh Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Content-Disposition: inline Sender: netfilter-devel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Jozsef Kadlecsik , Amos Jeffries Cc: Mr Dash Four , netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy , Alex Bligh --On 2 July 2012 09:54:20 +0200 Jozsef Kadlecsik wrote: > - my view follows how the subsytem sees the interfaces > > ------------------ > pkt comes in --- interface | ipset subsytem | interface --- pkt goes out > ^ ------------------ ^ > source destination I have no comment on the back compatibility issue, but from a clean sheet these interfaces should probably be called "ingress" and "egress" interfaces (or, if you must 'input' and 'output' but those are ripe for confusion with iptables rules). If those aren't the terms in the RFCs, they are certainly terms of art commonly used by router vendors. >From my point of view, the current nomenclature is better than reversing them (as I think is being proposed), but they are confusing in the case of forwarded traffic where neither interface might be the 'source' or 'destination' in an IP sense. Swapping them would cause more confusion. -- Alex Bligh