Patrick McHardy írta:
Laszlo Attila Toth wrote:
+static int match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const struct xt_match *match,
+ const void *matchinfo,
+ int offset,
+ unsigned int protoff,
+ int *hotdrop)
+{
+ const struct xt_ifgroup_info *info = matchinfo;
+
+ return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
The input interface is only valid in PREROUTING, INPUT and FORWARD.
Why don't you support output-interface matching?
The new version supports output-interface, currently I'm rewriting
iptables part. But I'm not sure what to do with the forward chain
because both input and output interface are valid here. My idea is that
the ifgroup_match function checks ifgroup values of both input and
output interfaces if they are set. An example:
iptables -A FORWARD -m ifgroup --in-ifgroup 4 --out-ifgroup 5/0x0f -j ACCEPT
The packet's input interface must be in group 4 and output interface
must be in group 5 but only lower 4 bits are checked. If one of these
assumptions fails the match fails.
Is it ok, or only one of them should be checked as in xt_policy: if
input side matches, other one is not checked?
--
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
