Laszlo Attila Toth wrote:
Patrick McHardy írta:
The input interface is only valid in PREROUTING, INPUT and FORWARD.
Why don't you support output-interface matching?
The new version supports output-interface, currently I'm rewriting
iptables part. But I'm not sure what to do with the forward chain
because both input and output interface are valid here. My idea is that
the ifgroup_match function checks ifgroup values of both input and
output interfaces if they are set. An example:
iptables -A FORWARD -m ifgroup --in-ifgroup 4 --out-ifgroup 5/0x0f -j
ACCEPT
The packet's input interface must be in group 4 and output interface
must be in group 5 but only lower 4 bits are checked. If one of these
assumptions fails the match fails.
Is it ok, or only one of them should be checked as in xt_policy: if
input side matches, other one is not checked?
xt_policy is a special case because the policy structure is so
large I decided the user should better use the match twice if
he really needs it (its also a quite uncommon use). For the
ifgroup match I think it should behave exactly as the -i and -o
matches: allow matching both in FORWARD, input device in
PREROUTING and INPUT and output device in OUTPUT and POSTROUTING.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
