On Sun, 8 Jul 2012, Mr Dash Four wrote: > > > > with your patches in some cases "src,in" == "src,src" or "src,in" != > > > > "src,src" > > > > > > > Could you provide me with an example please? I am intrigued! > > > > > > > This is ridiculous, as if I haven't provided it countless times: > > > > iptables -A INPUT -m set --match-set list1 src,src -j ACCEPT > > iptables -A INPUT -m set --match-set list1 src,in -j ACCEPT > > > Well, in the above example I fail to see where "src,in" == "src,src" - > that is *never* the case! According to your patches if list1 contains *only* hash:net,iface type of setst, then "src,in" == "src,src" because iptables -A INPUT -m set --match-set list1 src,in -j ACCEPT is identical in result with iptables -A INPUT -m set --match-set list1 src,src -j ACCEPT However, if list1 contains hash:net,iface type of sets *and* other types as well, then "src,in" != "src,src" because iptables -A INPUT -m set --match-set list1 src,in -j ACCEPT is not identical in result with iptables -A INPUT -m set --match-set list1 src,src -j ACCEPT Moreover, "list1" can be updated with new member sets any time, and depending on the *syntax*, again, the result may change. You have exhausted my patience in this, I won't repeat it again. > > > So, in other words, what you are actually getting at, is that you wish to > > > restrict the use of 'in' and 'out' options only for hash:net,iface types > > > because you are not happy with the use of 'in'/'out' in any other set > > > types, > > > list:set in particular? Have I understood this correctly then? > > > > That's a possible - probably the simplest - solution. It's OK for me. > > > So, let me get this straight then: you wish 'in' and 'out' to be accepted as > input (and I presume also displayed as well) *only* for hash:net,iface type of > sets and rejected (possibly with an error) everywhere else? > > In other words: > 1. For hash:net,iface the possible options should be 'in', 'out', 'src' and > 'dst'; and > 2. For all other sets, including list:set the only available options should be > 'src' and 'dst'. Have I understood this correctly then? Yes, that looks OK. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
