There is a flip side to that particular coin - I could argue that since
in/out *is* allowed to be used in hash:net,iface, why can't it be used
in list:set where I could have hash:net,iface type sets accepted as
members? You are imposing an unnecessary restriction where none is
needed.
Both a. and b. must satisfy that the result must not depend on the syntax.
If "in/out" is allowed in a rule then replacing by "src/dst" the result of
the iptables rule must remain the same. Whatever sets are in a list:set.
I fail to see how your answer addresses my point above, which I raised
in response to the restriction imposed by "solution a." of not allowing
in/out in a list:set where there could be hash:net,iface members
registered.
You know very well that by allowing in/out alongside src/dst in a
list:set this *will* produce the same members match - that was your
previous objection for not allowing in/out to be used alongside src/dst
in list:set, until I found you this solution and then you swiftly moved
the goalposts, again!
I don't favour b. Ugly like hell, a. were much cleaner.
You couldn't make this up! I mean, really Jozsef?
In a couple of hours yesterday, you went from:
"Solution b. is also acceptable but it's more controversial", then
"Therefore I'm not really happy with solution b. but I can stomach it",
and finally, the above answer, not to mention that you started all of
this with you being "unhappy" with users being "forced" to use src/dst
only on list:set types.
In other words - you have gone full circle - twice - in a space of just
a couple of days. I see that "debating" with you is becoming a bit of a
pointless exercise.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
