Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Tue, Oct 15, 2013 at 04:23:13PM +0200, Florian Westphal wrote: > > Uses same syntax as iptables: itfname+. > > Good you're bringing up this issue, we've been discussing this for a > while with recent Anand's patch. > > > The '+' suffix is not stored on the kernel side; this approach > > is the same as the one used by iptables-nftables. > > Hm, it seems current iptables-nftables seems broken by: > > 73ea1cc nft: convert rule into a command state structure I tested with latest ipt-nft (42531b3a6) -- admittingly, I did only test xt-save output, which adds '+' postfix in the no-trailing-nul case. > > Caveats: > > - I am not convinced '+' is a good idea -- it is ambiguous since > > 'foo+' is a legal interface name. > > I think we can remove the '+' in nft, so we match exactly what we > pass for the ifname case, eg. iifname "eth". Hm. "iifname eth1": Should it match eth1? Yes. But what about eth10, eth1.42, etc? I think we need an explicit way to resolve the ambiguity; relying on 'if_nametoinfex()' and just using index matching if we find an interface is not a good idea, it could fail too often in practice, or lead to unexpected results if rules are loaded before interfaces are brought up. > > - removes a FIXME in netlink_delinearize. What was that about? :-} > > I don't remember the reason for that case, please try to dig it out > from the history. Thanks! // FIXME if (left->len && left->dtype && left->dtype->type != TYPE_STRING ... is from Patricks initial commit. Lets see if Patrick remembers :) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
