On 09.06, Pablo Neira Ayuso wrote:
> On Tue, Jun 09, 2015 at 11:23:19AM +0200, Patrick McHardy wrote:
> > My idea was to have the base chains bind to a device, then we can
> > create shared chains and jump to them from the base chain:
> >
> > table netdev ingress {
> > chain eth0 {
> > hook eth0 ingress;
> > jump shared_chain;
> > }
> > chain eth1 {
> > hook eth1 ingress;
> > jump shared_chain;
> > }
> > chain shared_chain {
> > ...
> > }
> > }
> >
> > I think if we treat the table namespace global, than the hook and base
> > chain is the natural place to specify the device since this is where
> > the packets actually enter.
>
> We can also achieve this sharing with the approach I describe above, I
> don't see any limitation on that.
Its not a limitation, merely something that seems slightly inconsistent.
The base chain definitions basically define the entry points and in this
case we define them in two steps, unlike in the other cases.
It also matches better what we have in the kernel. Its actually the
hooks that are per device and nothing else.
> If the user doesn't want to share any set and chain, he creates a
> separate table so there's a clear separation between namespaces.
> Thus, we don't allow user to make convoluted configurations in
> scenarios where he doesn't need to share anything.
Yes, but that wouldn't be different if we have the device binding in
the hook definition.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
