Re: [PATCH nft] documentation: try to clarify iif vs. iifname.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Nov 04, 2018 at 08:05:20PM +0100, Florian Westphal wrote:
[...]
> diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt
> index 761f50bc1392..5846898e170e 100644
> --- a/doc/primary-expression.txt
> +++ b/doc/primary-expression.txt
> @@ -15,6 +15,29 @@ directly or as qualified meta expressions. Meta l4proto is useful to match a
>  particular transport protocol that is part of either an IPv4 or IPv6 packet. It
>  will also skip any IPv6 extension headers present in an IPv6 packet.
>  
> +meta iif, oif, iifname and oifname are used to match the interface a packet
> +arrived on or is about to be sent out on.
> +
> +iif and oif are used to match on the interface index, whereas iifname and
> +oifname are used to match on the interface name.
> +This is not the same -- assuming the rule
> +
> +  filter input meta iif "foo"
> +
> +Then this rule can only be added if the interface "foo" exists.
> +Also, the rule will continue to match even if the
> +interface "foo" is renamed to "bar".
> +
> +This is because internally the interface index is used.
> +In case of dynamically created interfaces, such as tun/tap or dialup
> +interfaces (ppp for example), it might be better to use iifname or oifname
> +instead.
> +
> +In these cases, the name is used so the interface doesn't have to exist to
> +add such a rule, it will stop matching if the interface gets renamed and it
> +will match again in case interface gets deleted and later a new interface
> +with the same name is created.

This looks good to me.

You can probably mention that iif is faster than iifname, but I think
it's better if you don't say so.

I observe people doing very stupid things in the name of performance.

So please push it as it is.

Thanks Florian!



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux