Re: [PATCH iptables] nft: check for source and destination address in first place

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 01, 2023 at 09:28:28PM +0200, Pablo Neira Ayuso wrote:
> When generating bytecode, check for source and destination address in
> first place, then, check for the input and output device. In general,
> the first expression in the rule is the most evaluated during the
> evaluation process. These selectors are likely to show more variability
> in rulesets.

The change is effective only for rules which match on both address(es)
and interface(s) anyway.

Patch applied, thanks!



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux