netdev - Re: [PATCH 2/2] Interface group match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4715D117.3080405@balabit.hu>
Date:	Wed, 17 Oct 2007 11:08:39 +0200
From:	Laszlo Attila Toth <panther@...abit.hu>
To:	Patrick McHardy <kaber@...sh.net>
CC:	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org
Subject: Re: [PATCH 2/2] Interface group match - netfilter part

Patrick McHardy írta:
> Laszlo Attila Toth wrote:
>> +static int match(const struct sk_buff *skb,
>> +      const struct net_device *in,
>> +      const struct net_device *out,
>> +      const struct xt_match *match,
>> +      const void *matchinfo,
>> +      int offset,
>> +      unsigned int protoff,
>> +      int *hotdrop)
>> +{
>> +    const struct xt_ifgroup_info *info = matchinfo;
>> +
>> +    return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
> 
> The input interface is only valid in PREROUTING, INPUT and FORWARD.
> Why don't you support output-interface matching?
> 

The new version supports output-interface, currently I'm rewriting 
iptables part. But I'm not sure what to do with the forward chain 
because both input and output interface are valid here. My idea is that 
the ifgroup_match function checks ifgroup values of both input and 
output interfaces if they are set. An example:

iptables -A FORWARD -m ifgroup --in-ifgroup 4 --out-ifgroup 5/0x0f -j ACCEPT

The packet's input interface must be in group 4 and output interface 
must be in group 5 but only lower 4 bits are checked. If one of these 
assumptions fails the match fails.

Is it ok, or only one of them should be checked as in xt_policy: if 
input side matches, other one is not checked?

-- 
Attila
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html