<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Setting bit mark according to result of lookup"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1125#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Setting bit mark according to result of lookup"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1125">bug 1125</a>
from <span class="vcard"><a class="email" href="mailto:uzytkownik2@gmail.com" title="Maciej Piechotka <uzytkownik2@gmail.com>"> <span class="fn">Maciej Piechotka</span></a>
</span></b>
<pre>(In reply to Robert White from <a href="show_bug.cgi?id=1125#c1">comment #1</a>)
<span class="quote">> Put the value from the map into the mark first.
>
> e.g. start the mark construction with
>
> add rule wherever wherever meta mark set iif map @iface_to_mark
>
> Then compose in your other stuff...
> </span >
This wouldn't work as the idea is that the packet gets a bitmask of interfaces
as it goes through the bridge filter. So if we have eth0 and eth1 both under
br0 and eth0 -> b001, eth1 -> b010, br0 -> b100 then packets from eth0 would
have b101 and from eth1 b110.
<span class="quote">> Also the group numbers "exist" before any interfaces are even configured
> because, hey, integers exist. So by moving interfaces in and out of groups
> you can radically change their behaviors without having to load/update any
> rules or sets/maps/dictionaries
>
> More complicated arrangements may need more groups.
> </span >
OTOH names are more user-readable and I don't have very high performance
requirements[1].
[1] That said in the current version there is chicken-and-egg problem between
nft and interfaces. Ideally you would want the firewall up and running before
setting the network. But to use high performance features such as iff you need
to set up it after the network as you need to create interfaces and some
interfaces might require network itself (tunnels etc.). I guess the simplest
thing would be to (re-)JIT on network creation/destruction/rename i/offname so
that the i/off is substituted for interface and compiles out for non-existing
interface.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>