On Fri, 2006-08-04 at 12:06 +0200, Patrick McHardy wrote: > Balazs Scheidler wrote: > > The use-case is as follows: > > > > * I have two different subsystems creating interfaces dynamically (for > > example pptpd and serial pppd lines, each creating dynamic pppX > > interfaces), > > * I would like to assign a different set of iptables rules for these > > clients, > > * I would like to react to a new interface being added to a specific set > > in a userspace application, > > > > The reasons I see this needs new kernel functionality: > > > > * iptables supports wildcard interface matching (for example "iptables > > -i ppp+"), but as the names of the interfaces used by PPTPD and PPPD > > cannot be distinguished this way, this is not enough, > > * Reloading the iptables ruleset everytime a new interface comes up is > > not really feasible, as it abrupts packet processing, and validating the > > ruleset in the kernel can take significant amount of time, > > * the kernel change is very simple, adapting userspace to this change is > > also very simple, and in userspace various software packages can easily > > interoperate with each-other once this is merged. > > > > The implementation: > > > > Each interface can belong to a single "group" at a time, an interface > > comes up without being a member in any of the groups. > > > > Userspace can assign interfaces to groups after being created, this > > would typically be performed in /etc/ppp/ip-up.d (and similar) scripts. > > > > In spirit "interface group" is somewhat similar to the "routing > > protocol" field for routing entries, which contains information on which > > routing daemon was responsible for adding the given route entry. > > > > Things to be done if you like this approach: > > > > * interface group match in iptables, > > * support for naming interface groups in userspace, a'la routing > > protocols, > > * emitting a netlink notification when the group of an interface > > changes, > > * possibly converting the "ip link" command to use NETLINK messages, > > instead of using ioctl() > > > > What do you think? > > > I like it .. kind of like routing realms. For your specific case there > is a possible solution already supported by the kernel, you can > pre-allocate ppp devices using PPPIOCNEWUNIT, rename them and later > attach to individual units in the ppp daemon using PPPIOCATTACH > (I have a patch for this somewhere if you're interested). But that > only works for PPP devices and the group idea looks more flexible.
Thanks for liking it :) I'm going to implement a complete patch with iptables match and support for naming interface groups like routing realms and post it when I'm ready. I'd go for the more general solution as I have other interfaces not just ppp, it was just a trivial example. -- Bazsi - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
