ipset and interfaces

ipset and interfaces

[Oskar Berggren]

Hi,

Regarding ipsets.... how crazy would it be to add a set type
containing interface names?

And how crazy would it be to add a set type containing tuples of
ip-address and interface name?  (I.e. the set match would look for ip,
and match if a tuple with the proper interface is found)


/Oskar

Re: ipset and interfaces

[Jozsef Kadlecsik]

On Tue, 24 May 2011, Oskar Berggren wrote:

> Regarding ipsets.... how crazy would it be to add a set type
> containing interface names?

Usually the number of interfaces are not quite high in a system, so it 
does not seem required.

> And how crazy would it be to add a set type containing tuples of
> ip-address and interface name?  (I.e. the set match would look for ip,
> and match if a tuple with the proper interface is found)

What is the case where a combination of matches does not solve the issue? 
Something like this

-N interfaces
-A interfaces -i foo -j ACTION
...

-A rule -m set --match-set src -j interfaces

and thus you can match IP addresses and possible (incoming) interfaces 
easily.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: ipset and interfaces

[Oskar Berggren]

2011/5/24 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
> On Tue, 24 May 2011, Oskar Berggren wrote:
>
>> Regarding ipsets.... how crazy would it be to add a set type
>> containing interface names?
>
> Usually the number of interfaces are not quite high in a system, so it
> does not seem required.

I have machines with plenty of vlans. About 700 interfaces in the
largest instance currently.
That said, I don't have a clear use case for this particular set type
currently, but out of curiosity,
would it be reasonably doable within the ipset framework?


>
>> And how crazy would it be to add a set type containing tuples of
>> ip-address and interface name?  (I.e. the set match would look for ip,
>> and match if a tuple with the proper interface is found)
>
> What is the case where a combination of matches does not solve the issue?
> Something like this
>
> -N interfaces
> -A interfaces -i foo -j ACTION
> ...
>
> -A rule -m set --match-set src -j interfaces
>
> and thus you can match IP addresses and possible (incoming) interfaces
> easily.


As above, about 700 interfaces, each with a generally just a few
source ip-addresses
expected for each interface, or a few subnets. I.e. in the simplest
case a single ip is
acceptable for a single interface, for a total of a couple of hundred
interfaces. This
is similar to rp_filter, but I had trouble getting that to work
predictably with multiple
routing tables. Currently I've solved it with a tree structure of
iptables chains and rules,
but being able to use a single set for this would look so much nicer.

/Oskar
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: ipset and interfaces

[Jozsef Kadlecsik]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 2144 bytes --]

On Tue, 24 May 2011, Oskar Berggren wrote:

> 2011/5/24 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
> > On Tue, 24 May 2011, Oskar Berggren wrote:
> >
> >> Regarding ipsets.... how crazy would it be to add a set type
> >> containing interface names?
> >
> > Usually the number of interfaces are not quite high in a system, so it
> > does not seem required.
> 
> I have machines with plenty of vlans. About 700 interfaces in the 
> largest instance currently. That said, I don't have a clear use case for 
> this particular set type currently, but out of curiosity, would it be 
> reasonably doable within the ipset framework?

Yes, I don't see any problem here.
 
> >> And how crazy would it be to add a set type containing tuples of
> >> ip-address and interface name?  (I.e. the set match would look for ip,
> >> and match if a tuple with the proper interface is found)
> >
> > What is the case where a combination of matches does not solve the issue?
> > Something like this
> >
> > -N interfaces
> > -A interfaces -i foo -j ACTION
> > ...
> >
> > -A rule -m set --match-set src -j interfaces
> >
> > and thus you can match IP addresses and possible (incoming) interfaces
> > easily.
> 
> As above, about 700 interfaces, each with a generally just a few source 
> ip-addresses expected for each interface, or a few subnets. I.e. in the 
> simplest case a single ip is acceptable for a single interface, for a 
> total of a couple of hundred interfaces. This is similar to rp_filter, 
> but I had trouble getting that to work predictably with multiple routing 
> tables. Currently I've solved it with a tree structure of iptables 
> chains and rules, but being able to use a single set for this would look 
> so much nicer.

So it looks like a valid case, for a new set type with interfaces and IP 
addresses/networks ;-) I'll work on it.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: ipset and interfaces

[Anton VG]

Hm, my largest instance is about 200 vlan's ;)

2011/5/24 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
> On Tue, 24 May 2011, Oskar Berggren wrote:
>
>> 2011/5/24 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
>> > On Tue, 24 May 2011, Oskar Berggren wrote:
>> >
>> >> Regarding ipsets.... how crazy would it be to add a set type
>> >> containing interface names?
>> >
>> > Usually the number of interfaces are not quite high in a system, so it
>> > does not seem required.
>>
>> I have machines with plenty of vlans. About 700 interfaces in the
>> largest instance currently. That said, I don't have a clear use case for
>> this particular set type currently, but out of curiosity, would it be
>> reasonably doable within the ipset framework?
>
> Yes, I don't see any problem here.
>
>> >> And how crazy would it be to add a set type containing tuples of
>> >> ip-address and interface name?  (I.e. the set match would look for ip,
>> >> and match if a tuple with the proper interface is found)
>> >
>> > What is the case where a combination of matches does not solve the issue?
>> > Something like this
>> >
>> > -N interfaces
>> > -A interfaces -i foo -j ACTION
>> > ...
>> >
>> > -A rule -m set --match-set src -j interfaces
>> >
>> > and thus you can match IP addresses and possible (incoming) interfaces
>> > easily.
>>
>> As above, about 700 interfaces, each with a generally just a few source
>> ip-addresses expected for each interface, or a few subnets. I.e. in the
>> simplest case a single ip is acceptable for a single interface, for a
>> total of a couple of hundred interfaces. This is similar to rp_filter,
>> but I had trouble getting that to work predictably with multiple routing
>> tables. Currently I've solved it with a tree structure of iptables
>> chains and rules, but being able to use a single set for this would look
>> so much nicer.
>
> So it looks like a valid case, for a new set type with interfaces and IP
> addresses/networks ;-) I'll work on it.
>
> Best regards,
> Jozsef
> -
> E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear Physics
>          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: ipset and interfaces

[Mr Dash Four]

> So it looks like a valid case, for a new set type with interfaces and IP 
> addresses/networks ;-) I'll work on it.
>   
Keep in mind though, that interfaces can be specified in "-i" as well as 
"-o" (i.e. input as well as output) - so you need to create some sort of 
matching mechanism which distinguishes between these. Obviously this is 
currently resolved in iptables with the "-i" and -"o" options respectively.