Laszlo Attila Toth wrote:

Lutz Jaenicke írta:

quoted

On Tue, Nov 20, 2007 at 02:14:28PM +0100, Laszlo Attila Toth wrote:

quoted

Interface group values can be checked on both input and output 
interfaces
with optional mask.

quoted

Index: extensions/libxt_ifgroup.c
===================================================================

--- extensions/libxt_ifgroup.c    (revision 0)
+++ extensions/libxt_ifgroup.c    (revision 0)

quoted

+        info->in_group = strtoul(optarg, &end, 0);

This is somewhat inconsistent with the iproute patch which targets
specific groups (with names).
Should iptables be allowed to read "/etc/iproute2/rt_ifgroup"?

It would be good but cannot be used if a mask is set and only values 
less than 256 can be used with names.

Why 256? I can see no such limitation. For masks you could
simply allow to define masks in rt_ifgroup too and use
name/name or simply name/0xmask.

quoted

There is no standard API like getservbyname()...

The code of iproute2 should be copied. If Patrick says it is ok,  I'll 
write this part.

Of course. Please put the tab part somewhere common, I always
wanted to have named firewall marks shared with ip and tc
and I believe Balazs wanted that too :)