Re: nomatch in bitmap:* sets

[Mr Dash Four <mr.dash.four@xxxxxxxxxxxxxx>]

> > Currently only hash:* sets have the "nomatch" feature. Could this be 
> > extended to bitmap:* sets as well?
> >     
>
> Actually, hash:*net* types have the "nomatch" feature. How would it make 
> sense to add it to the bitmap:* types too?
>   
I was thinking along the lines of this:

1. bitmap:port - currently, if I want to exclude specific ports from a 
given range (say ports 21,80,119,443 from ports range 1-1023) then I 
have to do the following:
n test-ports bitmap:port range 1-1023 timeout 0
a test-ports 1-20
a test-ports 22-79
a test-ports 81-118
a test-ports 120-442
a test-ports 444-1023

Very inconvenient and it is not immediately obvious which ports have 
been excluded from that range. By doing something like this:
n test-ports bitmap:port range 1-1023 timeout 0
a test-ports 1-1023
a test-ports 21 nomatch
a test-ports 80 nomatch
a test-ports 119 nomatch
a test-ports 443 nomatch

it is much more clearer what is going on.

2. bitmap:ip - same as above really: If I want to exclude a particular 
IP addresses from a given range (say 10.1.1.3, 10.1.1.9 and 10.1.1.14 
from 10.1.1.0/24) I have to do almost the same as with bitmap:port set 
above:
n test-bitmap-net bitmap:ip range 10.1.1.0/24 timeout 0
a test-bitmap-net 10.1.1.0-10.1.1.2
a test-bitmap-net 10.1.1.4-10.1.1.8
a test-bitmap-net 10.1.1.10-10.1.1.13
a test-bitmap-net 10.1.1.15-10.1.1.255

Again, it is not immediately obvious what has been excluded. By doing 
something like the following:
n test-bitmap-net bitmap:ip range 10.1.1.0/24 timeout 0
a test-bitmap-net 10.1.1.0/24
a test-bitmap-net 10.1.1.3 nomatch
a test-bitmap-net 10.1.1.9 nomatch
a test-bitmap-net 10.1.1.14 nomatch

that it is much more clearer.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html