From c0fc3e499f4bacbb7a1976afe33af143d34b068e Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Fri, 8 Apr 2011 16:04:22 +0200 Subject: bitmap:ip,mac type requires "src" for MAC Enforce that the second "src/dst" parameter of the set match and SET target must be "src", because we have access to the source MAC only in the packet. The previous behaviour, that the type required the second parameter but actually ignored the value was counter-intuitive and confusing. Manpage is updated to reflect the change. --- src/ipset.8 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/ipset.8 b/src/ipset.8 index 9603ddc..d9e5ff8 100644 --- a/src/ipset.8 +++ b/src/ipset.8 @@ -302,9 +302,10 @@ matched by the kernel, it will automatically fill out the missing MAC address wi source MAC address from the packet. If the entry was specified with a timeout value, the timer starts off when the IP and MAC address pair is complete. .PP -Please note, the \fBset\fR match and \fBSET\fR target netfilter kernel modules -\fBalways\fR use the source MAC address from the packet to match, add or delete -entries from a \fBbitmap:ip,mac\fR type of set. +The \fBbitmap:ip,mac\fR type of sets require two \fBsrc/dst\fR parameters of +the \fBset\fR match and \fBSET\fR target netfilter kernel modules and the second +one must be \fBsrc\fR to match, add or delete entries because the \fBset\fR match +and \fBSET\fR target have access to the source MAC address only. .PP Examples: .IP -- cgit v1.2.3