per-interface packet filters [summary]

[Gleb Smirnoff]

On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote:
J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote:
J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote:
J> > J> The way we have approached this in the past is to install /32 host routes
J> > J> for each interface addr's and respective subnet and broadcast /32 addresses
J> > J> into the kernel RIB, destined to lo0 interface. Place your per-interface
J> > J> filter on 'lo0' interface and packets destined to router iteslf will be
J> > J> subject to loopback filter before making it onto upper layer protocol.
J> > 
J> > I was thinking of this idea, too. So, it works?
J> 
J> It works indeed. If folks want me to, I'll provide patches to ip_fastfwd.c
J> after christmas-new-year break. (I have too much stuff on my plate right now)

Please do it.

J> Just to note, the patch will _not_ touch ip_input.c. Receive path should not
J> even exist on a host system, only on a router running hard core routing code
J> (aka ip_fastforward() being the routing code).

I agree on this point (also read your another mail about ip_fastforward).

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE