propose a new generic purpose rule option for ipfw
bycn82 at gmail.com
Thu May 29 12:45:30 UTC 2014
Sure your generic binary match could be a welcome
addition to ipfw. But its usefulness is extremely
limited in practice, as it only lets you match stuff
in fixed position of a packet, and it is not even good
to do other relatively simple things such as skip
options and the like.
Sure. When the user need to fulfill a feature and there is a rule option for it. Then in this scenario . the user should definitely use the option. Except the user this testing this feature.
If you have spare time you might try how hard would it be
to hook the in-kernel bpf to ipfw. That would be a superset
of what you propose, and avoids duplication of effort and features.
By the way, what is in-kernel bpf. I ve read your dummynet already, still have some place not clear.
This said, even bpf is not a generic firewall mechanism.
Much of the power of a firewall comes from the availability of high
level functions and data structures and metadata access functions
to reduce the complexity and improve the quality of matches.
Many of the ipfw options are just for that: address and port
bitmaps, tables, reverse path lookup, metadata lookups and so on.
Sure, that is the reason why developers are providing more and more rule options. But the my question is do we have enough options to match all the fixed position values?
More information about the freebsd-net