From owner-freebsd-pf@FreeBSD.ORG Wed Jul 19 10:54:55 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A8FA516A4E0 for ; Wed, 19 Jul 2006 10:54:55 +0000 (UTC) (envelope-from rajkumars@gmail.com) Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.171]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9E18E43D53 for ; Wed, 19 Jul 2006 10:54:54 +0000 (GMT) (envelope-from rajkumars@gmail.com) Received: by ug-out-1314.google.com with SMTP id m2so247737uge for ; Wed, 19 Jul 2006 03:54:53 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=OUOOniLEjQo9W6qkOyM0tihnLsY3nEH6m+uwuGG3LpJn1yFRdC0Mu5f1L/3OKn1OOnnWe9whA26HHSL3Cc73saO8xROmpKzl8q1XnNWPvaF4C/T/NUDhkl4f+87Pw1fMPmcdPGMwj+CNAz0ttVbjgmXbjCin1o+CeT+/If9oWgs= Received: by 10.78.170.17 with SMTP id s17mr256549hue; Wed, 19 Jul 2006 03:54:53 -0700 (PDT) Received: by 10.78.120.13 with HTTP; Wed, 19 Jul 2006 03:54:53 -0700 (PDT) Message-ID: <64de5c8b0607190354r6fec30afh3e1d10c5463e31eb@mail.gmail.com> Date: Wed, 19 Jul 2006 16:24:53 +0530 From: "Rajkumar S" To: freebsd-pf@freebsd.org In-Reply-To: <64de5c8b0607182320m6c9d0d9er5636de052e448bf3@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <64de5c8b0607181030h64d7d539r788ba7bbc6841e4d@mail.gmail.com> <200607181950.10304.max@love2party.net> <64de5c8b0607182320m6c9d0d9er5636de052e448bf3@mail.gmail.com> Subject: Re: Program to add/delete a rule from pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2006 10:54:55 -0000 On 7/19/06, Rajkumar S wrote: > Just to clarify once more, My requirement is to add and remove rules > like the one below inside an anchor. > > block in quick on fxp0 proto tcp from 192.168.3.3 port 1025 to > 64.233.167.99 port 80 > block in quick on fxp0 proto tcp from 192.168.3.23 port 1054 to > 72.14.207.99 port 8080 Got a reply from Daniel Hartmeier in the main pf list: Why don't you create sub-anchors, one for each single rule? Then removing one rule (and the sub-anchor that contains it) can be done by simply flushing the sub-anchor. You need one call in the main ruleset or the existing anchor, using the wildcard '*', that call evaluates all sub-anchors, and the call doesn't need to be updated when you insert/remove sub-anchors. You could even use the sub-anchor names in some clever way, like put the rule's expiration time (unix epoch) in that string, so to purge expired rules, you can traverse the list of sub-anchors alphabetically and stop when a name is larger than time(NULL). Or store some ID in the name (which your plugin associates with the entry), which helps you purge the sub-anchor without traversing them all searching for some rule. Unless you expect to have several thousand rules like this concurrently, the overhead of the sub-anchor evaluation isn't that terrible. IIRC, the ioctl API once contained a call to insert/remove one particular rule in a certain place of the ruleset, but it was cumbersome, and the entire (sub-)anchor concept makes it superfluous in most cases. Daniel This basically solves my problem. Thanks every one for help and suggetions. raj