Date: Sun, 5 Sep 2004 14:37:31 -0700 (PDT) From: Matthew Dillon <dillon@apollo.backplane.com> To: Luigi Rizzo <luigi@freebsd.org> Cc: net@freebsd.org Subject: Re: bridge callbacks in if_ed.c? Message-ID: <200409052137.i85LbV1V053075@apollo.backplane.com> References: <20040905205249.GA81337@cell.sick.ru> <20040905142036.A23213@xorpc.icir.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Well, wait a second... are we talking about a lot of packets being
discarded by the filter in 'normal' operation, or are we talking about
an attack? Because if we are takling about an attack the LAST ethernet
device anyone would ever want to use would be ED. i.e. they would be
under a major cpu load anyway and would be far better served using a
better ethernet card. It seems silly to leave a major hack in the system
just to support attacks on an ethernet device that nobody in their right
mind would use if they expected to be attacked! Also, most ED devices
are limited to 10BaseT (?), it's hard to imagine how the added load could
possibly make things any worse then they would otherwise be, and similarly
hard to imagine why anyone would want to use a programmed-I/O interface
at 100BaseT or greater speeds (I'd say that the poor guy would deserve
what he gets from that!).
-Matt
:there are performance reasons to do this way -- grabbing
:the entire packet is expensive because it is done via programmed
:I/O, so the current code only grabs the header, does the
:filtering, and grabs the rest of the packet only if
:needed.
:
:Probably the current code runs bridge_in_ptr() twice, but I
:believe this is still cheaper than grabbing all packets
:entirely.
:
:I'd rather not apply the patch unless you can show that
:the current code leads to incorrect behaviour.
:
:cheers
:luigi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200409052137.i85LbV1V053075>