From owner-freebsd-net@FreeBSD.ORG Tue Dec 14 13:07:16 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C20D316A4CE; Tue, 14 Dec 2004 13:07:16 +0000 (GMT) Received: from relay.bestcom.ru (relay.bestcom.ru [217.72.144.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id C578743D49; Tue, 14 Dec 2004 13:07:15 +0000 (GMT) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (root@cell.sick.ru [217.72.144.68]) by relay.bestcom.ru (8.13.1/8.12.9) with ESMTP id iBED7DJB068984 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 14 Dec 2004 16:07:13 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (glebius@localhost [127.0.0.1]) by cell.sick.ru (8.12.11/8.12.8) with ESMTP id iBED7C1p046526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 14 Dec 2004 16:07:12 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: (from glebius@localhost) by cell.sick.ru (8.12.11/8.12.11/Submit) id iBED7CLp046525; Tue, 14 Dec 2004 16:07:12 +0300 (MSK) (envelope-from glebius@freebsd.org) X-Authentication-Warning: cell.sick.ru: glebius set sender to glebius@freebsd.org using -f Date: Tue, 14 Dec 2004 16:07:12 +0300 From: Gleb Smirnoff To: Andre Oppermann Message-ID: <20041214130712.GA46386@cell.sick.ru> Mail-Followup-To: Gleb Smirnoff , Andre Oppermann , Luigi Rizzo , Max Laier , freebsd-net@freebsd.org References: <20041213124051.GB32719@cell.sick.ru> <20041213104200.A62152@xorpc.icir.org> <20041214085123.GB42820@cell.sick.ru> <20041214015603.A75019@xorpc.icir.org> <41BEE0E7.BD2316EB@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <41BEE0E7.BD2316EB@freebsd.org> User-Agent: Mutt/1.5.6i X-Virus-Scanned: clamd / ClamAV version devel-20041013, clamav-milter version 0.75l on 127.0.0.1 X-Virus-Status: Clean cc: Luigi Rizzo cc: freebsd-net@freebsd.org cc: Max Laier Subject: Re: per-interface packet filters [summary] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Dec 2004 13:07:16 -0000 On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote: A> > Implementationwise, the kernel side is evidently trivial as the A> > original code already supports the idea of multiple chains. All A> > you need is to extend the struct ifnet with a pointer to the chain, A> > or use some other trick (e.g. going through ifindex) to quickly A> > associate a chain to the input (and possibly output) interface. A> A> Nonononononononononononononononononononononono. A> A> There MUST NOT be any firewall specific pointers or other information A> in struct ifnet or any other non-firewall private part of the kernel. A> Otherwise the entire independence we've gained with the nice and clean A> PFIL_HOOKS API goes down the drain. This MUST NOT happen again. A> A> The whole idea of the PFIL_HOOKS is to have independend and loadable A> firewall modules with different approaches, internal designs and so A> on. The whole idea of PFIL_HOOKS is to have independend and loadable firewall modules, which can be attached to different parts of kernel! There is no such requirement that, pfil hooks MUST be sticked to a single entry point in ip_input() and ip_output(). Pfils attached to interface belong to interface, and thus should be stored in struct ifnet. This is the way it is done in per-interface filters. A> For example a way Gleb can get his way without any bickering from us A> is by creating his own gleb-firewall module using the PFIL_HOOKS API A> and put it into the ports tree for easy access, provided he doesn't A> modify the PFIL_HOOKS API (which he doesn't have to). I am not going to create a new firewall or change PFIL_HOOKS. I'm going to attach *the existing* pfil_hooks to a different place, to perform filtering with *existing* firewalls. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE