From owner-freebsd-net@FreeBSD.ORG Wed Dec 15 12:10:37 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AF7F616A4D6; Wed, 15 Dec 2004 12:10:37 +0000 (GMT) Received: from relay.bestcom.ru (relay.bestcom.ru [217.72.144.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id A704843D4C; Wed, 15 Dec 2004 12:10:36 +0000 (GMT) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (root@cell.sick.ru [217.72.144.68]) by relay.bestcom.ru (8.13.1/8.12.9) with ESMTP id iBFCAY0w093228 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 15 Dec 2004 15:10:35 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (glebius@localhost [127.0.0.1]) by cell.sick.ru (8.12.11/8.12.8) with ESMTP id iBFCAYah055681 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 15 Dec 2004 15:10:34 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: (from glebius@localhost) by cell.sick.ru (8.12.11/8.12.11/Submit) id iBFCAXfq055680; Wed, 15 Dec 2004 15:10:33 +0300 (MSK) (envelope-from glebius@freebsd.org) X-Authentication-Warning: cell.sick.ru: glebius set sender to glebius@freebsd.org using -f Date: Wed, 15 Dec 2004 15:10:33 +0300 From: Gleb Smirnoff To: Andre Oppermann Message-ID: <20041215121033.GM54307@cell.sick.ru> Mail-Followup-To: Gleb Smirnoff , Andre Oppermann , freebsd-net@freebsd.org References: <41BEF2AF.470F9079@freebsd.org> <20041215091135.GC53509@cell.sick.ru> <41C01A2C.24104876@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <41C01A2C.24104876@freebsd.org> User-Agent: Mutt/1.5.6i X-Virus-Scanned: clamd / ClamAV version devel-20041013, clamav-milter version 0.75l on 127.0.0.1 X-Virus-Status: Clean cc: freebsd-net@freebsd.org Subject: Re: per-interface packet filters, design approach X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2004 12:10:38 -0000 On Wed, Dec 15, 2004 at 12:04:12PM +0100, Andre Oppermann wrote: A> > On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote: A> > A> d1. The PFIL_HOOKS API has one hook per direction per protocol and A> > A> passes the interface information to the firewall package. A> > A> d2. Should the PFIL_HOOKS API be changed and be per interface instead A> > A> of per protocol? All firewall packages need to be modified and A> > A> we are no longer compatible with the PFIL_HOOKS API. A> > A> > s/API/usage/g A> A> See my previous mail why your proposal is broken by design. Probably many routers are broken by design, too? A> > Andre, you are the person, who is optimizing our IP stack. Can you ask A> > this question, please: if the interface has no filters associated with it, A> > why the hell the packets running on it would enter firewall functions? A> A> Listen Gleb, first and formost I'm cleaning up network stack from years A> of bolt-on hackery to make it maintainable and easily understandable and A> extendable again. But 4.x is more STABLE than 5.x, while it has rotten design, isn't it? Moreover some things stopped working because of better design! Now we have kern/71910, kern/73129, kern/73910, plus dozens of people who do not write PR because they see these three. But we have better design. A> If there is a trade-off to be made between a few CPU cycles wasted with a A> clean and structured design versus some hackery pseudo-optimization I'm A> going to do the former. This is always the more viable choice. A> When looking at the BSD history one thing stands out: Wherever we had a A> very clean, concise and documented API (for example protocol independent A> sockets) things started to fly. In the network area we have the protosw A> structure and API which allows to add any type of network protocol very A> easily into the kernel. This has allowed BSD to support many different A> network protocols. Most recently IPv6. The price to pay for the small A> indirection protosw has is nothing compared to the adavantages of a good A> and clean API design. A> A> History tells us that sticking to certain design principals pays off very A> well and is worth some amount of performance tradeoffs. Feel free to ask A> Kirk McKusick on this lession of history. Good. I'm trying to convince you that design of attaching filters to interfaces is not mad, and we should choose it, stick to it, and be happy. Protocol level packet filters are excellent for hosts, but not for routers. You ain't say that we are building not a router platform. We are building a multipurpose platform, that's why I suggest protocol level and per-interface filters coexist. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE