Date: Thu, 29 May 2014 15:32:40 +0200 From: Andreas Nilsson <andrnils@gmail.com> To: Luigi Rizzo <rizzo@iet.unipi.it> Cc: FreeBSD Net <freebsd-net@freebsd.org>, bycn82 <bycn82@gmail.com> Subject: Re: propose a new generic purpose rule option for ipfw Message-ID: <CAPS9%2BSsfZ4J_PS4eLfqqhVv8YWn2XPT1u71VNjnpoodnsWDJGw@mail.gmail.com> In-Reply-To: <20140529131015.GA72798@onelab2.iet.unipi.it> References: <CAC%2BJH2x08jGWyaRKoE8PwXcwv555EhDP576-WJd5vZDrF%2Bnsbg@mail.gmail.com> <CA%2BhQ2%2BgQZQXOj8Ga%2Br%2BORMKX-WVXo=aTND-EA0WPF3Z%2BR30j-g@mail.gmail.com> <001b01cf7b3b$dfd1cfb0$9f756f10$@gmail.com> <20140529131015.GA72798@onelab2.iet.unipi.it>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 29, 2014 at 3:10 PM, Luigi Rizzo <rizzo@iet.unipi.it> wrote:
> On Thu, May 29, 2014 at 08:45:26PM +0800, bycn82 wrote:
> ...
> >
> > Sure, that is the reason why developers are providing more and more rule
> options. But the my question is do we have enough options to match all the
> fixed position values?
>
> we do not have an option for fixed position matching.
>
> As i said, feel free to submit one and i will be happy to
> import it if the code is clean (btw i am still waiting
> for fixes to the other 'rate limiting' option you sent),
> but keep in mind that 'fixed position' is mostly useless.
>
> More useful options would be one where you express the position as
>
> '{MAC|VLAN|IP|UDP|TCP|...|PAYLOAD}+offset'
>
> so at least you can adapt to variant headers, or one where you can look
> for a pattern in the entire packet or in a portion of it.
>
> cheers
> luigi
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
Wouldn't PAYLOAD require possibly reassembly of a fragmented packet?
It certainly is a good feature, don't get me wrong. But what are the
performance hits?
Best regards
Andreas
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPS9%2BSsfZ4J_PS4eLfqqhVv8YWn2XPT1u71VNjnpoodnsWDJGw>