From owner-freebsd-net@FreeBSD.ORG Thu May 29 13:32:41 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 562235F0 for ; Thu, 29 May 2014 13:32:41 +0000 (UTC) Received: from mail-oa0-x22e.google.com (mail-oa0-x22e.google.com [IPv6:2607:f8b0:4003:c02::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1C93B2A22 for ; Thu, 29 May 2014 13:32:41 +0000 (UTC) Received: by mail-oa0-f46.google.com with SMTP id g18so316476oah.19 for ; Thu, 29 May 2014 06:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=8VYFCqPLNFAEP+uen4+ioovRy59A9jssHdpS0PYPkWk=; b=A1Uh10tiiNxRXT4AlJxCOyfQTrx+8ZhxbFlSSvEjQ+fVFu29z6D0X+5ptUtWjM3bGS pEUtV+mdj2atDcCEtWIvK5F5kPUo+7AAIuMDgn+an8eRMCdpnmKBGvGm5iOIlid8XzC8 5/cXNuu++un59GB9sXg1AhriYnN3D7AxORVKAA0VUQgEyB4GVETLRF9WTXHgKeRG9TKb fIjYQ+iAxWIYKV7fGolEAx4sqyY1R01Kk9Es1nleWZ/UM9fM/cFsTj+Dr1UXt2dKgrGs n5BvSLgtyA+LwBt3oJey5zd9oJeDrKLC9EIrekyMrvLFXndcAAUfQHaOrnjaD+h3kyTo shbA== MIME-Version: 1.0 X-Received: by 10.182.109.226 with SMTP id hv2mr8188602obb.79.1401370360420; Thu, 29 May 2014 06:32:40 -0700 (PDT) Received: by 10.76.170.39 with HTTP; Thu, 29 May 2014 06:32:40 -0700 (PDT) In-Reply-To: <20140529131015.GA72798@onelab2.iet.unipi.it> References: <001b01cf7b3b$dfd1cfb0$9f756f10$@gmail.com> <20140529131015.GA72798@onelab2.iet.unipi.it> Date: Thu, 29 May 2014 15:32:40 +0200 Message-ID: Subject: Re: propose a new generic purpose rule option for ipfw From: Andreas Nilsson To: Luigi Rizzo Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18 Cc: FreeBSD Net , bycn82 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 May 2014 13:32:41 -0000 On Thu, May 29, 2014 at 3:10 PM, Luigi Rizzo wrote: > On Thu, May 29, 2014 at 08:45:26PM +0800, bycn82 wrote: > ... > > > > Sure, that is the reason why developers are providing more and more rule > options. But the my question is do we have enough options to match all the > fixed position values? > > we do not have an option for fixed position matching. > > As i said, feel free to submit one and i will be happy to > import it if the code is clean (btw i am still waiting > for fixes to the other 'rate limiting' option you sent), > but keep in mind that 'fixed position' is mostly useless. > > More useful options would be one where you express the position as > > '{MAC|VLAN|IP|UDP|TCP|...|PAYLOAD}+offset' > > so at least you can adapt to variant headers, or one where you can look > for a pattern in the entire packet or in a portion of it. > > cheers > luigi > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" > Wouldn't PAYLOAD require possibly reassembly of a fragmented packet? It certainly is a good feature, don't get me wrong. But what are the performance hits? Best regards Andreas