Date: Thu, 8 Dec 2005 17:12:23 +0100 From: Claudio Jeker <cjeker@diehard.n-r-g.com> To: freebsd-net@freebsd.org Subject: Re: Programming Question: Policy Based Routing Message-ID: <20051208161245.GB19179@diehard.n-r-g.com> In-Reply-To: <f85d6aa70512080315k7861b9f8w@mail.gmail.com> References: <f85d6aa70512071854h1b41f10o@mail.gmail.com> <4397A2D1.452F290A@freebsd.org> <f85d6aa70512080315k7861b9f8w@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Dec 08, 2005 at 01:15:04PM +0200, Ivo Vachkov wrote: > > Normally it's the other way around. > > So be it :) > > My definition of Policy-Based Routing (PBR): ability make routing > decision based on information other than destination IP address in the > packet. In my project this "other" information includes source ip > address, L4 protocol, tos, packet length. > > Implementation: > > Plan 1) This is complex standalone solution implemented entirely in > the kernel, plus userland utilities (like the route command). Whole > current routing engine will be changed. Instead of Patricia tree I > implement a list of data structures, each one including special mask > which identifies what field of the IP header are used to match the > packet and an AVL tree to store routing information in it. Algorithm > is simple: An AVL tree is far from optimal for route lookups -- think about longest prefix matches. It is even worse than a Patricia tree. Also doing the packet classification as part of the route lookup is IMO a bad idea. Also the linear list that needs to be traversed for every packet is very expensive because you can only do one comparison at a time. > Plan B) *Somehow very Linuxish* Using some sort of packet classifier > (for example packet filter matching code) it marks the packet with a > some user defined value. Example: > ipfw add mark 10 ip from 192.168.0.0/24 to 192.168.10.0/24 > and: > pbr_route add -mark 10 $gateway > The kernel implementation should check for such marks on every packet > and search them in a binary search tree (AVL probably). > > That's it. Please, excuse my bad english and poor explanations. If you > have any questions I'll try to explain better, probably using more > examples. > This is a better approach and much simpler. Pf and IPFW have a powerful classifier and with tables, states, ... it is possible to reduce the classification time significantly. -- :wq Claudio
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051208161245.GB19179>