Date: Tue, 13 Feb 2001 09:25:10 -0800 (PST) From: Luigi Rizzo <rizzo@aciri.org> To: phk@critter.freebsd.dk (Poul-Henning Kamp) Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw.c ip_fw.h src/sbin/ipfw ipfw.8 ipfw.c Message-ID: <200102131725.f1DHPKO31020@iguana.aciri.org> In-Reply-To: <51205.982073676@critter> from Poul-Henning Kamp at "Feb 13, 2001 3:14:36 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> > The check is semi expensive (traverses the interface address list) any input packet needs to traverse the interface address list. If there is an efficiency problem there, the fix is to use a hash table to lookup local addresses. BTW can you explain me the logic in INADDR_TO_IFP ? I am not sure i understand why IFF_POINTOPOINT is considered differently here and not in ip_input(). > It would be more elegant to have multiple lists of ipfw rules: > One input list per interface > One output list per interface > One list for packets being forwarded > One list for packets arriving locally > One list for packets originating locally what would you apply to 'forwarded' packets ? Just the 'forward' list (very hard to do in practice, as you might have to backtrack, think of divert sockets) or the set <input,forward,output> ? > And it would be trivial to implement this in a backwards compatible [ok the following is just driven by thinking at how to implement this in the most efficient way...] In terms of elegance, remember that an access list is no different than a set of (current) ipfw rules with the same rule number and a final acceptall or denyall action (current rules are more flexible as they permit GOTO). Implementationwise, we could just associate a starting rule number (currently is 0 for all) to each interface. The relevant pointer to the starting rule could be in the interface descriptor, not in ipfw, so the lookup has O(1) cost. Of course, next time someone will ask to have rulesets on a per-interface-address basis, not just on a per-interface basis... The only gain in terms of performance would be when we have many interfaces (or aliases) and different processing for each of them, which in the current configuration requires some kind of switch statement at the beginning to select the good ruleset. cheers luigi ----------------------------------+----------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . ACIRI/ICSI (on leave from Univ. di Pisa) http://www.iet.unipi.it/~luigi/ . 1947 Center St, Berkeley CA 94704 Phone: (510) 666 2927 ----------------------------------+----------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200102131725.f1DHPKO31020>