Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 19 Sep 2005 09:11:33 -0600
From:      Brett Glass <brett@lariat.org>
To:        Luigi Rizzo <rizzo@icir.org>
Cc:        net@freebsd.org
Subject:   Re: Efficient use of Dummynet pipes in IPFW
Message-ID:  <6.2.3.4.2.20050919085600.07f783f0@localhost>
In-Reply-To: <20050919005932.B60737@xorpc.icir.org>
References:  <6.2.3.4.2.20050918205708.08cff430@localhost> <20050918235659.B60185@xorpc.icir.org> <6.2.3.4.2.20050919010035.07dfc448@localhost> <20050919005932.B60737@xorpc.icir.org>

next in thread | previous in thread | raw e-mail | index | archive | help
At 01:59 AM 9/19/2005, Luigi Rizzo wrote:

>Same for as the 'resume' option. It might be nice to have,
>however but there is already a two-rule version (the one i
>suggested, follow the non-terminating action with a skipto rule)
>so its absence is not blocking you from doing what you want.

That option requires repeating ALL of the matching on the packet.
Not efficient, especially if the rule is complex. And pipes
are usually used in pairs, so the inefficiency is doubled.

>in terms of implementation, if you want to add it, the best place
>would be to add the 'skipto' fields to each 'action' opcode.
>I am not very interested in implementing it, though, because i still see
>ipfw as a low-level language.

I don't see it that way, because low level languages like assembler 
are normally very efficient and highly granular. The underlying
opcode language of IPFW is low level for sure. But I would classify 
IPFW's "language," as presented by the userland utility, as "high 
level but limited." Sort of like the MS-DOS shell.

>> I've looked at the source and it's fragmented and virtually undocumented,
>
>are you talking about the userland part or the kernel code ?

Both. There are some parts that are better than others; for
example, the kernel part is more straightforward than the
userland part and has more comments.

Yes, I know: some coders (the NetBSD folks are notorious for this) 
seem to think that if you don't want to read (and mentally reverse-
engineer) all of the C code, you shouldn't be touching it. But this 
leads to bugs, because even a good coder won't know about "contracts" 
involving code in other places.

>i agree the userland part is a mess.
>But the kernel code i believe is reasonably documented
>(of course it could be documented better - patches welcome).
>the first 250 or so lines in ip_fw2.h are almost all comments
>describing the opcode formats.
>ip_fw2.c tries to describe rule parsing in the body of ipfw_chk()

Yep, I see that. But there are implicit contracts with the userland
side.... Some are obvious but some seem to be subtle.

--Brett Glass




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6.2.3.4.2.20050919085600.07f783f0>