Date: Thu, 29 May 2014 16:15:59 +0200 From: 'Luigi Rizzo' <rizzo@iet.unipi.it> To: bycn82 <bycn82@gmail.com> Cc: 'FreeBSD Net' <freebsd-net@freebsd.org> Subject: Re: propose a new generic purpose rule option for ipfw Message-ID: <20140529141559.GC74344@onelab2.iet.unipi.it> In-Reply-To: <003201cf7b44$bfd6ed40$3f84c7c0$@gmail.com> References: <CAC%2BJH2x08jGWyaRKoE8PwXcwv555EhDP576-WJd5vZDrF%2Bnsbg@mail.gmail.com> <CA%2BhQ2%2BgQZQXOj8Ga%2Br%2BORMKX-WVXo=aTND-EA0WPF3Z%2BR30j-g@mail.gmail.com> <001b01cf7b3b$dfd1cfb0$9f756f10$@gmail.com> <20140529131015.GA72798@onelab2.iet.unipi.it> <003201cf7b44$bfd6ed40$3f84c7c0$@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 29, 2014 at 09:48:58PM +0800, bycn82 wrote: > > > -----Original Message----- > From: 'Luigi Rizzo' [mailto:rizzo@iet.unipi.it] > Sent: 29 May, 2014 21:10 > To: bycn82 > Cc: 'FreeBSD Net' > Subject: Re: propose a new generic purpose rule option for ipfw > > > > On Thu, May 29, 2014 at 08:45:26PM +0800, bycn82 wrote: > > ... > > > > > > Sure, that is the reason why developers are providing more and more rule options. But the my question is do we have enough options to match all the fixed position values? > > > > we do not have an option for fixed position matching. > > > > Can I say that ???It will be useful when a user come up with a special requirement which cannot be fulfilled by any existing rule option.??? Since there are so many rule options already. So I don???t know when that special requirement will appear. L that is what you said ???useless???, I accept that . please re-read what i said below. 'mostly useless' != 'useless', and i am ok importing a clean implementation. > As i said, feel free to submit one and i will be happy to import it if the code is clean (btw i am still waiting for fixes to the other 'rate limiting' option you sent), but keep in mind that 'fixed position' is mostly useless. > > Which `rate limiting`, the `Packet per second`? > > http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/189720 ok commented the remaining problems with a separate email. > More useful options would be one where you express the position as > > > > '{MAC|VLAN|IP|UDP|TCP|...|PAYLOAD}+offset' > > > > It is possible, > > match <position> <mask> <value> > > the <mask> can be a pattern , then that means it can match multiple value at the same time. what i wrote is a completely different thing. Never mind. cheers luigi > > > > so at least you can adapt to variant headers, or one where you can look for a pattern in the entire packet or in a portion of it. > > > cheers > > luigi > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140529141559.GC74344>