lkml.org 
[lkml]   [1997]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Firewalling Rules (Was: Linux Kernels)
Date
In message <199710311643.RAA03450@cave.BitWizard.nl> you write:
> Richard B. Johnson wrote:
> >
> > On Fri, 31 Oct 1997, Matthew Kirkwood wrote:
> > > So -- Am I a fool, or should I make some hacking time this weekend? :)
> > >
> > > Matthew.
> >
> > I have not looked at the firewall code. However, I think that firewall
> > rules just create and/or modify entries within a hash-table or two. If so,
> > you are just adding/modifying entries to an existing table when using
> > the cumbersome utility. The code should already be somewhat optimized so
> > your net-gain from a lot of work might be near zero.
> >
> > I hope that, if there are 'N' rules, there are not 'N' entries that have
> > to be scanned for every incoming packet. If so, you could make better
> > use of your time rewriting the packet filter.
>
> I don't think you can work with has tables easily: you don't know how
> specific a rule is going to hit this packet. So you cannot generate a
> usable hash-code from a packet that just came in that will point you
> towards the right firewall rule. If all rules would specify a complete
> host, then you'd be able to make a hash based on the source IP. However
> now you've got 32 possible netmasks that might make a rule match.

If you ARE hitting a performance limit, I'd love you to try the
Generic IP Firewalling patches which makes logical organisation
easier. At:

http://www.adelaide.net.au/~rustcorp/ipfwchains/ipfwchains.html

The best solution to the optimisation problem is to use the packet
counters attached to each rule to reorder them to have the most
commonly matched ones at the top. Reordering rules without changing
the semantics is the trick (and doing it atomically is impossible
without my Generic IPFW patch -- shameless plug).

Since Linus has announced an impending code-slush, I'm hoping to do
more work on this in the coming few days, including just such an
optimiser utility.

Paul.
--
.sig lost in the mail.

\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.561 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site