lkml.org 
[lkml]   [1997]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Firewalling Rules
Date
On Fri, 31 Oct 1997 10:47:51 -0500 (EST), 
"Richard B. Johnson" <root@chaos.analogic.com> wrote:
>I have not looked at the firewall code. However, I think that firewall
>rules just create and/or modify entries within a hash-table or two. [snip]
>I hope that, if there are 'N' rules, there are not 'N' entries that have
>to be scanned for every incoming packet. If so, you could make better
>use of your time rewriting the packet filter.

It's a serial chain for each rule type (-I/-O/-F). Firewall code
serially scans the relevant chain until it finds an entry that matches
or drops off the end and uses the policy setting. The masquerade port
lookup is hashed but the rules are not.

IMHO there is no chance of firewall rules being hashed. The design of
the filter requires that the rules be scanned top to bottom. However
there is hope, "Paul Rusty Russell" <Paul.Russell@rustcorp.com.au> has
written patches (http://www.adelaide.net.au/~rustcorp) to represent the
rules as a tree with user defined structure. Makes rule scanning
faster and it is easier to test new firewall configurations.



\
 
 \ /
  Last update: 2005-03-22 13:40    [from the cache]
©2003-2011 Jasper Spaans