per-interface packet filters [summary]

[Andre Oppermann]

Luigi Rizzo wrote:
> 
> On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote:
> ...
> > > Implementationwise, the kernel side is evidently trivial as the
> > > original code already supports the idea of multiple chains.  All
> > > you need is to extend the struct ifnet with a pointer to the chain,
> > > or use some other trick (e.g. going through ifindex) to quickly
> > > associate a chain to the input (and possibly output) interface.
> >
> > Nonononononononononononononononononononononono.
> 
> andre you need to cool down a bit!

I'm not angry but frustrated.  In the network area it's too much 'lets
quickly hack this in' instead of 'lets carefully design this in'.

> i said "use some other trick" exactly to avoid changing
> the struct ifnet. All i meant to say is that we want a unique
> key, possibly in a small namespace, to quickly locate the per-if
> private firewall info. How the key is used is not a business of
> the rest of the kernel. But of course if it is an index in a
> smallish array (such as ifindex) the thing is fast and clean.

Ok, I'm fine with *this* approach.

This can be done and handled inside ipfw_check_in|out() based on the
interface pointer information passed in from pfil_run_hooks().

Then inside IPFW it can be implemented with multiple rule chains
although I'm not convinced this would be the smartest approach.

Wouldn't it be even better to have per-interface and global rules
after each other?  This way your problem with the general rule
synching can be solved.

-- 
Andre