propose a new generic purpose rule option for ipfw

[bycn82]

Sure your generic binary match could be a welcome

addition to ipfw. But its usefulness is extremely

limited in practice, as it only lets you match stuff

in fixed position of a packet, and it is not even good

to do other relatively simple things such as skip

options and the like.

 

Sure. When the user need to fulfill a feature and there is a rule option for it. Then in this scenario . the user should definitely use the option. Except the user this testing this feature.

 

If you have spare time you might try how hard would it be

to hook the in-kernel bpf to ipfw. That would be a superset

of what you propose, and avoids duplication of effort and features.

 

By the way, what is in-kernel bpf. I ve read your dummynet already, still have some place not clear.

 

This said, even bpf is not a generic firewall mechanism.

 

Much of the power of a firewall comes from the availability of high

level functions and data structures and metadata access functions

to reduce the complexity and improve the quality of matches.

Many of the ipfw options are just for that: address and port

bitmaps, tables, reverse path lookup, metadata lookups and so on.

 

Sure, that is the reason why developers are providing more and more rule options. But the my question is do we have enough options to match all the fixed position values?

 

cheers

luigi