Re: `among' match
Grzegorz Borowiak <[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.devel |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 3 Sep 2003, Bart De Schuymer wrote:
> Perhaps it's better to make 2 matches out of it, one for source, one for
> destination. That will save space if you only want source stuff.
These matches would have most of their code shared and would differ only
slightly. So we would have two pieces of code, each only slightly less
than present one piece of code.
> What would also be very nice, I think, is the following extension of your
> module: have MAC address - IP address correspondences. So one could have one
> anti-spoofing rule with lots of MAC-IP correspondences.
OK, but such a match would be complicated in its way. It should check a
protocol (IPV4 or ARP), then extract IP address dependently on protocol.
So implementation of this would take some time for me, about 2 weeks
(primarily, I'd like to implement some ebt features that I need, so they
have higher priority).
Maybe should I make this extended match as a separate module?
> Also, the negation ('!') should be added, as in "not in this list of MAC
> addresses".
No problem.
> I haven't had a look at the hash implementation,
Most of this is explained in a large comment in ebt_among.h, read this
before you will read the code (the code is somewhat dizzy).
> but I think that if feasable the number of MAC addresses should be
> configurable, not hard-coded to 256.
Does ebtables interface allow to use variable-sized info structures? This
would be necessary to achieve this.
Not if you mean compile-time configuration like "make menuconfig", of
course, but then you would have to compile kernel and userspace utility
with the same parameter.
It would be a nice toy for very special, rare cases, but there is no
problem to enable this.
> I'll put your code in the CVS. If you plan on doing more coding for ebtables,
> I could give you write access to the CVS.
I plan, so this would be nice.
--
Grzesław
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf