Re: `among' match

On Wednesday 03 September 2003 09:32, Grzegorz Borowiak wrote:
> On Wed, 3 Sep 2003, Bart De Schuymer wrote:
> > Perhaps it's better to make 2 matches out of it, one for source, one for
> > destination. That will save space if you only want source stuff.
>
> These matches would have most of their code shared and would differ only
> slightly. So we would have two pieces of code, each only slightly less
> than present one piece of code.

It should be possible to have both matches in one module. ebt_nat userspace is 
like that. Kernel space should be possible too, the only problem is the name 
of the matches, since currently ebtables tries to insmod ebt_matchname, which 
would fail if the match names are different from the kernel file containing 
both. But this is a userspace problem that can be fixed.

> > What would also be very nice, I think, is the following extension of your
> > module: have MAC address - IP address correspondences. So one could have
> > one anti-spoofing rule with lots of MAC-IP correspondences.
>
> OK, but such a match would be complicated in its way. It should check a
> protocol (IPV4 or ARP), then extract IP address dependently on protocol.
> So implementation of this would take some time for me, about 2 weeks
> (primarily, I'd like to implement some ebt features that I need, so they
> have higher priority).
>
> Maybe should I make this extended match as a separate module?

Yes, it would be a different module.

> Does ebtables interface allow to use variable-sized info structures? This
> would be necessary to achieve this.

Yeah it does. In userspace, you just need to update the size and possibly the 
pointer to the struct ebt_entry_match. The parse function has as argument 
"struct ebt_entry_match **match", so you can change the pointer to the 
ebt_entry_match if f.e. you need more memory for the match data.

> I plan, so this would be nice.

OK.

cheers,
Bart




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf