Re: per-interface packet filters [summary]

From: Kelly Yancey (kbyanc_at_posi.net)
Date: 12/16/04

  • Next message: Дмитрий Двойников: "Divert sockets no longer behave like connected (SS_ISCONNECTED is removed from so->so_state)" 
    Date: Wed, 15 Dec 2004 16:36:12 -0800 (PST)
To: Andre Oppermann <andre@freebsd.org>

    On Thu, 16 Dec 2004, Andre Oppermann wrote:

    > Kelly Yancey wrote:
    > >
    > > How about a generic per-interface pfil demultiplexer? That is, a module
    > > that uses the existing pfil hooks to in turn call per-interface hooks.
    > > As Luigi suggested earlier, it would be possible to use the interface
    > > index to index an array private to the multiplexer's implementation.
    > > If each element in this array had its own pfil_head, then the demultiplexer
    > > could then call pfil_run_hooks() using that list. This would allow you
    > > to have your per-interface hooks in a generic way without changing a line
    > > of existing code. It could be entirely encapsulated in kld. Provided an
    > > API to manipulate the per-interface pfil registration, you could even run
    > > different filters on different interfaces.
    > > You'de even have a chance of back-porting it to FreeBSD 5.x since you
    > > won't be changing the ifnet structure at all.
    >
    > You'd have to change all firewall packages too. Currently they are not
    > aware of and can't deal with multiple rule chain heads. The is the
    > second main problem of Gleb implementation proposal so far.
    >
    > Nothing prevents generic routines to have the demultiplexer you describe
    > but it's use and handling has to be inside each firewall package.
    >

      Absolutely. You could only use such a demultiplexer to select which
    interfaces filters would apply to. The issue of implementing different
    behavior depending on the interface (e.g. a firewall implementing
    per-interface rulesets) is necessarily a matter for the filter not the
    framework.
      That said, since we have 3 firewall implementations, you could use the
    demultiplexer to have 3 different sets of rules, each applied to a different
    subset of the interfaces. :)

      Kelly 

    --
Kelly Yancey  -  kbyanc@{posi.net,FreeBSD.org}  -  kelly@nttmcl.com
"An enlightened people, and an energetic public opinion... will control and
 enchain the aristocratic spirit of the government." --Thomas Jefferson
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Дмитрий Двойников: "Divert sockets no longer behave like connected (SS_ISCONNECTED is removed from so->so_state)"

    Relevant Pages

    • Re: NDIS_MINIPORT_CHARACTERISTICS
      ... I am referring to NDIS-hooking filters that wrap the NDIS interfaces. ... kernel security if unsigned drivers and components can so easily ...
      (microsoft.public.development.device.drivers)
    • Crap: Really no programmatically filter control in DirectShow??
      ... I try to use several MPEG2-Decoders in my DirectShow application. ... Besides the quality and performance issues among all the filters you can get ... If I have to know what interfaces a COM object can use (I can only ... So I can only control these filters, where .h header files exist from the ...
      (microsoft.public.win32.programmer.directx.video)
    • XDS Codec - any experiences
      ... We have been implementing a number of filters in WME9, ... except the XDS_Codec filter and interfaces ... In the documentation, there are several vague points which we ...
      (microsoft.public.windowsmedia.sdk)
    • Looking for more docs on PfCreateInterface
      ... My main goal is to add filters to the WAN ips on the server boxes so that I ... Are the filter interfaces created via PfCreateInterface persisted on the ... without modifying the settings? ...
      (microsoft.public.win32.programmer.networks)
    • Re: Using VMR9 outside of DShow?
      ... >> fine in web pages with filters inside. ... I don't have any filters outside my executables anymore, ... In my case the ActiveX control used the same filters our applications ... Also, COM interfaces aren't supposed to change, but that is ridiculous ...
      (microsoft.public.win32.programmer.directx.video)