On 10/4/14 20:35, Alexander V. Chernikov wrote:

I'm going to merge projects/ipfw branch to HEAD in the middle of next week.

What has changed:

Main user-visible changes are related to tables:

* Tables are now identified by names, not numbers. There can be up to 65k tables with up to 63-byte long names. * Tables are now set-aware (default off), so you can switch/move them atomically with rules. * More functionality is supported (swap, lock, limits, user-level lookup, batched add/del) by generic table code. * New table types are added (flow) so you can match multiple packet fields at once. * Ability to add different type of lookup algorithms for particular table type has been added. * New table algorithms are added (cidr:hash, iface:array, number:array and flow:hash) to make certain types of lookup more effective. * Table value are now capable of holding multiple data fields for different tablearg users

Some examples (see ipfw(8) manual page for the description):

0:02 [2] zfscurr0# ipfw table fl2 create type flow:src-ip,proto,dst-port algo flow:hash valtype skipto,fib
   0:02 [2] zfscurr0# ipfw table fl2 info
   +++ table(fl2), set(0) +++
    kindex: 0, type: flow:src-ip,proto,dst-port
    valtype: number, references: 0
    algorithm: flow:hash
    items: 0, size: 280
   0:02 [2] zfscurr0# ipfw table fl2 add 2a02:6b8::333,tcp,443 45000,12
   0:02 [2] zfscurr0# ipfw table fl2 add,tcp,80 22000,13
   0:02 [2] zfscurr0# ipfw table fl2 list
   +++ table(fl2), set(0) +++
   2a02:6b8::333,6,443 45000,6,80 22000
0:02 [2] zfscurr0# ipfw add 200 count tcp from me to 80 flow 'table(fl2)'

   ipfw table mi_test create type cidr algo "cidr:hash masks=/30,/64"
   ipfw table mi_test add
   ipfw table mi_test add 2a02:6b8:b010::1/64 25

   # ipfw table si add 1111 2222
   added: 1111
   added: 2222
   # ipfw table si add 2200 4444
   exists: 2200
   added: 4444
   ipfw: Adding record failed: record already exists
   ^^^^^ Returns error but keeps inserted items
   # ipfw table si list
   +++ table(si), set(0) +++ 1111 2222 4444
# ipfw table si atomic add 3333 4400 5555
   added(reverted): 3333
   exists: 4400
   ignored: 5555
   ipfw: Adding record failed: record already exists
   ^^^^^ Returns error and reverts added records

Performance changes:
* Main ipfw lock was converted to rmlock
* Rule counters were separated from rule itself and made per-cpu.
* Radix table entries fits into 128 bytes
* struct ip_fw is now more compact so more rules will fit into 64 bytes
* interface tables uses array of existing ifindexes for faster match

ABI changes:
All functionality supported by old ipfw(8) remains functional. Old & new binaries can work together with the following restrictions: * Tables named other than ^\d+$ are shown as table(65535) in ruleset in old binaries * I'm a bit unsure about "lookup src-port|dst-port N" case, something may be broken here. Anyway, this can be fixed for MFC

Internal changes:.
Changing table ids to numbers resulted in format modification for most sockopt codes. Old sopt format was compact, but very hard to extend (no versioning, inability to add more opcodes), so * All relevant opcodes were converted to TLV-based versioned IP_FW3-based codes. * The remaining opcodes were also converted to be able to eliminate all older opcodes at once * All IP_FW3 handlers uses special API instead of calling sooptcopy* directly to ease adding another communication methods
* struct ip_fw is now different for kernel and userland
* tablearg value has been changed to 0 to ease future extensions
* table "values" are now indexes in special value array which holds extended data for given index
* Batched add/delete has been added to tables code
* Most changes has been done to permit batched rule addition.
* interface tracking API has been added (started on demand) to permit effective interface tables operations * O(1) skipto cache, currently turned off by default at compile-time (eats 512K).

* Several steps has been made towards making libipfw:
* most of new functions were separated into "parse/prepare/show and actuall-do-stuff" pieces (already merged). * there are separate functions for parsing text string into "struct ip_fw" and printing "struct ip_fw" to supplied buffer (already merged).
* Probably some more less significant/forgotten features

freebsd-...@freebsd.org mailing list
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"

Good job, Waiting for your code :)


freebsd-current@freebsd.org mailing list
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Reply via email to