Re: Global ingress filter for ip

["Rodolphe De Saint Leger" <rdesaintleger%gmail.com@localhost>]

On Fri, Mar 28, 2008 at 6:22 PM, Thor Lancelot Simon 
<tls%rek.tjls.com@localhost> wrote:
>
>  What does this do that cannot be done by a standard packet filter (e.g.
>  ipf or pf) using the existing ip_input filter hook?
>
>  Thor
>

As far as I know, this can be done using ipf or pf, in an other way:
The ingress test use a lookup in the routing table, rules would use ip
addresses.

However, the tunnel pseudo devices actualy use this test (with an
IFF_LINK). My goal was to make it more centric, generic, and
independant of any processing which could be done on the packet (this
is why the test occurs before NAT).

It's just a way to share code between tunnel pseudo devices. Also,
it's much more light and simpler.

For code sharing, the tunnel pseudo devices would call
enable_ipingress() when cloning interface, and it can check the
ingress status of the packet by looking at the flags in
encap_lookup().

Regards,
-- 
int main(int c,char**v){int b,e=(c>>24)+6,g=c==1?1:e>>4;
char*d=c==1?"d3JpdGUgaW4gQw==":g==2?*v:v[c-1];b=c<<6|(*d
+(*d>96?-71:*d>58?-65:*d>47?4:*d>46?16:19));if(*d==61?0:
*d){if((e&=15)>7)putchar((b>>(e-=8))&255); d++;main(((e|
32)<<24)|(b&4095),&d);}return g<2&&c>2?main(--c,v):1;}