Subject: Re: PF for netbsd
To: Kenjiro Cho <kjc@csl.sony.co.jp>
From: Darren Reed <avalon@caligula.anu.edu.au>
List: tech-net
Date: 06/28/2003 00:16:14
In some mail from Kenjiro Cho, sie said:
>
> My impression is that API is not so important here.
I think it is - always.
Currently, based on what I've seen in OpenBSD and read here, you
should not have a kernel configuration like this:
pseudo-device ipfilter
#pseudo-device pf
options ALTQ
because various ALTQ files include pf related header files for things
like "struct pf_altq". ALTQ should be providing the interface to be
used by packet classifiers, not the other way around. I say "should
not" because strictly speakingn header files can be used like that
but it doesn't strike me as being a "Good Thing"(tm). Anyway, where
you are aiming to support a 1:N relationship, the "1" should be
providing the interface, not one of the N's.
Maybe I'm just more concerned about things architecturally and looking
for a good design...
> The tagger and the consumer share only tag values. All you need is a
> mechanism to map a string label to the corresponding tag value.
> In pf, pf creates and keeps mapping, and provides a function to
> retrieve tag values.
> u_int16_t pf_tagname2tag(char *tagname);
> So, if IPFilter provides a similar function, we can make use of
> IPFilter.
That suggests to me that IPFilter/pf couldn't co-exist if they were
both required to provide the same function name as part of an interface,
correct ?
Looking at ALTQ from KAME (I just did a cvs update from kame), there
is currently no use of m_tag that is found in the OpenBSD source.
Is this because changes are still pending being pulled up into KAME
from OpenBSD to support this ?
And if someone were to update the NetBSD altq with what appears to be
-current ALTQ from KAME, there would be no need for pf, right ?
Hopefully this means any integration/API between packet classifiers
and ALTQ is still open for discussion :)
> There's no conspiracy behind it. It's just because I didn't have a
> chance to drink beer with you :)
Damn, I'm never in the right place at the right time!
;)
Darren