Subject: Re: RFC: New BGF 'LOOP' instruction

From: Hagen Paul Pfeifer <[email-masked]>
Date: Tue, 03 Aug 2010 11:10:28 +0200

On Tue, 03 Aug 2010 00:19:04 -0700 (PDT), David Miller wrote:

> From: Paul LeoNerd Evans <[email-masked]>

>> Rightnow, BPF is all but useless for parsing, say, IPv6. I only pick

>> IPv6 as one example, I'm sure there must exist a great number more

>> packet-based protocols that use a "linked-list" style approach to

>> headers. None of those are currently filterable on the current set of

>> instructions. LOOP would allow these.

> It's not meant for detailed packet protocol header analysis,

> it's for stateless straight line matching of masked values

> in packet headers.

David is right, BPF cannot - and will not - keep with any high level

connection tracking packet filter. There is an processing trade-off between

packet classification and packet storage with post processing analysis.

Hagen