>>>>> "James" == James R Leu <jleu@xxxxxxxxxxxxxx> writes:
James> I've added a field to skbs called aux_protodata. Its an array of
void*.
James> Auxiliary protocols (one that don't fit the normal Linux network
stack
James> model) can mark interest in a particular protocol and store data here
James> for later use. For example, MPLS uses this by coping data from
fib_nodes
James> into this field in the skb, at the same time it creates a dst_entry
that
James> redirect the skb to an mpls_output function. There the
aux_protodata is
James> used to find the next hop label forwarding entry needed to transmit
this
James> packet on a label switched path.
This sounds precisely what IPsec wants.
We need to attach some auxiliary data to the skb based upon a packet
classifier, and then redirect the packet to our custom xmit routine.
It sounds to me like we could very easily use the same, or similar mechanisms.
(One concern is that we do not use precisely the same mechanism. After all,
people will want to encrypt packets for a VPN, and then push a label on them
to get them there with low latency, etc...)
James> The short coming of this model so far is that it should use a
netfilter like
James> scheme for redirecting packets at certain points in the network
stack.
James> Why not use netfilter? The places that auxiliary protocols need to
James> modify skbs or dst_entries are different then those provided by
netfilter.
I would argue that you should put netfilter calls into those places instead.
James> Plus there should be a clear difference between what is being
accomplished
James> via netfilter (IPvX packet redirecting/mangling) and aux_protodata
James> (protocol
I don't think of netfilter as limited to "redirecting/mangling" --- it does
classification.
I'm also not clear that netfilter is limited to IPvX -- it (or rather
iptables) has rather general facilities. You are, presumeable, making
classification decisions on the packets in some way and sending them to MPLS
processing routines.
When can I expect to see your code in mainstream?
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Sandelman Software Works, Ottawa, ON |net architect[
] mcr@xxxxxxxxxxxxxxxxxxxxxx http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [
|