<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 10/19/2011 03:02 PM, David Stevens wrote:
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div>Stefan,<br>
Can't you achieve the same thing by reserving an
early block<br>
of priorities (and a late one, for system stuff that should be
done late)?<br>
</div>
</font></blockquote>
The problem is that at the moment rules (in the 'root' table) can
have priorities [0, 1000]. So nothing prevents one to write a rule
with priority 0. However, due to how nwfilters works right now the
jumps into the protocol-specific tables will always be created
*before* those rules. I am trying to address this now with assigning
negative numbers to the chains to achieve the same sorting and
maintain backwards compatibility.<br>
<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div> If you use negative numbers, then you lose the
capability of<br>
ever extending priorities to interpret the negative number as
"from the end"<br>
as done in ebtables/iptables line numbers. I think that is
more useful, and<br>
having to do that outside of priorities would mean extra
parsing and encoding<br>
to get that effect.<br>
</div>
</font></blockquote>
There is no relation between priorities and the ordering parameter
to the ebtables / iptables commands. The priorities were introduced
so that more complex filters can be built by composing them of
individual filters and yet have their filtering rules be created in
the 'proper' order that goes beyond of how they are reference
through filter references inside the filters and their appearance in
the XML.<br>
I don't see how this could be changed, but I'd be curious to see
'how'.<br>
<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div> I also think that nwfilters ought to reflect
the underlying filter<br>
mechanisms as much as possible. Really, I'd prefer they were
simply<br>
parameterized shell scripts of ebtables/iptables commands run
at significant<br>
events (start-up, shutdown, migrate) instead of XML-encoded
things. Then<br>
the full feature sets of ebtables/iptables would be available
"for free", instead<br>
of requiring libvirt patches to, e.g., add "return/continue"
or multiple chains.<br>
</div>
</font></blockquote>
If you want to design another filtering subsytem for libvirt, please
go ahead. mwfilters currently works with XML and I don't see we can
change that so easily.<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div> Barring that, at least I think what nwfilters
provides should be a close<br>
map to ebtables/iptables capabilities. Mapping line numbers
into a wide range<br>
</div>
</font></blockquote>
It was not intended to be a 1:1 mapping but allow portability to
other system. Of course, the lack of similar functionality on other
system may be quite a bit of work to overcome first.<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div>of priorities is straightforward, but if you use negative
numbers in an ordinary<br>
sort, you can no longer use the sign as ebtables/iptables
does. Because<br>
you've limited the range, you could do something hacky with
offsets (anything<br>
below "-1000" is "from the end" or some such), but that's
arcane.<br>
</div>
</font></blockquote>
Right, 'arcane'...<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div> Using priorities in multiple places is very
like programming in basic<br>
and what both ebtables/iptables and nwfilters could use better
I think would<br>
be the capability to label rules by name and reference the
label to identify the<br>
rule location. Then you might, e.g., add a rule at "myrules +
5" and don't care<br>
what particular priority/line number "myrules" is.<br>
</div>
</font></blockquote>
You have patches for that?<br>
<br>
<blockquote
cite="mid:OF633E3689.5F82EEC3-ON8725792E.00689C5E-8725792E.00689C68@us.ibm.com"
type="cite"><font face="Default Sans
Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<div><br>
+-DLS<br>
<br>
<br>
<br>
</div>
</font></blockquote>
<br>
</body>
</html>