Re: [PATCH] new 'tcpack' match

[Carl-Daniel Hailfinger <c-d.hailfinger.devel.2005@gmx.net>]

Maciej Soltysiak schrieb:
>>I aim to fix this all with one simple netfilter match which can give an
>>answer with simple arithmetics in one go instead of matching against a
>>preconfigured list of possible values one by one.
> 
> Right.
> 
> I agree the best way to go would be to extend the tcp match with
> the proposed semantics:
>     --datalen [!] A[,B:C[,D]]
> 
> 
> It also might be useful to match the sole header length.
>    --headerlen [!] A[,B:C[,D]]
> 
> And the lenght of tcp+data
> 
>    --len
> 
> Possibly the similar for udp:
>    --datalen, --headerlen, --len
> 
> And ICMP:
>    --datalen, --len (icmp headers have fixed size)

Could we do this in a generic way? I'm currently rewriting the iptables
ACCOUNT target and it could benefit from that as well.

I'd need:
- length of whole IP packet
- length of layer 2 frame

Perhaps a generic prefix for all "length" options is appropriate?

--len-header-ip
--len-data-ip
--len-full-ip
--len-header-tcp
--len-data-tcp
--len-full-tcp
--len-header-ether
--len-data-ether
--len-full-ether
etc.

I realize that some of the options above don't make that much sense,
but you get the idea.

Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/