Re: [ANNOUNCE] new iptables module match large amount of ip addresses

[Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>]

On Fri, 18 Sep 2009, Jan Engelhardt wrote:

> On Thursday 2009-09-17 21:15, Mikulas Patocka wrote:
> >
> >Here I submit an iptables module that can match large amounts (millions) 
> >of ip addresses efficiently using binary search.
> 
> So you just reinvented xt_geoip...

I am wondering, if there are two approaches for matching large amounts of 
addresses (xt_geoip and ipset), why is none of them in the kernel?

I was saying how OpenBSD is better than Linux because OpenBSD has 
tree-based firewall tables --- hmm --- well --- Linux has them too, except 
that noone can really find them because they are not in the kernel.

> >- fast matching of large amount of ip addresses using binary search.
> >- an ability to match ranges of addresses or address/mask subnets.
> >- fast loading of the addresses (on Pentium 3 850, 2 million addresses 
> >load in 5.5s, if they are already sorted in the file, the load time is 
> >just 1.5s).
> >- memory efficient --- consumes only 8 bytes per address.
> 
> xt_geoip uses less than that -- 8 bytes per range. Of course it depends 
> on the data, but on the average, since large netblocks is used, it's 
> much better than 8 per address.

My code uses 8 bytes per range too, not really per address.

Mikulas