[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: fully transparent ftp-proxy?

Actually, there wouldn't be any real performance penalty, because these
embrionic states are in effect only a tree sorted list of one shot rules.
When they match they're removed from the embrionic tree, filled in with
some other details, and moved to the normal state tree. It's just done
faster than if you added rules to match the same things.
And if you don't like using embrionic states, then you would have an empty
embrionic state tree and it would then only require one extra pointer
comparison (and seeing that it's NULL), before moving on to evaluating the
rule set.
And if you were to follow my previous post, you wouldn't even have to
evalutate the tree until you found a rule in the rule list that allowed
you to do so.
-- Rukh
On Wed, 30 Oct 2002, Henning Brauer wrote:
> On Wed, Oct 30, 2002 at 10:24:29PM +0100, Daniel Hartmeier wrote:
> > On Wed, Oct 30, 2002 at 08:41:12PM +0000, Roy Badami wrote:
> >
> > > It seems to me that whilst it might require a minimal amount of kernel
> > > machinery to permit setup of the outgoing connection from the proxy,
> > > once established it is identical in nature to the incoming
> > > connection...
> >
> > This could be solved with 'embryonic states', a separate list/tree of
> > state entries that lack certain parts (like source ports, which are
> > usually random and not known in advance). After the normal state lookup
> > (if it fails), but before the rule set evaluation, a matching embryonic
> > state would be completed and turn into a normal state.
> Uh well, this sounds like a massive performance penalty... I don't think I
> like that.