netdev - Re: [ANNOUNCE] new iptables module match large amount of ip addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0909172232340.32723@artax.karlin.mff.cuni.cz>
Date:	Thu, 17 Sep 2009 22:36:57 +0200 (CEST)
From:	Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>
To:	Eric Leblond <eric@....fr>
cc:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [ANNOUNCE] new iptables module match large amount of ip addresses

On Thu, 17 Sep 2009, Eric Leblond wrote:

> Hi,
> 
> Le jeudi 17 septembre 2009 a 21:15 +0200, Mikulas Patocka a écrit :
> > Hi
> > 
> > Here I submit an iptables module that can match large amounts (millions) 
> > of ip addresses efficiently using binary search.
> 
> What are the differences with ipset ? (http://ipset.netfilter.org/)
> 
> BR,

What I wrote is static --- once loaded, then used. The only way to update 
the addresses is to reload it. Ipset is dynamic (and has more memory 
consumption because of it). In my implementation, the kernel reads the ip 
addresses, in ipset, the userspace tool reads them. 

I didn't know about ipset before because it is not in the kernel (will it 
ever be?)

Mikulas