From owner-cvs-src@FreeBSD.ORG Sat Jul 17 03:40:28 2004 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 86F6016A4CE; Sat, 17 Jul 2004 03:40:28 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.187]) by mx1.FreeBSD.org (Postfix) with ESMTP id F3A5543D2D; Sat, 17 Jul 2004 03:40:27 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.155] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1Blg3n-0001CV-00; Sat, 17 Jul 2004 05:40:27 +0200 Received: from [217.227.153.122] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1Blg3n-0001wY-00; Sat, 17 Jul 2004 05:40:27 +0200 From: Max Laier To: Juli Mallett Date: Sat, 17 Jul 2004 05:38:07 +0200 User-Agent: KMail/1.6.2 References: <200407170240.i6H2eEHO021683@repoman.freebsd.org> In-Reply-To: <200407170240.i6H2eEHO021683@repoman.freebsd.org> MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Boundary-02=_m8J+ADUU83mSe6A"; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200407170538.14572.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 cc: cvs-src@FreeBSD.org cc: src-committers@FreeBSD.org cc: cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw2.c src/sys/sys mbuf.h X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Jul 2004 03:40:28 -0000 --Boundary-02=_m8J+ADUU83mSe6A Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Saturday 17 July 2004 04:40, Juli Mallett wrote: > jmallett 2004-07-17 02:40:14 UTC > > FreeBSD src repository > > Modified files: > sys/netinet ip_fw2.c > sys/sys mbuf.h > Log: > Make M_SKIP_FIREWALL a global (and semantic) flag, preventing anything > from using M_PROTO6 and possibly shooting someone's foot, as well as > allowing the firewall to be used in multiple passes, or with a packet > classifier frontend, that may need to explicitly allow a certain packet.= =20 > Presently this is handled in the ipfw_chk code as before, though I have r= un > with it moved to upper layers, and possibly it should apply to ipfilter a= nd > pf as well, though this has not been investigated. pf does something to the same effect by prepending a mbuf with the=20 "PACKET_TAG_PF_GENERATED" mbuf_tag to skip processing for its own packets. = If=20 we can agree that the presence of M_SKIP_FIREWALL is copied to icmp error=20 messages I will happily replace the mbuf tag with the more general flag=20 (which will perform significantly better, I believe). Please tell me what y= ou=20 think of this. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --Boundary-02=_m8J+ADUU83mSe6A Content-Type: application/pgp-signature Content-Description: signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQBA+J8mXyyEoT62BG0RAie9AJ9IKmgM3An5FItJ151HJIgFuD+RmQCeNQb/ PRjAI+1mkkuTn/DbDPhNsqc= =I51E -----END PGP SIGNATURE----- --Boundary-02=_m8J+ADUU83mSe6A--