From owner-freebsd-hackers@FreeBSD.ORG Wed Feb 8 14:04:10 2012 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1CE33106564A; Wed, 8 Feb 2012 14:04:10 +0000 (UTC) (envelope-from ermal.luci@gmail.com) Received: from mail-iy0-f182.google.com (mail-iy0-f182.google.com [209.85.210.182]) by mx1.freebsd.org (Postfix) with ESMTP id C23928FC1D; Wed, 8 Feb 2012 14:04:09 +0000 (UTC) Received: by iaeo4 with SMTP id o4so1256087iae.13 for ; Wed, 08 Feb 2012 06:04:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=+J0xlP6I1mhPtm6JmLkzX/MN5IuuYy8GGNP+ZtNP1Kg=; b=IcivfqBr1JdiPJTEbuhNzxbMoy0aPAGOXDihScdkTJl+EJJe4gSjJAyxiQ4Lwiphbx 4PKQM9TNS56QNSlMr89Ra2KehIAr3kf+Mih1iJn2pmFz+a7nkgW66YsVf1y0kHuqWO3H OxAXXJz5HETWCSfWxVMZwtxrYIBGs7vRRP0b0= MIME-Version: 1.0 Received: by 10.42.144.69 with SMTP id a5mr27139143icv.45.1328709849420; Wed, 08 Feb 2012 06:04:09 -0800 (PST) Sender: ermal.luci@gmail.com Received: by 10.231.134.198 with HTTP; Wed, 8 Feb 2012 06:04:09 -0800 (PST) In-Reply-To: <20120208133559.GK13554@FreeBSD.org> References: <20120131110204.GA95472@onelab2.iet.unipi.it> <20120208133559.GK13554@FreeBSD.org> Date: Wed, 8 Feb 2012 15:04:09 +0100 X-Google-Sender-Auth: 0aFIRkQDzHRwTd5nBZ_gaj2_wVQ Message-ID: From: =?ISO-8859-1?Q?Ermal_Lu=E7i?= To: Gleb Smirnoff Content-Type: text/plain; charset=ISO-8859-1 Cc: freebsd-net , Luigi Rizzo , freebsd-hackers@freebsd.org Subject: Re: [PATCH] multiple instances of ipfw(4) X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2012 14:04:10 -0000 2012/2/8 Gleb Smirnoff : > On Tue, Jan 31, 2012 at 12:02:04PM +0100, Luigi Rizzo wrote: > L> if i understand what the patch does, i think it makes sense to be > L> able to hook ipfw instances to specific interfaces/sets of interfaces, > L> as it permits the writing of more readable rulesets. Right now the > L> workaround is start the ruleset with skipto rules matching on > L> interface names, and then use some discipline in "reserving" a range > L> of rule numbers to each interface. > > This is definitely a desired feature, but it should be implemented > on level of pfil(9). However, that would still require multiple > instances of ipfw(4). > This opens a discussion of architecture design. I do not think presently pfil(9) is designed to handle such thing! Regards, Ermal