From owner-freebsd-security  Sun Apr  7  7:18:48 2002
Delivered-To: freebsd-security@freebsd.org
Received: from caligula.anu.edu.au (caligula.anu.edu.au [150.203.224.42])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3256437B400; Sun,  7 Apr 2002 07:18:44 -0700 (PDT)
Received: (from avalon@localhost)
	by caligula.anu.edu.au (8.9.3/8.9.3) id AAA04872;
	Mon, 8 Apr 2002 00:18:42 +1000 (EST)
From: Darren Reed <avalon@coombs.anu.edu.au>
Message-Id: <200204071418.AAA04872@caligula.anu.edu.au>
Subject: Re: pf OR ipf ?
To: cjc@FreeBSD.ORG (Crist J. Clark)
Date: Mon, 8 Apr 2002 00:18:42 +1000 (Australia/ACT)
Cc: security@FreeBSD.ORG
In-Reply-To: <20020407002315.J70207@blossom.cjclark.org> from "Crist J. Clark" at Apr 07, 2002 12:23:15 AM
X-Mailer: ELM [version 2.5 PL1]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In some mail from Crist J. Clark, sie said:
> 
> On Sun, Apr 07, 2002 at 06:09:48PM +1000, Darren Reed wrote:
> > In some mail from Crist J. Clark, sie said:
> > > 
> > > It's in 5.0-CURRENT so it may make 5.0-RELEASE. ;) I do not plan to
> > > merge the code into 4.x-STABLE in its current form. I really am not
> > > happy with how it works in -CURRENT either, but to get it to work more
> > > cleanly and in a way darrenr suggested, I'd need to modify IPFilter
> > > code, which I have tried to avoid. So the -CURRENT code is
> > > experimental, but that's OK for -CURRENT. It's not OK for -STABLE.
> > 
> > Ack. what was it that I suggested (that needed ipfilter code changed) ?
> 
> A separate inetsw[] structure for the bridging. I don't see how you
> can do that without changing IPFilter code. Or am I missing something?

No, you're not.

> I _can_ do this, and it creates some really interesting possibilities
> (the obvious one being completely independent filter lists for the
> bridge and the IP stack). But I really do not want to create a
> divergent branch of IPFilter that isn't going to get merged back
> in.

Yes, I have been considering this too.

In some ways, it makes sense.

For example, you might have a box with both bridging interfaces and
routing interfaces.

Darren

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message