From owner-freebsd-ipfw@FreeBSD.ORG Sat Apr 19 18:04:02 2014 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 14AD45AC; Sat, 19 Apr 2014 18:04:02 +0000 (UTC) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id D1DF71D0C; Sat, 19 Apr 2014 18:04:01 +0000 (UTC) Received: from Julian-MBP3.local (ppp121-45-232-70.lns20.per1.internode.on.net [121.45.232.70]) (authenticated bits=0) by vps1.elischer.org (8.14.8/8.14.8) with ESMTP id s3JI3vU2032262 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Sat, 19 Apr 2014 11:03:59 -0700 (PDT) (envelope-from julian@freebsd.org) Message-ID: <5352BA87.50803@freebsd.org> Date: Sun, 20 Apr 2014 02:03:51 +0800 From: Julian Elischer User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: bycn82 , ae@freebsd.org, freebsd-ipfw@freebsd.org Subject: Re: kern/188543: [ipfw] ipfw option `in` is not working on FreeBSD10 References: <201404161420.s3GEK0OB081227@freefall.freebsd.org> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Apr 2014 18:04:02 -0000 On 4/16/14, 11:40 PM, bycn82 wrote: > Hi > According to the `loop` in the chk() function, everytime it was > invoked, the arg will be checked against `the chain`, so I assumed > that the same is always the same, > I saw that, `the chain` is always `V_layer3_chain`, but I did not > find any V_layer2_chain !!! > So I assumed that currently it always using the same`chain`. > If so , is it better to separate the rules into multiple `chain`? > for saying , chain1 chain2 chain3 chain4, and differnet `check > point`s are going to use its own chain accordingly ? you can do that with 1 chain, by using the 'skipto' command to make packets from different entry-points skipto different rule numbers. > > Respect your effort, and I want to say `thanks` here, Thanks! > > Best Regards, > Bill Yuan > > On Wed, 16 Apr 2014 23:23:03 +0800, bycn82 wrote: > >> Cool! >> I just finished the overview of the source code,and finally >> understood the `for loop` in the ip_fw2.c roughly, >> beside of the coding style,sorry for my ironic words, I want to ask >> whether my understanding is correct. >> >> you wrap the packet/frame in the `check frame` or `check packet` >> which where invoked in the hook() function, and pass it into the >> chk() function >> and the chk() function will check the `args` against the whole rule >> set.( the `chain` variable) >> >> so my question is , does it mean that all the packet need to be >> checked against all the firewall rule, sorry I did not have time to >> check/understand how we generate the `chain` yet, If it is really >> working in this case, I cannot accept that personally! >> >> according to the man page, we have 4 `check point`, I assumed that >> we have registered the hook() into 4 different places, for saying , >> if I have 10K lines of rules which are for 4st `check point` only, >> based on current logic, each packet/frame need to check against the >> rules for 4 times, and actually in the 1 2 3rd `check-point` ,the >> verification are not needed. I hope i was wrong, >> >> Can someone kindly explain the correct logic ? thanks very much! >> >> >> On Wed, 16 Apr 2014 22:20:00 +0800, wrote: >> >>> Synopsis: [ipfw] ipfw option `in` is not working on FreeBSD10 >>> >>> Responsible-Changed-From-To: freebsd-ipfw->ae >>> Responsible-Changed-By: ae >>> Responsible-Changed-When: Wed Apr 16 14:19:42 UTC 2014 >>> Responsible-Changed-Why: >>> Take it. >>> >>> http://www.freebsd.org/cgi/query-pr.cgi?pr=188543 >>> _______________________________________________ >>> freebsd-ipfw@freebsd.org mailing list >>> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw >>> To unsubscribe, send any mail to >>> "freebsd-ipfw-unsubscribe@freebsd.org" > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >