From owner-cvs-all@FreeBSD.ORG Thu Feb 26 07:11:24 2004 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3EA9016A4CE; Thu, 26 Feb 2004 07:11:24 -0800 (PST) Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2F67543D1D; Thu, 26 Feb 2004 07:11:24 -0800 (PST) (envelope-from rizzo@icir.org) Received: from xorpc.icir.org (localhost [127.0.0.1]) by xorpc.icir.org (8.12.9p1/8.12.8) with ESMTP id i1QFBN9Q032005; Thu, 26 Feb 2004 07:11:23 -0800 (PST) (envelope-from rizzo@xorpc.icir.org) Received: (from rizzo@localhost) by xorpc.icir.org (8.12.9p1/8.12.3/Submit) id i1QFBNu1032004; Thu, 26 Feb 2004 07:11:23 -0800 (PST) (envelope-from rizzo) Date: Thu, 26 Feb 2004 07:11:23 -0800 From: Luigi Rizzo To: Andre Oppermann Message-ID: <20040226071123.A31631@xorpc.icir.org> References: <200402260234.i1Q2YDx1014240@repoman.freebsd.org> <20040226060126.GA70201@troutmask.apl.washington.edu> <20040226080517.GA29763@cat.robbins.dropbear.id.au> <20040226015016.B23674@xorpc.icir.org> <403DC956.8EA364B2@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <403DC956.8EA364B2@freebsd.org>; from andre@freebsd.org on Thu, Feb 26, 2004 at 11:24:22AM +0100 cc: Max Laier cc: Tim Robbins cc: cvs-src@freebsd.org cc: cvs-all@freebsd.org cc: src-committers@freebsd.org cc: Steve Kargl Subject: Re: cvs commit: src/sys/contrib/pf/net if_pflog.c if_pflog.h if_pfsync.c if_pfsync.h pf.c pf_ioctl.c pf_norm.c pf_osfp.c pf_table.c pfvar.h src/sys/contrib/pf/netinet in4_cksum.c X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Feb 2004 15:11:24 -0000 On Thu, Feb 26, 2004 at 11:24:22AM +0100, Andre Oppermann wrote: > Luigi, > > do you have any patches ready or in the works to make ipfw2 use the > PFIL_HOOKS API? That would simplify ip_input() and ip_output() a > *great* deal. no, i will try to look and see if i can implement something of use. But i don't think you'd save much more than the extra call to ip_fw_chk() -- things such as 'divert' and 'forward' greatly interact with the rest of the packet processing in ip_input() and ip_output(). If you look at the code, calling the firewall is a short block of code; the big offender is the processing after the firewall returns with a non-trivial action (especially 'forward' in ip_output()). cheers luigi > -- > Andre