Date: Sat, 17 Jul 2004 05:38:07 +0200 From: Max Laier <max@love2party.net> To: Juli Mallett <jmallett@FreeBSD.org> Cc: cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw2.c src/sys/sys mbuf.h Message-ID: <200407170538.14572.max@love2party.net> In-Reply-To: <200407170240.i6H2eEHO021683@repoman.freebsd.org> References: <200407170240.i6H2eEHO021683@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Saturday 17 July 2004 04:40, Juli Mallett wrote: > jmallett 2004-07-17 02:40:14 UTC > > FreeBSD src repository > > Modified files: > sys/netinet ip_fw2.c > sys/sys mbuf.h > Log: > Make M_SKIP_FIREWALL a global (and semantic) flag, preventing anything > from using M_PROTO6 and possibly shooting someone's foot, as well as > allowing the firewall to be used in multiple passes, or with a packet > classifier frontend, that may need to explicitly allow a certain packet. > Presently this is handled in the ipfw_chk code as before, though I have run > with it moved to upper layers, and possibly it should apply to ipfilter and > pf as well, though this has not been investigated. pf does something to the same effect by prepending a mbuf with the "PACKET_TAG_PF_GENERATED" mbuf_tag to skip processing for its own packets. If we can agree that the presence of M_SKIP_FIREWALL is copied to icmp error messages I will happily replace the mbuf tag with the more general flag (which will perform significantly better, I believe). Please tell me what you think of this. -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQBA+J8mXyyEoT62BG0RAie9AJ9IKmgM3An5FItJ151HJIgFuD+RmQCeNQb/ PRjAI+1mkkuTn/DbDPhNsqc= =I51E -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200407170538.14572.max>