From owner-freebsd-ipfw@FreeBSD.ORG Thu Mar 13 09:40:19 2008 Return-Path: Delivered-To: freebsd-ipfw@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1FE641065671 for ; Thu, 13 Mar 2008 09:40:19 +0000 (UTC) (envelope-from piso@southcross.wired.org) Received: from mail.oltrelinux.com (krisma.oltrelinux.com [194.242.226.43]) by mx1.freebsd.org (Postfix) with ESMTP id D25218FC22 for ; Thu, 13 Mar 2008 09:40:18 +0000 (UTC) (envelope-from piso@southcross.wired.org) Received: from southcross.wired.org (host-84-221-232-101.cust-adsl.tiscali.it [84.221.232.101]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.oltrelinux.com (Postfix) with ESMTP id 178F011AE7E; Thu, 13 Mar 2008 10:40:14 +0100 (CET) Received: (from piso@localhost) by southcross.wired.org (8.14.2/8.14.1/Submit) id m2D9hvfR009288; Thu, 13 Mar 2008 10:43:57 +0100 (CET) (envelope-from piso) Date: Thu, 13 Mar 2008 10:43:56 +0100 From: Paolo Pisati To: Vadim Goncharov Message-ID: <20080313094356.GA9219@tin.it> References: <200803122100.m2CL0t7V088955@freefall.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.17 (2007-11-01) X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at krisma.oltrelinux.com Cc: freebsd-ipfw@FreeBSD.org Subject: Re: kern/80642: [ipfw] [patch] ipfw small patch - new RULE OPTION X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Mar 2008 09:40:19 -0000 On Thu, Mar 13, 2008 at 09:21:11AM +0000, Vadim Goncharov wrote: > > > http://www.freebsd.org/cgi/query-pr.cgi?pr=80642 > > Yes, this is useful, but some minor changes are needed, I think. First, rename > it to "bytelimit" or somewhat. Second, allow this to use tablearg and possibly > ability to reference a counter to corresponding dynamic rule, to allow this to > act for a specific IP or connection without need to write many rules. Third, > add packet counter as well. That's all possible with one opcode, though... if anyone post an updated patch, i'll commit it. -- bye, P.