From owner-freebsd-net@FreeBSD.ORG  Wed Dec 15 09:11:38 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id DF92C16A4CE; Wed, 15 Dec 2004 09:11:38 +0000 (GMT)
Received: from relay.bestcom.ru (relay.bestcom.ru [217.72.144.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id EFAE343D45; Wed, 15 Dec 2004 09:11:37 +0000 (GMT)
	(envelope-from glebius@freebsd.org)
Received: from cell.sick.ru (root@cell.sick.ru [217.72.144.68])
	by relay.bestcom.ru (8.13.1/8.12.9) with ESMTP id iBF9BaOL089621
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL);
	Wed, 15 Dec 2004 12:11:36 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.12.11/8.12.8) with ESMTP id iBF9BZHB053986
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Wed, 15 Dec 2004 12:11:36 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
Received: (from glebius@localhost)
	by cell.sick.ru (8.12.11/8.12.11/Submit) id iBF9BZdS053985;
	Wed, 15 Dec 2004 12:11:35 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
X-Authentication-Warning: cell.sick.ru: glebius set sender to
	glebius@freebsd.org using -f
Date: Wed, 15 Dec 2004 12:11:35 +0300
From: Gleb Smirnoff <glebius@freebsd.org>
To: Andre Oppermann <andre@freebsd.org>
Message-ID: <20041215091135.GC53509@cell.sick.ru>
Mail-Followup-To: Gleb Smirnoff <glebius@freebsd.org>,
	Andre Oppermann <andre@freebsd.org>, freebsd-net@freebsd.org
References: <41BEF2AF.470F9079@freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <41BEF2AF.470F9079@freebsd.org>
User-Agent: Mutt/1.5.6i
X-Virus-Scanned: clamd / ClamAV version devel-20041013, clamav-milter version
	0.75l	on 127.0.0.1
X-Virus-Status: Clean
cc: freebsd-net@freebsd.org
Subject: Re: per-interface packet filters, design approach
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Dec 2004 09:11:39 -0000

On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote:
A>  d1. The PFIL_HOOKS API has one hook per direction per protocol and
A>      passes the interface information to the firewall package.
A>  d2. Should the PFIL_HOOKS API be changed and be per interface instead
A>      of per protocol?  All firewall packages need to be modified and
A>      we are no longer compatible with the PFIL_HOOKS API.

s/API/usage/g

Andre, you are the person, who is optimizing our IP stack. Can you ask
this question, please: if the interface has no filters associated with it,
why the hell the packets running on it would enter firewall functions?

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE