Date: Sun, 7 Apr 2002 00:23:15 -0800 From: "Crist J. Clark" <cjc@FreeBSD.ORG> To: Darren Reed <avalon@coombs.anu.edu.au> Cc: Scott Lampert <scott@lampert.org>, security@FreeBSD.ORG Subject: Re: pf OR ipf ? Message-ID: <20020407002315.J70207@blossom.cjclark.org> In-Reply-To: <200204070809.SAA06353@caligula.anu.edu.au>; from avalon@coombs.anu.edu.au on Sun, Apr 07, 2002 at 06:09:48PM %2B1000 References: <20020406214253.H70207@blossom.cjclark.org> <200204070809.SAA06353@caligula.anu.edu.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Apr 07, 2002 at 06:09:48PM +1000, Darren Reed wrote:
> In some mail from Crist J. Clark, sie said:
> >
> > It's in 5.0-CURRENT so it may make 5.0-RELEASE. ;) I do not plan to
> > merge the code into 4.x-STABLE in its current form. I really am not
> > happy with how it works in -CURRENT either, but to get it to work more
> > cleanly and in a way darrenr suggested, I'd need to modify IPFilter
> > code, which I have tried to avoid. So the -CURRENT code is
> > experimental, but that's OK for -CURRENT. It's not OK for -STABLE.
>
> Ack. what was it that I suggested (that needed ipfilter code changed) ?
A separate inetsw[] structure for the bridging. I don't see how you
can do that without changing IPFilter code. Or am I missing something?
I _can_ do this, and it creates some really interesting possibilities
(the obvious one being completely independent filter lists for the
bridge and the IP stack). But I really do not want to create a
divergent branch of IPFilter that isn't going to get merged back
in.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020407002315.J70207>