From owner-freebsd-security Sun Apr 7 0:23:19 2002 Delivered-To: freebsd-security@freebsd.org Received: from rwcrmhc54.attbi.com (rwcrmhc54.attbi.com [216.148.227.87]) by hub.freebsd.org (Postfix) with ESMTP id 87EE537B400 for ; Sun, 7 Apr 2002 00:23:16 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc54.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020407082316.LDWH15826.rwcrmhc54.attbi.com@blossom.cjclark.org>; Sun, 7 Apr 2002 08:23:16 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g378NFc71839; Sun, 7 Apr 2002 00:23:15 -0800 (PST) (envelope-from cjc) Date: Sun, 7 Apr 2002 00:23:15 -0800 From: "Crist J. Clark" To: Darren Reed Cc: Scott Lampert , security@FreeBSD.ORG Subject: Re: pf OR ipf ? Message-ID: <20020407002315.J70207@blossom.cjclark.org> References: <20020406214253.H70207@blossom.cjclark.org> <200204070809.SAA06353@caligula.anu.edu.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200204070809.SAA06353@caligula.anu.edu.au>; from avalon@coombs.anu.edu.au on Sun, Apr 07, 2002 at 06:09:48PM +1000 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Sun, Apr 07, 2002 at 06:09:48PM +1000, Darren Reed wrote: > In some mail from Crist J. Clark, sie said: > > > > It's in 5.0-CURRENT so it may make 5.0-RELEASE. ;) I do not plan to > > merge the code into 4.x-STABLE in its current form. I really am not > > happy with how it works in -CURRENT either, but to get it to work more > > cleanly and in a way darrenr suggested, I'd need to modify IPFilter > > code, which I have tried to avoid. So the -CURRENT code is > > experimental, but that's OK for -CURRENT. It's not OK for -STABLE. > > Ack. what was it that I suggested (that needed ipfilter code changed) ? A separate inetsw[] structure for the bridging. I don't see how you can do that without changing IPFilter code. Or am I missing something? I _can_ do this, and it creates some really interesting possibilities (the obvious one being completely independent filter lists for the bridge and the IP stack). But I really do not want to create a divergent branch of IPFilter that isn't going to get merged back in. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message