Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 19 Oct 2012 13:06:21 -0700
From:      Julian Elischer <julian@freebsd.org>
To:        "Andrey V. Elsukov" <ae@freebsd.org>
Cc:        ipfw@freebsd.org, net@freebsd.org
Subject:   Re: [RFC] Enabling IPFIREWALL_FORWARD in run-time
Message-ID:  <5081B2BD.3090103@freebsd.org>
In-Reply-To: <508138A4.5030901@FreeBSD.org>
References:  <508138A4.5030901@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On 10/19/12 4:25 AM, Andrey V. Elsukov wrote:
> Hi All,
>
> Many years ago i have already proposed this feature, but at that time
> several people were against, because as they said, it could affect
> performance. Now, when we have high speed network adapters, SMP kernel
> and network stack, several locks acquired in the path of each packet,
> and i have an ability to test this in the lab.
>
> So, i prepared the patch, that removes IPFIREWALL_FORWARD option from
> the kernel and makes this functionality always build-in, but it is
> turned off by default and can be enabled via the sysctl(8) variable
> net.pfil.forward=1.
>
> 	http://people.freebsd.org/~ae/pfil_forward.diff
>
> Also we have done some tests with the ixia traffic generator connected
> via 10G network adapter. Tests have show that there is no visible
> difference, and there is no visible performance degradation.
>
> Any objections?
>
NO objection from me..
It was always my intention to "some day" either make it standard, OR 
at least default it to 'on'.

looks ot me as if a couple of your 'goto's might just be changed to  {}




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5081B2BD.3090103>