Date: Mon, 5 Aug 2019 18:13:17 -0700 From: Gleb Smirnoff <glebius@freebsd.org> To: Cy Schubert <cy@freebsd.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r349929 - head/sys/contrib/ipfilter/netinet Message-ID: <20190806011317.GG1398@FreeBSD.org> In-Reply-To: <201907120159.x6C1x9go013298@repo.freebsd.org> References: <201907120159.x6C1x9go013298@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, On Fri, Jul 12, 2019 at 01:59:09AM +0000, Cy Schubert wrote: C> Log: C> Move the new ipf_pcksum6() function from ip_fil_freebsd.c to fil.c. C> The reason for this is that ipftest(8), which still works on FreeBSD-11, C> fails to link to it, breaking stable/11 builds. C> C> ipftest(8) was broken (segfault) sometime during the FreeBSD-12 cycle. C> glebius@ suggested we disable building it until I can get around to C> fixing it. Hence this was not caught in -current. C> C> The intention is to fix ipftest(8) as it is used by the netbsd-tests C> (imported by ngie@ many moons ago) for regression testing. AFAIR, maintaining ipftest always was a PITA, as it wants to compile lots of kernel code into a userland utility. Of course, once disabled it will bitrot very quickly. I'd suggest to achive functionality of ipftest in a different way. Add a new ioctl() to the pfil(9), that will read a packet from the userland and match it against a given pfil head and report the result. This will make a universal tool for packet against ruleset checking for all existing firewalls, including ipfw and pf. Let's call it pfiltest utility. It can also be a part of existing pfilctl, invoked as "pfilctl test". The second missing bit of functionality is that ipftest can test against not the running ruleset, but some other ruleset. This can be achieved by adding multiple ruleset feature into existing firewalls. The pfil(9) already has notion of ruleset names, but so far ipfw, pf and ipf provide only "default". Once a firewall is able to make alternative rulesets, we can match this functionality: ipftest would install temporary ruleset, don't connect it to any head, run the new ioctl() on it, then destroy the ruleset. I'm sorry to come with a suggestion but can't contribute any time into it. -- Gleb Smirnoff
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190806011317.GG1398>