Date: Thu, 15 Feb 2001 13:23:56 -0800 (PST) From: Archie Cobbs <archie@dellroad.org> To: Garrett Wollman <wollman@khavrinen.lcs.mit.edu> Cc: Poul-Henning Kamp <phk@critter.freebsd.dk>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw.c ip_fw.h src/sbin/ipfw ipfw.8 ipfw.c Message-ID: <200102152123.NAA82143@curve.dellroad.org> In-Reply-To: <200102131601.LAA30728@khavrinen.lcs.mit.edu> "from Garrett Wollman at Feb 13, 2001 11:01:48 am"
next in thread | previous in thread | raw e-mail | index | archive | help
Garrett Wollman writes: > > It would be more elegant to have multiple lists of ipfw rules: > > That is an excellent idea (and one that has been suggested before to > no effect). Doing so would also improve the speed of access-list > evaluation, and would make ipfw more comfortable for those who are > used to (e.g.) Cisco per-interface access-lists. Here's a proposal :-) Netgraphify the entire networking stack. Each interface is a node, the local IP stack (or stacks) is a node, etc. Sprinkle liberally with ng_ipfw(4) (or better yet, ng_bpf(4), allowing full tcpdump style packet matching) nodes to suit. -Archie __________________________________________________________________________ Archie Cobbs * Packet Design * http://www.packetdesign.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200102152123.NAA82143>