Date: Mon, 16 Aug 2004 23:05:56 -0700 From: Jeremy Chadwick <freebsd@jdc.parodius.com> To: freebsd-current@freebsd.org Subject: ipfw2 net.inet.ip.fw.verbose_limit broken Message-ID: <20040817060556.GA7458@parodius.com>
next in thread | raw e-mail | index | archive | help
Just wanted to toss this one up here. Also, apologies for not cross-posting this to freebsd-ipfw, but I'm not on the list; although they seem to be aware of it: http://lists.freebsd.org/mailman/htdig/freebsd-ipfw/2004-July/001239.html Seems that ipfw2's support for net.inet.ip.fw.verbose_limit is, to put it bluntly, broken. This applies to both -STABLE and -CURRENT. The following PR has been sitting around for quite some time... http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/46080 I've managed to confirm this still exists even as of an August 5th build of -CURRENT. Using `logamount' directives per rule works properly as a workaround. I've also looked at the patch, although I'm not sure about the performance implications of looking up a sysctl value per packet with a matching ipfw2 `log' directive. The ipfw2 code isn't something I feel even remotely comfortable tinkering with, so if someone could take a poke at this (or contact the correct people), that'd be great. Thanks! -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040817060556.GA7458>