Luigi Rizzo wrote: > > On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote: > ... > > > Implementationwise, the kernel side is evidently trivial as the > > > original code already supports the idea of multiple chains. All > > > you need is to extend the struct ifnet with a pointer to the chain, > > > or use some other trick (e.g. going through ifindex) to quickly > > > associate a chain to the input (and possibly output) interface. > > > > Nonononononononononononononononononononononono. > > andre you need to cool down a bit!
I'm not angry but frustrated. In the network area it's too much 'lets quickly hack this in' instead of 'lets carefully design this in'. > i said "use some other trick" exactly to avoid changing > the struct ifnet. All i meant to say is that we want a unique > key, possibly in a small namespace, to quickly locate the per-if > private firewall info. How the key is used is not a business of > the rest of the kernel. But of course if it is an index in a > smallish array (such as ifindex) the thing is fast and clean. Ok, I'm fine with *this* approach. This can be done and handled inside ipfw_check_in|out() based on the interface pointer information passed in from pfil_run_hooks(). Then inside IPFW it can be implemented with multiple rule chains although I'm not convinced this would be the smartest approach. Wouldn't it be even better to have per-interface and global rules after each other? This way your problem with the general rule synching can be solved. -- Andre _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
