RFC: ipfirewall_forward patch #2

2001-11-16 Thread Julian Elischer
Here is a fixed version of this patch. last one used an unitialised variable. Note: the whole ipfw/fwd scheme is non re-entrant. to fix it and some other parts of the code will require that we gain teh capability of associating extra state with a packet.. e.g. "this packet has been diverted" or

Re: RFC: ipfirewall_forward patch

2001-11-16 Thread Julian Elischer
ethfw should be implemented as a negraph module... (all teh hooks are already there) On Fri, 16 Nov 2001, Mikel King wrote: > Chrisy Luke wrote: > > > Mikel King wrote (on Nov 16): > > > Just curious, but what's a doddle? > > > > It's like a doodle, but with less o's and more d's. :) > > > > I

Re: RFC: ipfirewall_forward patch

2001-11-16 Thread Julian Elischer
A "doddle" is "a task so easy that you could do it in your sleep" (BTW the patch has a small bug.. but the fix is trivial.) On Fri, 16 Nov 2001, Mikel King wrote: > Just curious, but what's a doddle? > > Cheers, > mikel > > Julian Elischer wrote: > > > On Thu, 15 Nov 2001, Chrisy Luke wrot

Re: RFC: ipfirewall_forward patch

2001-11-16 Thread Mikel King
Chrisy Luke wrote: > Mikel King wrote (on Nov 16): > > Just curious, but what's a doddle? > > It's like a doodle, but with less o's and more d's. :) > > It essentially means "this is easy to do". > > Chris. > -- > == [EMAIL PROTECTED]T: +44 845 333 0122 > == Gl

Re: RFC: ipfirewall_forward patch

2001-11-16 Thread Chrisy Luke
Mikel King wrote (on Nov 16): > Just curious, but what's a doddle? It's like a doodle, but with less o's and more d's. :) It essentially means "this is easy to do". Chris. -- == [EMAIL PROTECTED]T: +44 845 333 0122 == Global IP Network Engineering, Easynet G

Re: RFC: ipfirewall_forward patch

2001-11-16 Thread Mikel King
Just curious, but what's a doddle? Cheers, mikel Julian Elischer wrote: > On Thu, 15 Nov 2001, Chrisy Luke wrote: > > > > only packets already leaving the system can be hijacked and forwarded > > > > to a 2nd machine. Incoming packets can only be forwarded to local > > > > addresses/port combin

Re: RFC: ipfirewall_forward patch

2001-11-14 Thread Julian Elischer
On Thu, 15 Nov 2001, Chrisy Luke wrote: > > > only packets already leaving the system can be hijacked and forwarded > > > to a 2nd machine. Incoming packets can only be forwarded to local > > > addresses/port combinations. > > My fault. I was being lazy when I wrote it. :) Ah it WAS you I comm

Re: RFC: ipfirewall_forward patch

2001-11-14 Thread Chrisy Luke
Excuse me feollowing up to myself, but... Chrisy Luke wrote (on Nov 15): > It looks good. The ipfw syntax doesn't quite make sense to me. > Also, are you requiring that they all be on the same ipfw rule number? Ignore this. Just occured to me you're sharing load based on a netmask. A small stat

Re: RFC: ipfirewall_forward patch

2001-11-14 Thread Chrisy Luke
Julian Elischer wrote (on Nov 15): > Oops forgot the patch.. here it is... I almost replied to the first - too quick off the mark! > Julian Elischer wrote: > > Ipfw 'fwd' at present has teh following restriction: > > > > only packets already leaving the system can be hijacked and forwarded >

Re: RFC: ipfirewall_forward patch

2001-11-14 Thread Julian Elischer
Oops forgot the patch.. here it is... Julian Elischer wrote: > > The following patch is expected to > allow the forwarding of INCOMING packets to an arbitrary next hop > controlled by the ipfw fwd command.. > > Ipfw 'fwd' at present has teh following restriction: > > only packets already le

RFC: ipfirewall_forward patch

2001-11-14 Thread Julian Elischer
The following patch is expected to allow the forwarding of INCOMING packets to an arbitrary next hop controlled by the ipfw fwd command.. Ipfw 'fwd' at present has teh following restriction: only packets already leaving the system can be hijacked and forwarded to a 2nd machine. Incoming packet