Re: addition to ipfw table..

2008-04-17 Thread Julian Elischer
Andrey V. Elsukov wrote: Julian Elischer wrote: I do know it won't handle non contiguous masks well but as the ipfw ABI code only accepts a network mask length instead of a mask, there's not much that can be done. I may suggest a later fix for that but it will break the ABI. comments? What yo

Re: addition to ipfw table..

2008-04-16 Thread Andrey V. Elsukov
Julian Elischer wrote: I do know it won't handle non contiguous masks well but as the ipfw ABI code only accepts a network mask length instead of a mask, there's not much that can be done. I may suggest a later fix for that but it will break the ABI. comments? What you think about my patch? -

Re: addition to ipfw..

2006-12-16 Thread Julian Elischer
Andre Oppermann wrote: Max Laier wrote: I don't like the implementation for this reason. It feels hackish to me. What is the reason that you didn't duplicate the ethernet header approach in ip_fw_pfil.c? Speed? Did you measure? It is certainly easier to properly strip off the vlan header

Re: addition to ipfw..

2006-12-16 Thread Julian Elischer
Max Laier wrote: On Friday 15 December 2006 22:20, Julian Elischer wrote: Max, further to your comment.. Max Laier wrote: On Monday 11 December 2006 23:58, Julian Elischer wrote: Andre Oppermann wrote: Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall a

Re: addition to ipfw..

2006-12-16 Thread Andre Oppermann
Max Laier wrote: I don't like the implementation for this reason. It feels hackish to me. What is the reason that you didn't duplicate the ethernet header approach in ip_fw_pfil.c? Speed? Did you measure? It is certainly easier to properly strip off the vlan header in the pfil hook code an

Re: addition to ipfw..

2006-12-15 Thread Max Laier
On Friday 15 December 2006 22:20, Julian Elischer wrote: > Max, further to your comment.. > > Max Laier wrote: > > On Monday 11 December 2006 23:58, Julian Elischer wrote: > >> Andre Oppermann wrote: > >>> Julian Elischer wrote: > in ipfw layer 2 processing, the packet is passed to the firewal

Re: addition to ipfw..

2006-12-15 Thread Julian Elischer
Max, further to your comment.. Max Laier wrote: On Monday 11 December 2006 23:58, Julian Elischer wrote: Andre Oppermann wrote: Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall as if it was a layer 3 IP packet but the ether header is also made available.

Re: addition to ipfw..

2006-12-11 Thread Julian Elischer
Max Laier wrote: On Monday 11 December 2006 23:58, Julian Elischer wrote: Andre Oppermann wrote: Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall as if it was a layer 3 IP packet but the ether header is also made available. I would like to add something

Re: addition to ipfw..

2006-12-11 Thread Julian Elischer
Max Laier wrote: On Monday 11 December 2006 23:58, Julian Elischer wrote: Andre Oppermann wrote: Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall as if it was a layer 3 IP packet but the ether header is also made available. I would like to add something

Re: addition to ipfw..

2006-12-11 Thread Max Laier
On Monday 11 December 2006 23:58, Julian Elischer wrote: > Andre Oppermann wrote: > > Julian Elischer wrote: > >> in ipfw layer 2 processing, the packet is passed to the firewall > >> as if it was a layer 3 IP packet but the ether header is also made > >> available. > >> > >> I would like to add s

Re: addition to ipfw..

2006-12-11 Thread Julian Elischer
Andre Oppermann wrote: Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall as if it was a layer 3 IP packet but the ether header is also made available. I would like to add something similar in the case where a vlan tag is also on the packet.. basically

Re: addition to ipfw..

2006-12-11 Thread Andre Oppermann
Julian Elischer wrote: in ipfw layer 2 processing, the packet is passed to the firewall as if it was a layer 3 IP packet but the ether header is also made available. I would like to add something similar in the case where a vlan tag is also on the packet.. basically I have a change where: