From owner-cvs-all  Tue Feb 13  6:14:45 2001
Delivered-To: cvs-all@freebsd.org
Received: from critter.freebsd.dk (flutter.freebsd.dk [212.242.40.147])
	by hub.freebsd.org (Postfix) with ESMTP
	id 96A1937B491; Tue, 13 Feb 2001 06:14:35 -0800 (PST)
Received: from critter (localhost [127.0.0.1])
	by critter.freebsd.dk (8.11.1/8.11.1) with ESMTP id f1DEEaw51207;
	Tue, 13 Feb 2001 15:14:36 +0100 (CET)
	(envelope-from phk@critter.freebsd.dk)
Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/netinet ip_fw.c ip_fw.h src/sbin/ipfw ipfw.8 ipfw.c 
In-Reply-To: Your message of "Tue, 13 Feb 2001 06:12:37 PST."
             <200102131412.f1DECdZ12064@freefall.freebsd.org> 
Date: Tue, 13 Feb 2001 15:14:36 +0100
Message-ID: <51205.982073676@critter>
From: Poul-Henning Kamp <phk@critter.freebsd.dk>
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

In message <200102131412.f1DECdZ12064@freefall.freebsd.org>, Poul-Henning Kamp 
writes:
>phk         2001/02/13 06:12:37 PST
>
>  Modified files:
>    sys/netinet          ip_fw.c ip_fw.h 
>    sbin/ipfw            ipfw.8 ipfw.c 
>  Log:
>  Introduce a new feature in IPFW:  Check of the source or destination
>  address is configured on a interface.  This is useful for routers with
>  dynamic interfaces.  It is now possible to say:
>  
>          0100 allow       tcp from any to any established
>          0200 skipto 1000 tcp from any to any
>          0300 allow       ip from any to any
>          1000 allow       tcp from 1.2.3.4 to me 22
>          1010 deny        tcp from any to me 22
>          1020 allow       tcp from any to any
>  
>  and not have to worry about the behaviour if dynamic interfaces configure
>  new IP numbers later on.
>  
>  The check is semi expensive (traverses the interface address list)
>  so it should be protected as in the above example if high performance
>  is a requirement.

It would be more elegant to have multiple lists of ipfw rules:
        One input list per interface
        One output list per interface
        One list for packets being forwarded
        One list for packets arriving locally
        One list for packets originating locally

And it would be trivial to implement this in a backwards compatible
fashion, but I guess that is bikeshed coloring material so I'll
just leave that thought to fester here in case anyone feels like
looking at it....

--
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message