Date: Fri, 20 Dec 2002 16:57:22 -0800 From: Terry Lambert <tlambert2@mindspring.com> To: Sergey Mokryshev <mokr@mokr.net> Cc: Vallo Kallaste <kalts@estpak.ee>, Sam Leffler <sam@errno.com>, Hiten Pandya <hiten@unixdaemons.com>, Darren Reed <darrenr@reed.wattle.id.au>, current@FreeBSD.ORG Subject: Re: PFIL_HOOKS should be made default in 5.0 Message-ID: <3E03BC72.422C971F@mindspring.com> References: <20021221020951.C7129-100000@lemori.mokr.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Sergey Mokryshev wrote: > Unfortunately nobody cares to look into PR database (conf/44576) > > In case PFIL_HOOKS really slows IP processing I don't mind keeping this > out of GENERIC, however it should be noted in UPDATING and release notes. > > I did not do any time consuming searches the first time I tried to load > ipl.ko, but I've spent some time reading NOTES before upgrading to > -CURRENT and I am using IP Filter for about three years now on Solaris > and FreeBSD (thanks, Darren). > > IMHO GENERIC is not supposed to be fast, but to be useable out-of-the box. This is a reasonable argument... if it's possible to tune it so that it's fast. Hacking in the IP Filter hooks unonditionally for code that can't really be distributed as part of the system because of its license, and thus making things slower, with no chance to make them faster later, is not my idea of A Really Good Thing(tm). I'm really not a fan of "NO_PFIL_HOOKS" as an option. Probably the correct thing to do is to wire in ipfilter as a Netgraph module. -- Terry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3E03BC72.422C971F>