From owner-freebsd-ipfw@FreeBSD.ORG Wed Apr 16 15:23:18 2014 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 443E37C7; Wed, 16 Apr 2014 15:23:18 +0000 (UTC) Received: from mail-pd0-x22e.google.com (mail-pd0-x22e.google.com [IPv6:2607:f8b0:400e:c02::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id F11141B1F; Wed, 16 Apr 2014 15:23:17 +0000 (UTC) Received: by mail-pd0-f174.google.com with SMTP id y13so10770474pdi.5 for ; Wed, 16 Apr 2014 08:23:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:to:subject:references:date:mime-version :content-transfer-encoding:from:organization:message-id:in-reply-to :user-agent; bh=qZpBy3rpaB2nHv00dPtutKdw6Hb1CQ0aPGLiPjbwzKY=; b=oZNfIqehNTTxrYakFJXpFly6ohkrmcHFYhPkvoTwoEDFOFx1ZD9oGvXcRLOxd7HxOo 7JrXgkJId4zxNe7h5YGHH1HIUE5ZIQhtGJQlafifxD7JVvLIYAadNafER4nLYJ96VDpp SeQDXu5XLEqxnkNx/GFvqZTu1EqZAR0+PfJUJ4s8tItn6WwUrAp57Q9Z+g7MekkZhnZ2 dBBljnOa0rqTN6PeitrDplBG6fBH61tndVKwHat8TVueYuZ0KQbCCC3BxfYt/AuyYEHa hIFAdDe5dJ5PiSvugeH6fZDHdbDGwDavsD+1D/FKxwetUBOiHq9/LwN8/8ea/st7h32h 1G7Q== X-Received: by 10.68.179.36 with SMTP id dd4mr9095887pbc.139.1397661797345; Wed, 16 Apr 2014 08:23:17 -0700 (PDT) Received: from bill-win7 (amx-tls2.starhub.net.sg. [203.116.164.12]) by mx.google.com with ESMTPSA id kl1sm47609355pbd.73.2014.04.16.08.23.13 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Wed, 16 Apr 2014 08:23:15 -0700 (PDT) Content-Type: text/plain; charset=gbk; format=flowed; delsp=yes To: ae@freebsd.org, freebsd-ipfw@freebsd.org Subject: Re: kern/188543: [ipfw] ipfw option `in` is not working on FreeBSD10 References: <201404161420.s3GEK0OB081227@freefall.freebsd.org> Date: Wed, 16 Apr 2014 23:23:03 +0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: bycn82 Organization: cozilyworks Message-ID: In-Reply-To: <201404161420.s3GEK0OB081227@freefall.freebsd.org> User-Agent: Opera Mail/1.0 (Win32) X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Apr 2014 15:23:18 -0000 Cool! I just finished the overview of the source code,and finally understood the `for loop` in the ip_fw2.c roughly, beside of the coding style,sorry for my ironic words, I want to ask whether my understanding is correct. you wrap the packet/frame in the `check frame` or `check packet` which where invoked in the hook() function, and pass it into the chk() function and the chk() function will check the `args` against the whole rule set.( the `chain` variable) so my question is , does it mean that all the packet need to be checked against all the firewall rule, sorry I did not have time to check/understand how we generate the `chain` yet, If it is really working in this case, I cannot accept that personally! according to the man page, we have 4 `check point`, I assumed that we have registered the hook() into 4 different places, for saying , if I have 10K lines of rules which are for 4st `check point` only, based on current logic, each packet/frame need to check against the rules for 4 times, and actually in the 1 2 3rd `check-point` ,the verification are not needed. I hope i was wrong, Can someone kindly explain the correct logic ? thanks very much! On Wed, 16 Apr 2014 22:20:00 +0800, wrote: > Synopsis: [ipfw] ipfw option `in` is not working on FreeBSD10 > > Responsible-Changed-From-To: freebsd-ipfw->ae > Responsible-Changed-By: ae > Responsible-Changed-When: Wed Apr 16 14:19:42 UTC 2014 > Responsible-Changed-Why: > Take it. > > http://www.freebsd.org/cgi/query-pr.cgi?pr=188543 > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"