Date: Sat, 16 Dec 2006 10:15:05 +0100 From: Andre Oppermann <andre@freebsd.org> To: Max Laier <max@love2party.net> Cc: freebsd-net@freebsd.org, Julian Elischer <julian@elischer.org> Subject: Re: addition to ipfw.. Message-ID: <4583B919.8030008@freebsd.org> In-Reply-To: <200612160446.02644.max@love2party.net> References: <457DCD47.5090004@elischer.org> <200612120045.41425.max@love2party.net> <4583119B.20608@elischer.org> <200612160446.02644.max@love2party.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Max Laier wrote: > I don't like the implementation for this reason. It feels hackish to me. > What is the reason that you didn't duplicate the ethernet header approach > in ip_fw_pfil.c? Speed? Did you measure? It is certainly easier to > properly strip off the vlan header in the pfil hook code and reattach it > when done (or trust the hardware to do it - if M_VLANTAG was set in the > first place). > > As an aside, I agree that the mtod mania isn't that great either and we > should probably do away with it. But that's orthogonal to the vlan > handling - I just don't like that to be pulled into *IP*fw. This might > just be me, however. IMO we should split IPFW into two parts (at least logically), one for *IP* firewalling, as you say, and one for Ethernet firewalling. With different not-intermixed rulesets. /sbin/ipfw could get a hardlink to /sbin/efw to do the ethernet rules display and manipulation. Note that this is a different thing from the etherbridge stuff where a layer 2 frame is inspected and turned temporarily into a layer 3 IP packet for inspection on the IP layer. -- Andre
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4583B919.8030008>