Date: Mon, 1 May 2000 13:21:43 -0700 (PDT) From: Archie Cobbs <archie@whistle.com> To: luigi@info.iet.unipi.it (Luigi Rizzo) Cc: freebsd-net@FreeBSD.ORG Subject: Re: ether matching in ipfw?? Message-ID: <200005012021.NAA93590@bubba.whistle.com> In-Reply-To: <200005012003.WAA46626@info.iet.unipi.it> from Luigi Rizzo at "May 1, 2000 10:03:07 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Luigi Rizzo writes: > > In trying to clean up this bridging stuff, I just realized that > > ip_fw_chk() contains code for matching Ethernet headers and > > non IP packets! > > > > This hack is just too gross and I plan to rip it out. > > Call me Danish if you like. > > yes it was a gross, and, especially, unfinished hack, and you are > welcome to rip it out. I should have done it myself long ago. > > HOWEVER: for the future re-inclusion I would be a strong advocate > of a unified firewall interface rather than separate things > (etherfw, ipfw). The reason is because at times one might want > to interleave rules matching ethernet headers, ip headers, tcp > headers, and having separate filters does not support this. Yes, I think that's a good idea. Seems like a good approach would be to have separate per-layer filtering in the kernel implementation, with a nice intuitive unified userland view. > > Does the "ip" in "ipfw" not mean anything to anyone?? > > for what matters we are already matching TCP flags which are > one layer above IP... True.. if we did things properly we'd have different filtering engines at each level. This would not be too hard to acomplish using netgraph by providing 'stub' hooks at the appropriate points in the networking stack. It should all have a nice unified userland view of course. -Archie ___________________________________________________________________________ Archie Cobbs * Whistle Communications, Inc. * http://www.whistle.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200005012021.NAA93590>