From owner-cvs-all Thu Feb 15 13:24: 3 2001 Delivered-To: cvs-all@freebsd.org Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26]) by hub.freebsd.org (Postfix) with ESMTP id 8402A37B401; Thu, 15 Feb 2001 13:23:57 -0800 (PST) Received: from curve.dellroad.org (curve.dellroad.org [10.1.1.30]) by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id NAA13138; Thu, 15 Feb 2001 13:23:57 -0800 (PST) Received: (from archie@localhost) by curve.dellroad.org (8.9.3/8.9.3) id NAA82143; Thu, 15 Feb 2001 13:23:56 -0800 (PST) (envelope-from archie) From: Archie Cobbs Message-Id: <200102152123.NAA82143@curve.dellroad.org> Subject: Re: cvs commit: src/sys/netinet ip_fw.c ip_fw.h src/sbin/ipfw ipfw.8 ipfw.c In-Reply-To: <200102131601.LAA30728@khavrinen.lcs.mit.edu> "from Garrett Wollman at Feb 13, 2001 11:01:48 am" To: Garrett Wollman Date: Thu, 15 Feb 2001 13:23:56 -0800 (PST) Cc: Poul-Henning Kamp , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org X-Mailer: ELM [version 2.4ME+ PL77 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Garrett Wollman writes: > > It would be more elegant to have multiple lists of ipfw rules: > > That is an excellent idea (and one that has been suggested before to > no effect). Doing so would also improve the speed of access-list > evaluation, and would make ipfw more comfortable for those who are > used to (e.g.) Cisco per-interface access-lists. Here's a proposal :-) Netgraphify the entire networking stack. Each interface is a node, the local IP stack (or stacks) is a node, etc. Sprinkle liberally with ng_ipfw(4) (or better yet, ng_bpf(4), allowing full tcpdump style packet matching) nodes to suit. -Archie __________________________________________________________________________ Archie Cobbs * Packet Design * http://www.packetdesign.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message