Date: Wed, 16 Apr 2014 23:40:15 +0800 From: bycn82 <bycn82@gmail.com> To: ae@freebsd.org, freebsd-ipfw@freebsd.org Subject: Re: kern/188543: [ipfw] ipfw option `in` is not working on FreeBSD10 Message-ID: <op.xee1tdehf9kwod@bill-win7> In-Reply-To: <op.xee00pe5f9kwod@bill-win7> References: <201404161420.s3GEK0OB081227@freefall.freebsd.org> <op.xee00pe5f9kwod@bill-win7>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi According to the `loop` in the chk() function, everytime it was invoked, the arg will be checked against `the chain`, so I assumed that the same is always the same, I saw that, `the chain` is always `V_layer3_chain`, but I did not find any V_layer2_chain !!! So I assumed that currently it always using the same`chain`. If so , is it better to separate the rules into multiple `chain`? for saying , chain1 chain2 chain3 chain4, and differnet `check point`s are going to use its own chain accordingly ? Respect your effort, and I want to say `thanks` here, Thanks! Best Regards, Bill Yuan On Wed, 16 Apr 2014 23:23:03 +0800, bycn82 <bycn82@gmail.com> wrote: > Cool! > I just finished the overview of the source code,and finally understood > the `for loop` in the ip_fw2.c roughly, > beside of the coding style,sorry for my ironic words, I want to ask > whether my understanding is correct. > > you wrap the packet/frame in the `check frame` or `check packet` which > where invoked in the hook() function, and pass it into the chk() function > and the chk() function will check the `args` against the whole rule > set.( the `chain` variable) > > so my question is , does it mean that all the packet need to be checked > against all the firewall rule, sorry I did not have time to > check/understand how we generate the `chain` yet, If it is really > working in this case, I cannot accept that personally! > > according to the man page, we have 4 `check point`, I assumed that we > have registered the hook() into 4 different places, for saying , if I > have 10K lines of rules which are for 4st `check point` only, based on > current logic, each packet/frame need to check against the rules for 4 > times, and actually in the 1 2 3rd `check-point` ,the verification are > not needed. I hope i was wrong, > > Can someone kindly explain the correct logic ? thanks very much! > > > On Wed, 16 Apr 2014 22:20:00 +0800, <ae@freebsd.org> wrote: > >> Synopsis: [ipfw] ipfw option `in` is not working on FreeBSD10 >> >> Responsible-Changed-From-To: freebsd-ipfw->ae >> Responsible-Changed-By: ae >> Responsible-Changed-When: Wed Apr 16 14:19:42 UTC 2014 >> Responsible-Changed-Why: >> Take it. >> >> http://www.freebsd.org/cgi/query-pr.cgi?pr=188543 >> _______________________________________________ >> freebsd-ipfw@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw >> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?op.xee1tdehf9kwod>