Date: Sat, 21 Dec 2002 04:15:09 +0300 (MSK) From: Sergey Mokryshev <mokr@mokr.net> To: Terry Lambert <tlambert2@mindspring.com> Cc: Vallo Kallaste <kalts@estpak.ee>, Sam Leffler <sam@errno.com>, Hiten Pandya <hiten@unixdaemons.com>, Darren Reed <darrenr@reed.wattle.id.au>, <current@FreeBSD.ORG> Subject: Re: PFIL_HOOKS should be made default in 5.0 Message-ID: <20021221040724.G7129-100000@lemori.mokr.ru> In-Reply-To: <3E03BC72.422C971F@mindspring.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 20 Dec 2002, Terry Lambert wrote: > Sergey Mokryshev wrote: > > Unfortunately nobody cares to look into PR database (conf/44576) > > > > In case PFIL_HOOKS really slows IP processing I don't mind keeping this > > out of GENERIC, however it should be noted in UPDATING and release notes. > > > > I did not do any time consuming searches the first time I tried to load > > ipl.ko, but I've spent some time reading NOTES before upgrading to > > -CURRENT and I am using IP Filter for about three years now on Solaris > > and FreeBSD (thanks, Darren). > > > > IMHO GENERIC is not supposed to be fast, but to be useable out-of-the box. > > This is a reasonable argument... if it's possible to tune it so > that it's fast. Hacking in the IP Filter hooks unonditionally > for code that can't really be distributed as part of the system > because of its license, and thus making things slower, with no > chance to make them faster later, is not my idea of A Really > Good Thing(tm). > > I'm really not a fan of "NO_PFIL_HOOKS" as an option. > I'm not talking about NO_PFIL_HOOKS but "options PFIL_HOOKS" in GENERIC. Too many people may foot shoot themselves trying to upgrade from 4-STABLE to 5.0. "dd" in vi is really quick. We still can remove this options from BOOTMFS kernel to keep it small. > Probably the correct thing to do is to wire in ipfilter as a > Netgraph module. > AFAIK Solaris, HP-UX and others lack Netgraph support, but support pfil. Darren may (or may not) explain it further. IMHO it is almost impossible and pointless (I did not look in the code, just MHO). Sergey Mokryshev -- Sergey S. Mokryshev <mokr@mokr.net> SMP453, MOKR-RIPN To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021221040724.G7129-100000>