Date: Tue, 14 Dec 2004 06:03:41 -0800 From: Luigi Rizzo <rizzo@icir.org> To: Andre Oppermann <andre@freebsd.org> Cc: freebsd-net@freebsd.org Subject: Re: per-interface packet filters [summary] Message-ID: <20041214060341.A77720@xorpc.icir.org> In-Reply-To: <41BEE0E7.BD2316EB@freebsd.org>; from andre@freebsd.org on Tue, Dec 14, 2004 at 01:47:35PM %2B0100 References: <20041213124051.GB32719@cell.sick.ru> <20041214085123.GB42820@cell.sick.ru> <20041214015603.A75019@xorpc.icir.org> <41BEE0E7.BD2316EB@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote: ... > > Implementationwise, the kernel side is evidently trivial as the > > original code already supports the idea of multiple chains. All > > you need is to extend the struct ifnet with a pointer to the chain, > > or use some other trick (e.g. going through ifindex) to quickly > > associate a chain to the input (and possibly output) interface. > > Nonononononononononononononononononononononono. andre you need to cool down a bit! i said "use some other trick" exactly to avoid changing the struct ifnet. All i meant to say is that we want a unique key, possibly in a small namespace, to quickly locate the per-if private firewall info. How the key is used is not a business of the rest of the kernel. But of course if it is an index in a smallish array (such as ifindex) the thing is fast and clean. cheers luigi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041214060341.A77720>