lkml.org 
[lkml]   [1997]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Generic IP Firewalling Chains
Date
> 1) Why is the dev_get() call in ip_fw.c's insert_in_chain inside a
> cli()? Can a device go down or up on an interrupt?

No it can't. It looks like when the feature was added it was put inside
the dev_get() unnecessarily. Also you can lock the device list briefly
with dev_lock_list() anyway.

> 2) Does anyone actually use TOS setting? Why is it that ip_fw.c
> mangles the TOS rules so that "minimise cost" can never be effected?
> (Shouldn't this be enforced in ipfwadm, not silently in the kernel?)

People do use it. It doesn't handle minimise cost as that postdates the
documents read by the authors of that code at the time.

The other thing needed fairly soon is labelling. That is so you can say

ipfwadm -I -i accept -S mywebserver:80 -D 0/0 -P tcp label 44

and then in the shaper to be things like

shapecfg shaper0 class 44 bandwidth 32000

I've held off that for now while I fixed other stuff, but if we go for
a firewall change then that would be the time to add it.

Once you are happy the code is solid I'd be interested in switching to it,
although being able to use ipchain in a totally ipfwadm compatible matter
would be important (perhaps if(strcmp(argv[0],"ipfwadm")==0) compat=1;
or whatever) so people don't have to redo all sorts of firewall scripts
and all the books dont go out of date, merely less featureful

Alan


\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.032 / U:0.808 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site