ipfw2 net.inet.ip.fw.verbose_limit broken
Jeremy Chadwick
freebsd at jdc.parodius.com
Mon Aug 16 23:05:57 PDT 2004
Just wanted to toss this one up here. Also, apologies for not
cross-posting this to freebsd-ipfw, but I'm not on the list; although
they seem to be aware of it:
http://lists.freebsd.org/mailman/htdig/freebsd-ipfw/2004-July/001239.html
Seems that ipfw2's support for net.inet.ip.fw.verbose_limit is, to
put it bluntly, broken. This applies to both -STABLE and -CURRENT.
The following PR has been sitting around for quite some time...
http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/46080
I've managed to confirm this still exists even as of an August 5th build
of -CURRENT. Using `logamount' directives per rule works properly as
a workaround.
I've also looked at the patch, although I'm not sure about the performance
implications of looking up a sysctl value per packet with a matching
ipfw2 `log' directive.
The ipfw2 code isn't something I feel even remotely comfortable tinkering
with, so if someone could take a poke at this (or contact the correct
people), that'd be great.
Thanks!
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. |
More information about the freebsd-current
mailing list