cvs commit: src/sys/netinet ip_fw2.c src/sys/sys mbuf.h

[Darren Reed]

On Sat, Jul 17, 2004 at 05:38:07AM +0200, Max Laier wrote:
> On Saturday 17 July 2004 04:40, Juli Mallett wrote:
> >   Log:
> >   Make M_SKIP_FIREWALL a global (and semantic) flag, preventing anything
> > from using M_PROTO6 and possibly shooting someone's foot, as well as
> > allowing the firewall to be used in multiple passes, or with a packet
> > classifier frontend, that may need to explicitly allow a certain packet. 
> > Presently this is handled in the ipfw_chk code as before, though I have run
> > with it moved to upper layers, and possibly it should apply to ipfilter and
> > pf as well, though this has not been investigated.
> 
> pf does something to the same effect by prepending a mbuf with the 
> "PACKET_TAG_PF_GENERATED" mbuf_tag to skip processing for its own packets. If 
> we can agree that the presence of M_SKIP_FIREWALL is copied to icmp error 
> messages I will happily replace the mbuf tag with the more general flag 
> (which will perform significantly better, I believe). Please tell me what you 
> think of this.

Hmmm...personally, I think it is better if firewall packages only ignore
what they've generated themselves.

If you're using multiple ones together, you may wish to use one as a gap
filler that is able to manage the "output" of another.

Darren