kern/188543: [ipfw] ipfw option `in` is not working on FreeBSD10

[bycn82]

Cool!
I just finished the overview of the source code,and finally understood the  
`for loop` in the ip_fw2.c roughly,
beside of the coding style,sorry for my ironic words, I want to ask  
whether my understanding is correct.

you wrap the packet/frame in the `check frame` or `check packet` which  
where invoked in the hook() function, and pass it into the chk() function
and the chk() function will check the `args` against the whole rule set.(  
the `chain` variable)

so my question is , does it mean that all the packet need to be checked  
against all the firewall rule, sorry I did not have time to  
check/understand how we generate the `chain` yet, If it is really working  
in this case, I cannot accept that personally!

according to the man page, we have 4 `check point`, I assumed that we have  
registered the hook() into 4 different places, for saying , if I have 10K  
lines of rules which are for 4st `check point` only, based on current  
logic, each packet/frame need to check against the rules for 4 times, and  
actually in the 1 2 3rd `check-point` ,the verification are not needed.  I  
hope i was wrong,

Can someone kindly explain the correct logic ? thanks very much!


On Wed, 16 Apr 2014 22:20:00 +0800, <ae at freebsd.org> wrote:

> Synopsis: [ipfw] ipfw option `in` is not working on FreeBSD10
>
> Responsible-Changed-From-To: freebsd-ipfw->ae
> Responsible-Changed-By: ae
> Responsible-Changed-When: Wed Apr 16 14:19:42 UTC 2014
> Responsible-Changed-Why:
> Take it.
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=188543
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"