kern/188543: [ipfw] ipfw option `in` is not working on FreeBSD10

[Julian Elischer]

On 4/16/14, 11:40 PM, bycn82 wrote:
> Hi
> According to the `loop` in the chk() function, everytime it was 
> invoked, the arg will be checked against `the chain`, so I assumed 
> that the same is always the same,
> I saw that, `the chain` is always `V_layer3_chain`, but I did not 
> find any V_layer2_chain !!!
> So I assumed that currently it always using the same`chain`.
> If so , is it better to separate the rules into multiple `chain`? 
> for saying , chain1 chain2 chain3 chain4, and differnet `check 
> point`s are going to use its own chain accordingly ?

you can do that with 1 chain, by using the 'skipto' command to make 
packets from different entry-points skipto different rule numbers.
>
> Respect your effort, and I want to say `thanks` here, Thanks!
>
> Best Regards,
> Bill Yuan
>
> On Wed, 16 Apr 2014 23:23:03 +0800, bycn82 <bycn82 at gmail.com> wrote:
>
>> Cool!
>> I just finished the overview of the source code,and finally 
>> understood the `for loop` in the ip_fw2.c roughly,
>> beside of the coding style,sorry for my ironic words, I want to ask 
>> whether my understanding is correct.
>>
>> you wrap the packet/frame in the `check frame` or `check packet` 
>> which where invoked in the hook() function, and pass it into the 
>> chk() function
>> and the chk() function will check the `args` against the whole rule 
>> set.( the `chain` variable)
>>
>> so my question is , does it mean that all the packet need to be 
>> checked against all the firewall rule, sorry I did not have time to 
>> check/understand how we generate the `chain` yet, If it is really 
>> working in this case, I cannot accept that personally!
>>
>> according to the man page, we have 4 `check point`, I assumed that 
>> we have registered the hook() into 4 different places, for saying , 
>> if I have 10K lines of rules which are for 4st `check point` only, 
>> based on current logic, each packet/frame need to check against the 
>> rules for 4 times, and actually in the 1 2 3rd `check-point` ,the 
>> verification are not needed.  I hope i was wrong,
>>
>> Can someone kindly explain the correct logic ? thanks very much!
>>
>>
>> On Wed, 16 Apr 2014 22:20:00 +0800, <ae at freebsd.org> wrote:
>>
>>> Synopsis: [ipfw] ipfw option `in` is not working on FreeBSD10
>>>
>>> Responsible-Changed-From-To: freebsd-ipfw->ae
>>> Responsible-Changed-By: ae
>>> Responsible-Changed-When: Wed Apr 16 14:19:42 UTC 2014
>>> Responsible-Changed-Why:
>>> Take it.
>>>
>>> http://www.freebsd.org/cgi/query-pr.cgi?pr=188543
>>> _______________________________________________
>>> freebsd-ipfw at freebsd.org mailing list
>>> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
>>> To unsubscribe, send any mail to 
>>> "freebsd-ipfw-unsubscribe at freebsd.org"
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"
>