Re: [CFR] unified rc.firewall
Hajimu UMEMOTO
>>>>> On Mon, 23 Nov 2009 10:27:43 -0800
>>>>> Benjamin Lee <b...@b1c1l1.com> said:
ben> There is a bug in ipfw send_pkt() that prevents ipfw_tick() from
ben> functioning for IPv6. See PR kern/117234.
I confirmed that the patch fixed the problem. Thank you for letting
me know.
Sincerely,
--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
u...@mahoroba.org ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/
_______________________________________________
freebsd...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-curre...@freebsd.org"
John Baldwin
> Hi,
>
> >>>>> John Baldwin <j...@freebsd.org> said:
>
> I updated the patch.
>
> jhb> I had missed the me vs any. It is true that the equivalent rule would use
> jhb> me6. I would rather figure out the IPv6 bug so that TCP is treated the
> jhb> same for both protocols instead of having a weaker firewall for IPv6 than
> jhb> IPV4.
>
> Yes, it is better, definitely. I thought that we could change to use
> dynamic rule, once it was fixed.
> Since the PR kern/117234 fixed it, I changed to use dynamic rule for
> IPv6 as well. So, it requires the patch in the PR.
>
> jhb> I do find the shorter version easier to read, and it matches the existing
> jhb> style as well as the examples in the manual page, handbook, etc.
>
> Okay, I changed 'ip6' to 'all' where we can use it, and stopped use of
> 'proto xxx'' as possible.
>
> I reconsidered oif vs oif6 and iif vs iif6 issue. Now, if
> $firewall_simple_oif_ipv6 is not set, $firewall_simple_oif is assumed
> for oif6, and, $firewall_simple_iif_ipv6 is not set,
> $firewall_simple_iif is assumed for iif6.
> Further, I think we don't assign a global IPv6 address to oif in
> usual. So, I made $firewall_simple_onet_ipv6 optional.
> One more change is that DHCPv6 is allowed as well as IPv4 DHCP for
> WORKSTATION type. I'm using DHCPv6 in usual; L2TP + DHCPv6 PD, DHCPv6
> DNS option ...
>
> Sincerely,
I think you can just remove the ipv6_firewall_* variables from
/etc/defaults/rc.conf completely. Perhaps you can use 'set_rcvar_obsolete'
in /etc/rc.firewall to emit a warning if ipv6_firewall_enable is defined?
Or maybe just emit an explicit warning in /etc/rc.firewall in that case?
Other than that I think this patch looks good. Thanks for fixing this!
--
John Baldwin
Hajimu UMEMOTO
>>>>> On Mon, 30 Nov 2009 13:00:03 -0500
>>>>> John Baldwin <j...@freebsd.org> said:
jhb> I think you can just remove the ipv6_firewall_* variables from
jhb> /etc/defaults/rc.conf completely. Perhaps you can use 'set_rcvar_obsolete'
jhb> in /etc/rc.firewall to emit a warning if ipv6_firewall_enable is defined?
jhb> Or maybe just emit an explicit warning in /etc/rc.firewall in that case?
jhb> Other than that I think this patch looks good. Thanks for fixing this!
Thank you for the comment. I've changed to use 'set_rcvar_obsolete',
and committed it.
Sincerely,
--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
u...@mahoroba.org ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/