Author: luigi
Date: Sat Dec 5 11:51:32 2009
New Revision: 200118
URL: http://svn.freebsd.org/changeset/base/200118
Log:
adjust comment in previous commit after Julian's explanation
Modified:
head/sys/netinet/ipfw/ip_fw2.c
Modified: head/sys/netinet/ipfw/ip_fw2.c
==============================================================================
--- head/sys/netinet/ipfw/ip_fw2.c Sat Dec 5 10:30:54 2009
(r200117)
+++ head/sys/netinet/ipfw/ip_fw2.c Sat Dec 5 11:51:32 2009
(r200118)
@@ -4924,15 +4924,16 @@ vnet_ipfw_init(const void *unused)
/*
* Hook the sockopt handler, and the layer2 (V_ip_fw_chk_ptr)
* and pfil hooks for ipv4 and ipv6. Even if the latter two fail
- * we still keep the module alive. ipfw[6]_hook return
- * either 0 or ENOENT in case of failure, so we can ignore the
- * exact return value and just set a flag.
+ * we still keep the module alive because the sockopt and
+ * layer2 paths are still useful.
+ * ipfw[6]_hook return 0 on success, ENOENT on failure,
+ * so we can ignore the exact return value and just set a flag.
*
- * XXX 20091204 note that V_ether_ipfw is checked on each packet,
- * whereas V_fw_enable is only checked at vnet load time.
- * This must be fixed so that they act in the same way
- * (probably hooking the pfil unconditionally, and bypassing
- * the processing if V_fw_enable=0). Same for V_fw6_enable
+ * Note that V_fw[6]_enable are manipulated by a SYSCTL_PROC so
+ * changes in the underlying (per-vnet) variables trigger
+ * immediate hook()/unhook() calls.
+ * In layer2 we have the same behaviour, except that V_ether_ipfw
+ * is checked on each packet because there are no pfil hooks.
*/
V_ip_fw_ctl_ptr = ipfw_ctl;
V_ip_fw_chk_ptr = ipfw_chk;
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
