DragonFly BSD
DragonFly kernel List (threaded) for 2006-06
[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]

Re: ipfw deprecation

From: "Simon 'corecode' Schubert" <corecode@xxxxxxxxxxxx>
Date: Thu, 29 Jun 2006 11:16:00 +0200

On 29.06.2006, at 07:03, Andreas Hauser wrote:
I would like to deprecate ipfw (and dummynet, because it needs ipfw)
for the next release and remove it in 1.7.
Can you please show that pf is as fast as ipfw?
No, can't. As I understand the current answers, we will remove ipfw
from the main code path and get a pfil'ed version instead. So this
won't affect the speed after all. Besides, if somebody cares about his
filtering speed, he should do measurements. I don't have the network,
the equipment, nor the filter set to measure speed.
Well, last time i measured it was a lot slower. I would think that
a good procedure was that if someone wants to remove healthy code
that he has to proof that it is valid to do so.

Yes, the proof is the cleanliness of code: ipfw is in the main code path and needs to be removed from there. That's the only proof I need. Using your reasoning, we would not be allowed to remove crude hacks in favour of nice code, because the crude hacks are faster (quite possible in many cases). But as DragonFly is not the fastest OS ever, and neither aims to be as fast as it can get, by sacrificing transparency and nice code for speed, we won't have to do benchmarks for every change which makes the existing code more maintainable.

Please test at least the cases that /etc/rc.firewall allows for
and provide a script like it for replacement.

A replacement ruleset is a good idea, though I am not sure how to handle different types of filtering in one pf ruleset. But maybe somebody is interested in providing one?


Serve - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /"\
Work - Mac      +++  space for low €€€ NOW!1  +++      Campaign     \ /
Party Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \
Dude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \

Attachment: PGP.sig
Description: This is a digitally signed message part

[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]