diff options
| -rw-r--r-- | sys/netinet/ipfw/ip_fw2.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/sys/netinet/ipfw/ip_fw2.c b/sys/netinet/ipfw/ip_fw2.c index 481cd7a..601d80e 100644 --- a/sys/netinet/ipfw/ip_fw2.c +++ b/sys/netinet/ipfw/ip_fw2.c @@ -4924,15 +4924,16 @@ vnet_ipfw_init(const void *unused) /* * Hook the sockopt handler, and the layer2 (V_ip_fw_chk_ptr) * and pfil hooks for ipv4 and ipv6. Even if the latter two fail - * we still keep the module alive. ipfw[6]_hook return - * either 0 or ENOENT in case of failure, so we can ignore the - * exact return value and just set a flag. + * we still keep the module alive because the sockopt and + * layer2 paths are still useful. + * ipfw[6]_hook return 0 on success, ENOENT on failure, + * so we can ignore the exact return value and just set a flag. * - * XXX 20091204 note that V_ether_ipfw is checked on each packet, - * whereas V_fw_enable is only checked at vnet load time. - * This must be fixed so that they act in the same way - * (probably hooking the pfil unconditionally, and bypassing - * the processing if V_fw_enable=0). Same for V_fw6_enable + * Note that V_fw[6]_enable are manipulated by a SYSCTL_PROC so + * changes in the underlying (per-vnet) variables trigger + * immediate hook()/unhook() calls. + * In layer2 we have the same behaviour, except that V_ether_ipfw + * is checked on each packet because there are no pfil hooks. */ V_ip_fw_ctl_ptr = ipfw_ctl; V_ip_fw_chk_ptr = ipfw_chk; |
