On Sat, Dec 16, 2006 at 05:09:42PM +0100, Max Laier wrote: > Okay, spoken too quick ... I just had an idea (enlightment you might say - > given the time of year), that might finally get us rid of this symptom > (not of the problem though). > > The attached diff circumvents the problem by **always** doing the > credential lookup *before* walking the pf rules. This has the benefit, > that it works (at least I think it should), but there is a price to pay. > Now we have to pay for the socket lookup for *every* tcp and udp packet > instead of just for those that really hit uid/gid rules. That's why I > decided to make is a config option "PF_MPFSAFE_UGID" which you can turn > on if you are running a setup that will benefit. The patch turns it on > for the module-built by default. Is it possible to keep a reference count of the number of uid/gid rules and perform the lookup early if it is non-zero?
Andrew _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
