Re: bridge(4)+ NPF

[Mindaugas Rasiukevicius <rmind%netbsd.org@localhost>]

Stephen Borrill <netbsd%precedence.co.uk@localhost> wrote:
> I've happily used BRIDGE_IPF in the past, but given IPFilter 5's lack of 
> stability, I've been forced to consider NPF even with its missing 
> functionality. Does NPF have a similar option to BRIDGE_IPF?

Despite the name, BRIDGE_IPF is pretty generic code -- it just passes
the bridged packets through the pfil(9) hooks, with the Etherned header
temporarily removed.  I did not inspect the BRIDGE_IPF code in detail,
but generally there should be no reason why it would not work with NPF
or other packet filters.

Also, having the BRIDGE_IPF kernel option does not seem to be worth
these days.  The #ifdef-ed code is small and it's configured by a flag.

-- 
Mindaugas