Date: Fri, 10 Jun 2016 11:07:07 +0300 From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: lev@FreeBSD.org, freebsd-ipfw@freebsd.org Cc: "Alexander V. Chernikov" <melifaro@FreeBSD.org>, Julian Elischer <julian@freebsd.org> Subject: Re: IPFW: more "orthogonal? state operations, push into 11? Message-ID: <575A752B.1070304@FreeBSD.org> In-Reply-To: <5759DB79.10205@FreeBSD.org> References: <9229d4f7-8466-57b0-c954-117736102bd7@FreeBSD.org> <5755F0D3.9060909@FreeBSD.org> <5759DB79.10205@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Ml6vIscK6hcDbfoErNl1LwSqABb1dgS0J Content-Type: multipart/mixed; boundary="PJ03SWWUvkVl2H2ST3SEvVeDBRFPBhegA" From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: lev@FreeBSD.org, freebsd-ipfw@freebsd.org Cc: "Alexander V. Chernikov" <melifaro@FreeBSD.org>, Julian Elischer <julian@freebsd.org> Message-ID: <575A752B.1070304@FreeBSD.org> Subject: Re: IPFW: more "orthogonal? state operations, push into 11? References: <9229d4f7-8466-57b0-c954-117736102bd7@FreeBSD.org> <5755F0D3.9060909@FreeBSD.org> <5759DB79.10205@FreeBSD.org> In-Reply-To: <5759DB79.10205@FreeBSD.org> --PJ03SWWUvkVl2H2ST3SEvVeDBRFPBhegA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 10.06.16 00:11, Lev Serebryakov wrote: >> In terms of ipfw(4) a state is represented by ipfw_flow_id >> structure. To solve your task you just needs two states - one for >> not translated flow and second - for translated. > For what?! Logically it is one flow. NAT is kludge itself, of > course, but, IMHO, logically it doesn't create new flow, or > connection, whatever your name it. It hacks existing one. Your patch does exactly what I said - it creates state for untranslated flow when you call record-state with deferred action. Then after translation this flow has new addresses and ports, so ipfw_install_or_update_state() will create new state, old state will not updated (don't know for what purpose you have renamed it). Then when check-state/probe-state will be checked, both states can be updated by lookup_dyn_rule_locked() depending from flow that triggers this opcode. So, you introduced new implicit behavior while thinking that resolve old wrong behavior. --=20 WBR, Andrey V. Elsukov --PJ03SWWUvkVl2H2ST3SEvVeDBRFPBhegA-- --Ml6vIscK6hcDbfoErNl1LwSqABb1dgS0J Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJXWnUrAAoJEAHF6gQQyKF6z0YH/R49oAqK6nAUKwkTbnl2VBCs R3dLkcuVQggMGFuNH0YLQ5NJ2Swny3nHqU2opM2QY75HKYC+B1+yTJu2BJ/6dN61 Gqn7l9XQta7pkiDMvuYVFlHuf0UX4eCzWZYuWZpk4mqxLqPjO/eDUKxYffVXSsTV anLcQVOHx8hNMMgpzXoOsKIXOyYPqtCQkbXld+nkVuOlYN3pdsYYIXnlbNMU8w58 8l8gGsp4Vqhi4yAkk7aNTpmh+mDi1vHOZkFLXopH7tlevLNZRbvrr5sioSmOhTvs RCp4YIXAWmpds4FNA+srpZ1Ep9L+uUfdcOdDeOCZ6+zdM+UDtLtJP60rP4/xZWQ= =1Q3D -----END PGP SIGNATURE----- --Ml6vIscK6hcDbfoErNl1LwSqABb1dgS0J--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?575A752B.1070304>