Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 9 May 2004 01:16:59 -0700
From:      Luigi Rizzo <rizzo@icir.org>
To:        "Louis A. Mamakos" <louie@transsys.com>
Cc:        Oleg Bulyzhin <oleg@rinet.ru>
Subject:   Re: ipfw: ouch!, skip past end of rules, denying packet
Message-ID:  <20040509011659.A52837@xorpc.icir.org>
In-Reply-To: <20040509020814.61BB120F78@whizzo.transsys.com>; from louie@transsys.com on Sat, May 08, 2004 at 10:08:14PM -0400
References:  <104341060709.20040505171307@vkt.lt> <20040505194451.V9766@lath.rinet.ru> <20040506153815.A75812@xorpc.icir.org> <20040507024206.B61144@xorpc.icir.org> <20040507150212.P5201@lath.rinet.ru> <20040509020814.61BB120F78@whizzo.transsys.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, May 08, 2004 at 10:08:14PM -0400, Louis A. Mamakos wrote:
> 
> Not to hijack the thread here, but if you're looking at this code, it
> would be nice if the logic that the ipfw "queue" command used was
> similar to "divert"; where processing picks up at the next higher
> rule number rather than the next rule (which might be numbered the
> same.) 

actually i don't think the 'divert' behaviour was intentional, but
just a side effect of the fact that the only visible rule identifier
in userland is the rule number, and so you couldn't do otherwise.
For dummynet pipes the situation is different as you remain
in the kernel as packets remain in the kernel so you can keep
track correctly of the matching rule and locate the next one.

I understand that what you propose can be used to
implement a 'switch' block, but i wonder if changing
the behaviour now wouldn't break POLA...

	cheers
	luigi

> I'd like to have a bunch of queue commands in a row (perhaps with less
> specific matching criteria in successive rules) and know that if they're
> all numbered the same, only the first one will match.
> 
> louie



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040509011659.A52837>