Date: Mon, 19 Sep 2005 11:20:46 -0600 From: Brett Glass <brett@lariat.org> To: Luigi Rizzo <rizzo@icir.org>, Jeremie Le Hen <jeremie@le-hen.org> Cc: net@freebsd.org Subject: Re: Efficient use of Dummynet pipes in IPFW Message-ID: <6.2.3.4.2.20050919105218.07f5b0d8@localhost> In-Reply-To: <20050919092003.A69332@xorpc.icir.org> References: <6.2.3.4.2.20050918205708.08cff430@localhost> <20050918235659.B60185@xorpc.icir.org> <6.2.3.4.2.20050919010035.07dfc448@localhost> <20050919005932.B60737@xorpc.icir.org> <6.2.3.4.2.20050919085600.07f783f0@localhost> <20050919160853.GA24643@obiwan.tataz.chchile.org> <20050919092003.A69332@xorpc.icir.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 10:20 AM 9/19/2005, Luigi Rizzo wrote: >original > > ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN > >negated: > > ipfw add 1000 skipto 1001 cond1 cond2 cond3 cond4 cond5 ... condN > ipfw add 1000 dosomething This doesn't work, because you must transform cond1 && cond2 && cond3... into multiple rules that implement ~(cond1 || cond2 || cond3...). So, you'd need do do the following: ipfw add 1000 skipto 1001 not cond1 ipfw add 1000 skipto 1001 not cond2 ... (N rules total) ipfw add 1000 skipto 1001 not condN ipfw add 1000 dosomething ipfw add 1000 skipto 5000 // Where to resume on success ipfw add 1001 // Jump target; implemented in IPFW as "count ip from any to any" The other way to do it is via "spaghetti rules:" ipfw add 1000 skipto 1002 cond1 cond2 cond3 cond4 cond5 ... condN ipfw add 1001 skipto 1003 ipfw add 1002 dosomething ipfw add 1002 skipto 5000 // Where to resume on success ipfw add 1003 // Jump target; implemented inside IPFW as "count ip from any to any" Or you can do the entire pattern match twice: ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN ipfw add 1000 skipto 5000 cond1 cond2 cond3 cond4 cond5 ... condN --Brett
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6.2.3.4.2.20050919105218.07f5b0d8>