Date: Mon, 18 Jul 2005 05:27:06 -0700 From: Luigi Rizzo <rizzo@icir.org> To: freebsd-ipfw@freebsd.org Subject: Re: "or" blocks in IPFW2 Message-ID: <20050718052706.A15796@xorpc.icir.org> In-Reply-To: <200507181106.j6IB6K8D008172@lurza.secnetix.de>; from olli@lurza.secnetix.de on Mon, Jul 18, 2005 at 01:06:20PM %2B0200 References: <20050718020900.D13026@xorpc.icir.org> <200507181106.j6IB6K8D008172@lurza.secnetix.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 18, 2005 at 01:06:20PM +0200, Oliver Fromme wrote:
> Luigi Rizzo <rizzo@icir.org> wrote:
> > On Wed, Jul 13, 2005 at 05:57:53PM +0200, Oliver Fromme wrote:
> > ...
> > > # ipfw add allow tcp from any to any \{ in recv fxp0 or out xmit fxp0 \}
> > > 04400 allow tcp from any to any in { recv fxp0 or out } xmit fxp0
> >
> > surely the parser is not very robust and should complain :)
> >
> > This said, the 'or' is a conjunction of individual options,
> > and 'in' is one option and 'recv fxp0' is another one.
>
> Okay ... So the braces are actually redundant, right?
no braces are absolutely necessary and the fact that 'or' has
priority is just a bug, accidental and contrary to intuition ('and' has
always priority over 'or', and in ipfw the 'and' is implicit).
> Because the "or" operator has highest priority anyway
> (except possibly for "not"), and braces cannot be used
> to change priority.
yes but once again accidenta.
if someone decides to implement proper expression
evaluation we do need the braces.
cheers
luigi
> > if you need something different you probably have to write separate rules.
>
> Thank you very much for the explanation. So I have to
> write separate rules. (Not a big deal.)
>
> Best regards
> Oliver
>
> --
> Oliver Fromme, secnetix GmbH & Co KG, Marktplatz 29, 85567 Grafing
> Any opinions expressed in this message may be personal to the author
> and may not necessarily reflect the opinions of secnetix in any way.
>
> One Unix to rule them all, One Resolver to find them,
> One IP to bring them all and in the zone to bind them.
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050718052706.A15796>