Date: Mon, 19 Sep 2005 00:59:32 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Brett Glass <brett@lariat.org> Cc: net@freebsd.org Subject: Re: Efficient use of Dummynet pipes in IPFW Message-ID: <20050919005932.B60737@xorpc.icir.org> In-Reply-To: <6.2.3.4.2.20050919010035.07dfc448@localhost>; from brett@lariat.org on Mon, Sep 19, 2005 at 01:32:33AM -0600 References: <6.2.3.4.2.20050918205708.08cff430@localhost> <20050918235659.B60185@xorpc.icir.org> <6.2.3.4.2.20050919010035.07dfc448@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Sep 19, 2005 at 01:32:33AM -0600, Brett Glass wrote: ... > Unfortunately, this requires inverting the sense of rules. And in IPFW's > very simplistic language, you can't invert a single rule with more > than one condition into another single rule because you can only yes i know. you need to make it into two rules. you have to live with what is there. Same for as the 'resume' option. It might be nice to have, however but there is already a two-rule version (the one i suggested, follow the non-terminating action with a skipto rule) so its absence is not blocking you from doing what you want. in terms of implementation, if you want to add it, the best place would be to add the 'skipto' fields to each 'action' opcode. I am not very interested in implementing it, though, because i still see ipfw as a low-level language. > I've looked at the source and it's fragmented and virtually undocumented, are you talking about the userland part or the kernel code ? i agree the userland part is a mess. But the kernel code i believe is reasonably documented (of course it could be documented better - patches welcome). the first 250 or so lines in ip_fw2.h are almost all comments describing the opcode formats. ip_fw2.c tries to describe rule parsing in the body of ipfw_chk() cheers luigi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050919005932.B60737>