Date: Sun, 9 May 2004 01:16:59 -0700 From: Luigi Rizzo <rizzo@icir.org> To: "Louis A. Mamakos" <louie@transsys.com> Cc: Oleg Bulyzhin <oleg@rinet.ru> Subject: Re: ipfw: ouch!, skip past end of rules, denying packet Message-ID: <20040509011659.A52837@xorpc.icir.org> In-Reply-To: <20040509020814.61BB120F78@whizzo.transsys.com>; from louie@transsys.com on Sat, May 08, 2004 at 10:08:14PM -0400 References: <104341060709.20040505171307@vkt.lt> <20040505194451.V9766@lath.rinet.ru> <20040506153815.A75812@xorpc.icir.org> <20040507024206.B61144@xorpc.icir.org> <20040507150212.P5201@lath.rinet.ru> <20040509020814.61BB120F78@whizzo.transsys.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, May 08, 2004 at 10:08:14PM -0400, Louis A. Mamakos wrote: > > Not to hijack the thread here, but if you're looking at this code, it > would be nice if the logic that the ipfw "queue" command used was > similar to "divert"; where processing picks up at the next higher > rule number rather than the next rule (which might be numbered the > same.) actually i don't think the 'divert' behaviour was intentional, but just a side effect of the fact that the only visible rule identifier in userland is the rule number, and so you couldn't do otherwise. For dummynet pipes the situation is different as you remain in the kernel as packets remain in the kernel so you can keep track correctly of the matching rule and locate the next one. I understand that what you propose can be used to implement a 'switch' block, but i wonder if changing the behaviour now wouldn't break POLA... cheers luigi > I'd like to have a bunch of queue commands in a row (perhaps with less > specific matching criteria in successive rules) and know that if they're > all numbered the same, only the first one will match. > > louie
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040509011659.A52837>