From owner-freebsd-net@FreeBSD.ORG Tue Sep 20 07:15:07 2005 Return-Path: X-Original-To: net@freebsd.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 84F5416A41F for ; Tue, 20 Sep 2005 07:15:07 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from smtp1-g19.free.fr (smtp1-g19.free.fr [212.27.42.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7167243D45 for ; Tue, 20 Sep 2005 07:15:06 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from tatooine.tataz.chchile.org (vol75-8-82-233-239-98.fbx.proxad.net [82.233.239.98]) by smtp1-g19.free.fr (Postfix) with ESMTP id B1F0E10478; Tue, 20 Sep 2005 09:15:04 +0200 (CEST) Received: by tatooine.tataz.chchile.org (Postfix, from userid 1000) id A063C405D; Tue, 20 Sep 2005 09:15:04 +0200 (CEST) Date: Tue, 20 Sep 2005 09:15:04 +0200 From: Jeremie Le Hen To: Brett Glass Message-ID: <20050920071504.GC24643@obiwan.tataz.chchile.org> References: <6.2.3.4.2.20050918205708.08cff430@localhost> <20050918235659.B60185@xorpc.icir.org> <6.2.3.4.2.20050919010035.07dfc448@localhost> <20050919005932.B60737@xorpc.icir.org> <6.2.3.4.2.20050919085600.07f783f0@localhost> <20050919160853.GA24643@obiwan.tataz.chchile.org> <20050919092003.A69332@xorpc.icir.org> <6.2.3.4.2.20050919105218.07f5b0d8@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6.2.3.4.2.20050919105218.07f5b0d8@localhost> User-Agent: Mutt/1.5.10i Cc: Luigi Rizzo , Jeremie Le Hen , net@freebsd.org Subject: Re: Efficient use of Dummynet pipes in IPFW X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Sep 2005 07:15:07 -0000 Hi Brett, Luigi, all, > >original > > > > ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN > > > >negated: > > > > ipfw add 1000 skipto 1001 cond1 cond2 cond3 cond4 cond5 ... condN > > ipfw add 1000 dosomething > > This doesn't work, because you must transform cond1 && cond2 && cond3... > into multiple rules that implement ~(cond1 || cond2 || cond3...). So, > you'd need do do the following: > > ipfw add 1000 skipto 1001 not cond1 > ipfw add 1000 skipto 1001 not cond2 > ... (N rules total) > ipfw add 1000 skipto 1001 not condN > ipfw add 1000 dosomething > ipfw add 1000 skipto 5000 // Where to resume on success > ipfw add 1001 I tend to agree with Luigi now. I didn't realize this before, but let's apply De Morgan's theorem. Each condition is identified as a small letter "a", "b", "c". "/a" means "not a" and the "." operator is AND, while the "+" operator is OR. The above "original" rule is therefore : a.b.c The above "negated" rule is obviously : /(a.b.c) With your ruleset may be summed up as : /a+/b+/c Which is the same as the "negated" rule in regard to De Morgan's theorem. Do you agree with this ? Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >