From owner-freebsd-ipfw@freebsd.org  Thu May 26 10:55:19 2016
Return-Path: <owner-freebsd-ipfw@freebsd.org>
Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4083CB4AFD3
 for <freebsd-ipfw@mailman.ysv.freebsd.org>;
 Thu, 26 May 2016 10:55:19 +0000 (UTC) (envelope-from sd@rlan.ru)
Received: from mail.rlan.ru (mail.rlan.ru [213.234.25.10])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id EE4191232;
 Thu, 26 May 2016 10:55:18 +0000 (UTC) (envelope-from sd@rlan.ru)
Subject: Re: [RFC] ipfw named states support
To: "Andrey V. Elsukov" <ae@FreeBSD.org>,
 freebsd-ipfw <freebsd-ipfw@freebsd.org>
References: <573C803E.5020600@FreeBSD.org>
From: Dmitry Selivanov <sd@rlan.ru>
Message-ID: <cf7c98e0-843d-dbec-2f00-836c4ee41f66@rlan.ru>
Date: Thu, 26 May 2016 13:11:13 +0300
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:45.0) Gecko/20100101
 Thunderbird/45.1.0
MIME-Version: 1.0
In-Reply-To: <573C803E.5020600@FreeBSD.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 26 May 2016 10:55:19 -0000

18.05.2016 17:46, Andrey V. Elsukov пишет:
> We have the patch that adds named states support to ipfw.
> The idea is that we add a symbolic name-label to each dynamic state in
> addition to IP addresses, protocol and ports.
> This introduces new syntax for check-state and keep-state rules:
>
>   check-state { token | default | any }
>   keep-state { token | default }

> 1. Is this feature useful?
Yes.
> 2. How to commit it? Due to changed syntax it can break existing
> rulesets. Probably, we can add some mandatory prefix to state name, e.g.
> ':'.
Maybe create new opcode, e.g. "save-state", and deprecate "keep-state" with "save-state default".
I'm sorry I didn't understand what Lev Serebryakov suggests, and I could duplicate his suggestion.

Maybe there is a sense to add "search-state" option and use it instead of "check-state" action. E.g. "allow dst-port 80 search-state NAME".