From owner-freebsd-ipfw@FreeBSD.ORG  Tue Feb  3 10:26:58 2015
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 1B8D920F;
 Tue,  3 Feb 2015 10:26:58 +0000 (UTC)
Received: from onlyone.friendlyhosting.spb.ru (onlyone.friendlyhosting.spb.ru
 [46.4.40.135]) by mx1.freebsd.org (Postfix) with ESMTP id D021F36F;
 Tue,  3 Feb 2015 10:26:57 +0000 (UTC)
Received: from [192.168.135.70] (unknown [94.19.235.70])
 (Authenticated sender: lev@serebryakov.spb.ru)
 by onlyone.friendlyhosting.spb.ru (Postfix) with ESMTPSA id E79945C002;
 Tue,  3 Feb 2015 13:26:26 +0300 (MSK)
Message-ID: <54D0A253.1080302@FreeBSD.org>
Date: Tue, 03 Feb 2015 13:26:27 +0300
From: Lev Serebryakov <lev@FreeBSD.org>
Reply-To: lev@FreeBSD.org
Organization: FreeBSD
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Julian Elischer <julian@freebsd.org>, 
 freebsd-ipfw <freebsd-ipfw@freebsd.org>,
 freebsd-net <freebsd-net@freebsd.org>
Subject: Re: [RFC][patch] Two new actions: state-allow and state-deny
References: <54CFCD45.9070304@FreeBSD.org> <54D06E5C.3090701@freebsd.org>
 <54D0951F.2000304@FreeBSD.org>
In-Reply-To: <54D0951F.2000304@FreeBSD.org>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Feb 2015 10:26:58 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 03.02.2015 12:30, Lev Serebryakov wrote:

> "keep-state". Problem is, it adds "if" branch for EACH action (in 
> kernel code). IMHO, it is very prohibitive. I've though about
> that, but decide it is too expensive to have "if (!iHaveRecordOnly
> || fromDynamic)" for EACH action, always. It could be done easily,
> of course.
 Oh, I'm stupid! I know how to do "keep-state-only" cheap for fast path!

 I'll prepare new patch today or tomorrow.

 Also, I BADLY want "keep-state-but-dont-check" one. Sometimes it adds
couple of "skipto" rules to avoid "keep-state" because it will trigger
check too, even if MATCH will fail.

- -- 
// Lev Serebryakov AKA Black Lion
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQJ8BAEBCgBmBQJU0KJTXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRGOTZEMUNBMEI1RjQzMThCNjc0QjMzMEFF
QUIwM0M1OEJGREM0NzhGAAoJEOqwPFi/3EePTEMP/R3MZ8AmqKA0h7pFPy5SCwjT
/zhnjjRvk+sDpc5BJPA/xIXV8IBupCPBCDR8CvCcqbaxFBECTTbW+JHCaHB0idXf
F7lI2fTjiXcx5EK3E1RkjJ8dbRuHLAiYttMA4e1YIZBidsflgX/wLIEexseeia1K
Vqh0NLofJLgzZET+wDbDBNncgWSaUnyJyW05BtVDUi/kpHekpZg4zm71gfWAoLgl
tROv3i0y1YfkulwzZ84BcegsEAPMqD11AhSYZayeF1Ozl5jBGXTpC4rhaOQNYl7n
+Hcr828rOZFiP/b4p/QhHx0TAMdYm3oqxSXMtr8GzWK+q5cClk7vdBv2Nj2W5f43
jOaJhDHgy21HxKCmFKKvSg/ZMb43F21ZHh0hU4eVlAK+AH74cli8hISTzZo4KxwC
g74vUIPQkKs177UB+Hx1ADxwmur9fzbJpWWcK5zd/bLKQ8klUfiVrXp4awqLHma5
z6mKH89pxG9IC8rHFODetgfyvCJCiI0VY8bYuR8zJ6ciyk4NLGVhLk/VlzPyap8Y
IT8O+kYLCaOWPbJvR+Zqti+hnvsk+5JnGxa16tVUkxXiJfh7VfWt9dDQ12Z9At1t
srjr79R9yEJ0aPYKZRT4Z3q+CPhJZ+TpZyCxX3QT0vJuzewrj+R0CwSPP2xaWUZ3
x+Z6nsvc0bx37IgR7vsx
=DlMK
-----END PGP SIGNATURE-----