Re: Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)

From: Luigi Rizzo (rizzo_at_icir.org)
Date: 06/22/05

  • Next message: Jeremie Le Hen: "Re: Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)" 
    Date: Wed, 22 Jun 2005 11:45:13 -0700
To: Jeremie Le Hen <jeremie@le-hen.org>

    On Wed, Jun 22, 2005 at 08:34:00PM +0200, Jeremie Le Hen wrote:
    > Hi Luigi,
    >
    > > yes but it is a different action and you may want both types
    > > of rules in the same ruleset, so a sysctl is out of discussion.
    > > I really believe the "setnexthop" action is the best approach.
    >
    > IMHO, making the "fwd" action non-terminal (as the "count" action)

    i don;t understand what is the problem in defining a second action
    'setnexthop' which behaves as a nonblocking 'forward'. Implementationwise
    you can share most of the code, it is just a matter of putting and
    perhaps a flag in the structure that stores the nexthop depending
    on the action specified on the command line. Same for printing.

    It does not break POLA and it lets you have both behaviours at
    almost no cost.

    maybe net.inet.ip.fw.one_pass should not exist, but now it is
    there and once again, we have to keep it for POLA.

            cheers
            luigi

    > is the best way to achieve this. When net.inet.ip.fw.one_pass is set
    > to 1, then it will behave like actually. When set to 0, the user
    > will have to explicitely use an "accept" or a "skipto" rule to stop
    > going through the rules, in the same way you would do it for a
    > "pipe" action.
    >
    > However, the main problem with this approach is that it breaks POLA.
    >
    > Regards,
    > --
    > Jeremie Le Hen
    > < jeremie at le-hen dot org >< ttz at chchile dot org >
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Jeremie Le Hen: "Re: Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)"