Re: Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)

From: Jeremie Le Hen (jeremie_at_le-hen.org)
Date: 06/23/05

  • Next message: Kövesdán Gábor: "Re: www user than root" 
    Date: Thu, 23 Jun 2005 00:15:57 +0200
To: Luigi Rizzo <rizzo@icir.org>

    > i don;t understand what is the problem in defining a second action
    > 'setnexthop' which behaves as a nonblocking 'forward'. Implementationwise
    > you can share most of the code, it is just a matter of putting and
    > perhaps a flag in the structure that stores the nexthop depending
    > on the action specified on the command line. Same for printing.
    >
    > It does not break POLA and it lets you have both behaviours at
    > almost no cost.
    >
    > maybe net.inet.ip.fw.one_pass should not exist, but now it is
    > there and once again, we have to keep it for POLA.

    You are complely right. My wish would be to make ipfw minimalist, in
    other word no need to have either "setnexthop" or "tee" actions
    (respectively using non-blocking "forward" and "divert"). But this is
    pointless anyway as it would break POLA.

    Just for information, does this principle requires FreeBSD to keep
    existing option forever, or are there some scarce situations where
    some superfluous options could be deleted ?

    Regards, 

    -- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Kövesdán Gábor: "Re: www user than root"