[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ipfilter
Subject:    Re: Complex ruleset questions
From:       Damian Gerow <damian () sentex ! net>
Date:       2003-06-27 17:49:17
[Download RAW message or body]

Thus spake Thomas Quinot (thomas@cuivre.fr.eu.org) [27/06/03 13:40]:
> > specifying the allow rules twice, but means that any rule insertions between
> > the 'skip' rules and the 'head' rule will break the skips.  :(
> 
> But there is no reason to insert anything between the skips, they
> notionally are part of the same single high-level operation consisting
> in branching into a group when any one in a set of predicates matches.
> Think of it the way a compiler would generate code for a complex boolean
> expression using a combination of elementary tests and jumps.

I know that and you know that, but in three years, someone who doesn't know
IPF very well won't necessarily know that.

As well, the ruleset is considerably more complex than the examples I've
given.  We do have specific allows/denies on rl0/rl1 that shouldn't be
carried over into the other, and these will change over time.

It looks like using skip rules will be what I wind up doing, I just need to
get everything set up just so, and make sure I put big warnings in big
capitals in the rules file.
[prev in list] [next in list] [prev in thread] [next in thread]