[RFC][patch] Two new actions: state-allow and state-deny

Lev Serebryakov lev at FreeBSD.org
Wed Feb 4 13:13:02 UTC 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 04.02.2015 16:03, Lev Serebryakov wrote:

> To be honest, I want add not only "keep-state-only" (pure (1)),
> but, also have "keep-state-do-action-no-check" to have (1) + (3)
> without (2).
 Ideally, here should not be implicit "check-state" at all, and should
be two options to rule:

 (1) keep-state
 (2) skip-immediate-action

 So, current "keep-state" becomes two-rules:

 check-state all from any to any
 <rule> keep-state

 And all other variants are possible too, like

 <rule> keep-state skip-action

 and meaningless, but still possible,

 <rule> skip-immediate-action

 It is hard to add now in backward-compatible way, though.

 But may be... May be... I should think! It looks like doable on
second glance, and better (more flexible & orthogonal) that my current
proposal!

- -- 
// Lev Serebryakov
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQJ8BAEBCgBmBQJU0hrdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRGOTZEMUNBMEI1RjQzMThCNjc0QjMzMEFF
QUIwM0M1OEJGREM0NzhGAAoJEOqwPFi/3EePGFcP/0CpmLVadnVjQqC+PLQVpT4E
cqLy5RfE4D587JeaXfoDher7J/WJj02NKJWkuhZqkvuZAVvFx5xiyl63X9yR1ASR
a8rHGkM9pa4wbQ9XA2YKlhsaVntQtmmk1/qyp9AZecX/aZl6taWualeRCPGgNSvC
lP6JdUCTelUIjlGwvsKI4Xu9ljuV59PaYh3SxLXxQSuyr5CA1ayRjT5e6Mp7SLPk
gfy38Cq7PmrwrQAtkYfcP8K9fYTpnHaKqXYKpELSIqbpKGUcB0AnloXg9u2fJbmD
Ux8lf0MvpDOiw0UfcHaypluLzU0/vuWE9EwyXe4p6GbdWjd9YXwgkbMsCWcR5lbT
KJrAo0Jk2//blLFtKNDSLHb3JpKjSQkVRE/dhNOr066m682xnloPxFPE1p1e79P8
9D4Yi/ii2CGR15tP9keNjnDEOvO5JSSD+kHH/elUyuHye++UjKKNJoDCp5JIopFr
SJ7NHYyVhlMmIMWIQeXUIRoNxblv9C5C9G2k7nBMlaxWN8VG0AKIerRyHTrEtwzt
0M9Tb6Et7dXULvqR0U+PgXvOLDo+DmmYf5cZiUCsVnLba0UwcWt7i2qWsA9KmQEE
ZqTaVz8cJSkHybQLqlGtIwMfWgh7s6XSAjaPgk0OviDNCwTs9Ry/6QRPpCnkcC5p
wsN8ML5mL59HqlkIvTxU
=gWCG
-----END PGP SIGNATURE-----


More information about the freebsd-ipfw mailing list