Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)

[Luigi Rizzo]

On Wed, Jun 22, 2005 at 08:34:00PM +0200, Jeremie Le Hen wrote:
> Hi Luigi,
> 
> > yes but it is a different action and you may want both types
> > of rules in the same ruleset, so a sysctl is out of discussion.
> > I really believe the "setnexthop" action is the best approach.
> 
> IMHO, making the "fwd" action non-terminal (as the "count" action)

i don;t understand what is the problem in defining a second action
'setnexthop' which behaves as a nonblocking 'forward'.  Implementationwise
you can share most of the code, it is just a matter of putting and
perhaps a flag in the structure that stores the nexthop depending
on the action specified on the command line.  Same for printing.

It does not break POLA and it lets you have both behaviours at
almost no cost.

maybe net.inet.ip.fw.one_pass should not exist, but now it is
there and once again, we have to keep it for POLA.

	cheers
	luigi

> is the best way to achieve this.  When net.inet.ip.fw.one_pass is set
> to 1, then it will behave like actually.  When set to 0, the user
> will have to explicitely use an "accept" or a "skipto" rule to stop
> going through the rules, in the same way you would do it for a
> "pipe" action.
> 
> However, the main problem with this approach is that it breaks POLA.
> 
> Regards,
> -- 
> Jeremie Le Hen
> < jeremie at le-hen dot org >< ttz at chchile dot org >