Policy routing idea (Was: ipfw: Would it be possible to continue processing rest of rules after match ?)

[Jeremie Le Hen]

> i don;t understand what is the problem in defining a second action
> 'setnexthop' which behaves as a nonblocking 'forward'.  Implementationwise
> you can share most of the code, it is just a matter of putting and
> perhaps a flag in the structure that stores the nexthop depending
> on the action specified on the command line.  Same for printing.
> 
> It does not break POLA and it lets you have both behaviours at
> almost no cost.
> 
> maybe net.inet.ip.fw.one_pass should not exist, but now it is
> there and once again, we have to keep it for POLA.

You are complely right.  My wish would be to make ipfw minimalist, in
other word no need to have either "setnexthop" or "tee" actions
(respectively using non-blocking "forward" and "divert").  But this is
pointless anyway as it would break POLA.

Just for information, does this principle requires FreeBSD to keep
existing option forever, or are there some scarce situations where
some superfluous options could be deleted ?

Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >