ipfw: ouch!, skip past end of rules, denying packet

[Luigi Rizzo]

On Sat, May 08, 2004 at 10:08:14PM -0400, Louis A. Mamakos wrote:
> 
> Not to hijack the thread here, but if you're looking at this code, it
> would be nice if the logic that the ipfw "queue" command used was
> similar to "divert"; where processing picks up at the next higher
> rule number rather than the next rule (which might be numbered the
> same.) 

actually i don't think the 'divert' behaviour was intentional, but
just a side effect of the fact that the only visible rule identifier
in userland is the rule number, and so you couldn't do otherwise.
For dummynet pipes the situation is different as you remain
in the kernel as packets remain in the kernel so you can keep
track correctly of the matching rule and locate the next one.

I understand that what you propose can be used to
implement a 'switch' block, but i wonder if changing
the behaviour now wouldn't break POLA...

	cheers
	luigi

> I'd like to have a bunch of queue commands in a row (perhaps with less
> specific matching criteria in successive rules) and know that if they're
> all numbered the same, only the first one will match.
> 
> louie