"or" blocks in IPFW2

[Luigi Rizzo]

On Mon, Jul 18, 2005 at 01:06:20PM +0200, Oliver Fromme wrote:
> Luigi Rizzo <rizzo at icir.org> wrote:
>  > On Wed, Jul 13, 2005 at 05:57:53PM +0200, Oliver Fromme wrote:
>  > ...
>  > > # ipfw add allow tcp from any to any \{ in recv fxp0 or out xmit fxp0 \}
>  > > 04400 allow tcp from any to any in { recv fxp0 or out } xmit fxp0
>  > 
>  > surely the parser is not very robust and should complain :)
>  > 
>  > This said, the 'or' is a conjunction of individual options, 
>  > and 'in' is one option and 'recv fxp0' is another one.
> 
> Okay ...  So the braces are actually redundant, right?

no braces are absolutely necessary and the fact that 'or' has
priority is just a bug, accidental and contrary to intuition ('and' has
always priority over 'or', and in ipfw the 'and' is implicit).

> Because the "or" operator has highest priority anyway
> (except possibly for "not"), and braces cannot be used
> to change priority.

yes but once again accidenta.
if someone decides to implement proper expression
evaluation we do need the braces.

cheers
luigi

>  > if you need something different you probably have to write separate rules.
> 
> Thank you very much for the explanation.  So I have to
> write separate rules.  (Not a big deal.)
> 
> Best regards
>    Oliver
> 
> -- 
> Oliver Fromme,  secnetix GmbH & Co KG, Marktplatz 29, 85567 Grafing
> Any opinions expressed in this message may be personal to the author
> and may not necessarily reflect the opinions of secnetix in any way.
> 
> One Unix to rule them all, One Resolver to find them,
> One IP to bring them all and in the zone to bind them.
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"