Efficient use of Dummynet pipes in IPFW

[Brett Glass]

At 10:20 AM 9/19/2005, Luigi Rizzo wrote:

>original
>
>        ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN
>
>negated:
>
>        ipfw add 1000 skipto 1001 cond1 cond2 cond3 cond4 cond5 ... condN
>        ipfw add 1000 dosomething

This doesn't work, because you must transform cond1 && cond2 && cond3...
into multiple rules that implement ~(cond1 || cond2 || cond3...). So,
you'd need do do the following:

ipfw add 1000 skipto 1001 not cond1
ipfw add 1000 skipto 1001 not cond2
... (N rules total)
ipfw add 1000 skipto 1001 not condN
ipfw add 1000 dosomething
ipfw add 1000 skipto 5000 // Where to resume on success
ipfw add 1001 // Jump target; implemented in IPFW as "count ip from any to any"

The other way to do it is via "spaghetti rules:"

ipfw add 1000 skipto 1002 cond1 cond2 cond3 cond4 cond5 ... condN
ipfw add 1001 skipto 1003
ipfw add 1002 dosomething
ipfw add 1002 skipto 5000 // Where to resume on success
ipfw add 1003 // Jump target; implemented inside IPFW as "count ip from any to any"

Or you can do the entire pattern match twice:

ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN
ipfw add 1000 skipto 5000 cond1 cond2 cond3 cond4 cond5 ... condN

--Brett