Efficient use of Dummynet pipes in IPFW

[Jeremie Le Hen]

Hi Brett, Luigi, all,

> >original
> >
> >        ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN
> >
> >negated:
> >
> >        ipfw add 1000 skipto 1001 cond1 cond2 cond3 cond4 cond5 ... condN
> >        ipfw add 1000 dosomething
> 
> This doesn't work, because you must transform cond1 && cond2 && cond3...
> into multiple rules that implement ~(cond1 || cond2 || cond3...). So,
> you'd need do do the following:
> 
> ipfw add 1000 skipto 1001 not cond1
> ipfw add 1000 skipto 1001 not cond2
> ... (N rules total)
> ipfw add 1000 skipto 1001 not condN
> ipfw add 1000 dosomething
> ipfw add 1000 skipto 5000 // Where to resume on success
> ipfw add 1001

I tend to agree with Luigi now.  I didn't realize this before, but
let's apply De Morgan's theorem.  Each condition is identified as
a small letter "a", "b", "c".  "/a" means "not a" and the "." operator
is AND, while the "+" operator is OR.

The above "original" rule is therefore :	a.b.c
The above "negated" rule is obviously :		/(a.b.c)

With your ruleset may be summed up as :		/a+/b+/c

Which is the same as the "negated" rule in regard to De Morgan's theorem.

Do you agree with this ?

Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >