diff options
author | glebius <glebius@FreeBSD.org> | 2005-12-13 12:16:03 +0000 |
---|---|---|
committer | glebius <glebius@FreeBSD.org> | 2005-12-13 12:16:03 +0000 |
commit | d5ab5191cf5df5bcf63257124ddb49c77c2d7137 (patch) | |
tree | 6cd65aeebdffa5fddf4f8da962ba7f377ec1a186 /sys/netinet/ip_fw.h | |
parent | 97acc24830d83fc3b09a8cf246b54ccb44f0940e (diff) | |
download | FreeBSD-src-d5ab5191cf5df5bcf63257124ddb49c77c2d7137.zip FreeBSD-src-d5ab5191cf5df5bcf63257124ddb49c77c2d7137.tar.gz |
Add a new feature for optimizining ipfw rulesets - substitution of the
action argument with the value obtained from table lookup. The feature
is now applicable only to "pipe", "queue", "divert", "tee", "netgraph"
and "ngtee" rules.
An example usage:
ipfw pipe 1000 config bw 1000Kbyte/s
ipfw pipe 4000 config bw 4000Kbyte/s
ipfw table 1 add x.x.x.x 1000
ipfw table 1 add x.x.x.y 4000
ipfw pipe tablearg ip from table(1) to any
In the example above the rule will throw different packets to different pipes.
TODO:
- Support "skipto" action, but without searching all rules.
- Improve parser, so that it warns about bad rules. These are:
- "tablearg" argument to action, but no "table" in the rule. All
traffic will be blocked.
- "tablearg" argument to action, but "table" searches for entry with
a specific value. All traffic will be blocked.
- "tablearg" argument to action, and two "table" looks - for src and
for dst. The last lookup will match.
Diffstat (limited to 'sys/netinet/ip_fw.h')
-rw-r--r-- | sys/netinet/ip_fw.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h index dc5b563..e6ab185 100644 --- a/sys/netinet/ip_fw.h +++ b/sys/netinet/ip_fw.h @@ -461,6 +461,8 @@ typedef struct _ipfw_table { ipfw_table_entry ent[0]; /* entries */ } ipfw_table; +#define IP_FW_TABLEARG 65535 + /* * Main firewall chains definitions and global var's definitions. */ |