This is a discussion on Re: Complex ruleset questions within the IPFilter forums, part of the System Security and Security Related category; Thus spake Thomas Quinot (thomas@cuivre.fr.eu.org) [27/06/03 13:40]: > > specifying the allow rules ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
Thus spake Thomas Quinot (thomas@cuivre.fr.eu.org) [27/06/03 13:40]:
> > specifying the allow rules twice, but means that any rule insertions between > > the 'skip' rules and the 'head' rule will break the skips. :( > > But there is no reason to insert anything between the skips, they > notionally are part of the same single high-level operation consisting > in branching into a group when any one in a set of predicates matches. > Think of it the way a compiler would generate code for a complex boolean > expression using a combination of elementary tests and jumps. I know that and you know that, but in three years, someone who doesn't know IPF very well won't necessarily know that. As well, the ruleset is considerably more complex than the examples I've given. We do have specific allows/denies on rl0/rl1 that shouldn't be carried over into the other, and these will change over time. It looks like using skip rules will be what I wind up doing, I just need to get everything set up just so, and make sure I put big warnings in big capitals in the rules file. |
![]() |
| Thread Tools | |
| Display Modes | |
|
|