ipf group/head (and quick)
Edgar Fuß <ef <at> math.uni-bonn.de>
2016-06-07 18:17:31 GMT
I'm once again confused about the exact semantics of ipf groups, especially
in conjunction with "quick".
Generally, my impression is that rules in ipf.conf (or elsewhere) are, in
turn, added to per-group lists depending on the "group" part of the rule (0
as a default); then, after parsing, we have as many lists as we have groups
and every packet starts to be matched against the rules on list 0, until it
matches a "head n" rule, after which it starts to be matched against all the
rules on list n, no matter where they appear in ipf.conf. Is that correct?
So, if, in ipf.conf, rule #3 is "head 100", #2 and #5 are "group 100" and
#1, #4 #6 are default, and no rule is "quick", a packet matching the critera
of #3 would be matched against #1, then #3, then #2 and #5, right? Would it
also be matched against #4 or #6 afterwards?
What if a rule belonging to a non-default group has a "quick" attribute?
Will this stop processing of the group or the whole ruleset?
Then, there's a sentence about "quick" on "head" rules I don't understand:
"If quick is used with a head rule, rule processing isn't stopped until it
has returned from processing the group". How could it stop otherwise? What
exactly does "return" mean?
Can someone please enlighten me?