Hi Brett, Luigi, all, > >original > > > > ipfw add 1000 dosomething cond1 cond2 cond3 cond4 cond5 ... condN > > > >negated: > > > > ipfw add 1000 skipto 1001 cond1 cond2 cond3 cond4 cond5 ... condN > > ipfw add 1000 dosomething > > This doesn't work, because you must transform cond1 && cond2 && cond3... > into multiple rules that implement ~(cond1 || cond2 || cond3...). So, > you'd need do do the following: > > ipfw add 1000 skipto 1001 not cond1 > ipfw add 1000 skipto 1001 not cond2 > ... (N rules total) > ipfw add 1000 skipto 1001 not condN > ipfw add 1000 dosomething > ipfw add 1000 skipto 5000 // Where to resume on success > ipfw add 1001
I tend to agree with Luigi now. I didn't realize this before, but let's apply De Morgan's theorem. Each condition is identified as a small letter "a", "b", "c". "/a" means "not a" and the "." operator is AND, while the "+" operator is OR. The above "original" rule is therefore : a.b.c The above "negated" rule is obviously : /(a.b.c) With your ruleset may be summed up as : /a+/b+/c Which is the same as the "negated" rule in regard to De Morgan's theorem. Do you agree with this ? Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org > _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
