Re: Proposed Improvements to NPF

[mlelstv%serpens.de@localhost (Michael van Elst)]

gdt%lexort.com@localhost (Greg Troxel) writes:

>> Obvious choices are: (1) drop the rule [this is my favorite] loudly,
>> (2) provide syntax for fallback addresses (hard to get right for
>> the admin, but easy to implement), (3) fail the whole config
>> loading (IMHO worst option).

>I think of those, only option 1 is reasonable, with a warning.  I guess
>right now we might not have warnings, just silent success and errors.

Right now we don't have a failing DNS resolver, no warnings, no errors.

Dropping an allow rule might be an option for an initial configuration.

Dropping a forbid rule on the other hand is probably always bad, and that
includes permit rules with a negation ("allow all but ...").

For me the only safe way is 3), either load a working configuration
or keep the existing configuration.

N.B. a much better approach to handle varying IP addresses is to use a
table that gets refreshed externally.