From owner-freebsd-net@FreeBSD.ORG Thu Aug 14 15:58:58 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8BF0EA88; Thu, 14 Aug 2014 15:58:58 +0000 (UTC) Received: from smtp.digiware.nl (unknown [IPv6:2001:4cb8:90:ffff::3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 44CC12884; Thu, 14 Aug 2014 15:58:58 +0000 (UTC) Received: from rack1.digiware.nl (unknown [127.0.0.1]) by smtp.digiware.nl (Postfix) with ESMTP id 1A7D91534C0; Thu, 14 Aug 2014 17:58:56 +0200 (CEST) X-Virus-Scanned: amavisd-new at digiware.nl Received: from smtp.digiware.nl ([127.0.0.1]) by rack1.digiware.nl (rack1.digiware.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jdMbXqM6EbJy; Thu, 14 Aug 2014 17:58:46 +0200 (CEST) Received: from [192.168.101.102] (vpn.ecoracks.nl [31.223.170.173]) (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.digiware.nl (Postfix) with ESMTPSA id C55191534D2; Thu, 14 Aug 2014 17:58:46 +0200 (CEST) Message-ID: <53ECDCB7.8090703@digiware.nl> Date: Thu, 14 Aug 2014 17:58:47 +0200 From: Willem Jan Withagen User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: Lee Dilkie , Luigi Rizzo , "Alexander V. Chernikov" Subject: Re: [CFT] new tables for ipfw References: <53EBC687.9050503@yandex-team.ru> <53EC880B.3020903@yandex-team.ru> <53EC960A.1030603@yandex-team.ru> <53ECA6B2.8010003@digiware.nl> <53ECAFB9.50507@dilkie.com> <53ECD576.8040801@digiware.nl> <53ECDB62.5030708@dilkie.com> In-Reply-To: <53ECDB62.5030708@dilkie.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "freebsd-net@freebsd.org" , Luigi Rizzo , freebsd-ipfw , "Andrey V. Elsukov" X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Aug 2014 15:58:58 -0000 On 14-8-2014 17:53, Lee Dilkie wrote: > > On 8/14/2014 11:27 AM, Willem Jan Withagen wrote: >> On 14-8-2014 14:46, Lee Dilkie wrote: >>> On 8/14/2014 08:08, Willem Jan Withagen wrote: >>>> I've found the notation ipnr:something rather frustrating when using >>>> ipv6 addresses. Sort of like typing a ipv6 address in a browser, the >>>> last :xx is always interpreted as portnumber, UNLESS you wrap it in []'s. >>>> compare >>>> 2001:4cb8:3:1::1 >>>> 2001:4cb8:3:1::1:80 >>>> [2001:4cb8:3:1::1]:80 >>>> The first and the last are the same host but a different port, the >>>> middle one is just a different host. >>>> >>>> Could/should we do the same in ipfw? >>> the first and second forms are valid, but as ipv6 addresses *with no port*, >>> >>> The third is an ipv6 address with a port. >>> >>> If the intent of the second form is an address and port, it will not be >>> parsed that way by standard parsers and violates the ivp6 addressing rfc's. >> I agree, but ipfw does not understand [2001:4cb8:3:1::1] last time I tried. >> So I think you rephrased what I meant to say. >> >> Thanx, >> --WjW >> > > and re-reading your original post, yes you did state it correctly. > > ipfw needs to be fixed to understand the correct format of ipv6 addresses. > > however, this isn't the only offender. netstat's output is also > incorrect (linux example) > > > tcp 0 0 :::22 > :::* LISTEN > > should be > > tcp 0 0 [::]:22 > [::]:* LISTEN > > I don't understand why folks dream up incompatible, and unparsable, ipv6 > address formats. Why bother with rfc's if no-one writes to them. > > (see rfc5952) It think that that was the RFC I found when looking into getting the browser to do the right thing when I want it to go to: [2001:4cb8:3:1::1]:8080 Well the RFC would be an argument to at least spec an IPv6 address in a ipfw rule to be allowed either with or without []'s. And if you run into trouble by not using the []'s, they are "easily" added. --WjW