Date: Sun, 4 May 2008 04:50:02 GMT From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/123358: [ipfw] ipfw add 1000 allow IP from any to any doesn't work Message-ID: <200805040450.m444o2pR072250@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/123358; it has been noted by GNATS.
From: "Andrey V. Elsukov" <bu7cher@yandex.ru>
To: Edwin Groothuis <edwin@mavetju.org>
Cc: FreeBSD-gnats-submit@FreeBSD.org,
Julian Elischer <julian@elischer.org>
Subject: Re: kern/123358: [ipfw] ipfw add 1000 allow IP from any to any doesn't
work
Date: Sun, 04 May 2008 08:39:57 +0400
Edwin Groothuis wrote:
> Loading an ipfw rule with "IP" instead of "ip" will enter the rule
> properly in the list, but it never gets matched.
>
>> How-To-Repeat:
>
> [/home/edwin] root@k7>ipfw add 100 allow IP from any to any
> 00100 allow ip from any to any
> [/home/edwin] root@k7>ipfw add 100 allow ip from any to any
> 00100 allow ip from any to any
>
> [/home/edwin] root@k7>ipfw -a list
> 00100 0 0 allow ip from any to any
> 00100 922 168617 allow ip from any to any
> 65535 182 20023 deny ip from any to any
>
> The first entry should be increasing, not the second.
Yes. When you are using "ip" or "all" as protocol, then
ipfw(8) doesn't make internal opcode and ipfw(9) matches
any packets. When you are using "IP" (parser is case sensitive),
then ipfw(8) makes a O_PROTO opcode and ipfw(9) matches it
with layer3 protocol number.
I don't know what is the best way to fix this problem.
I see three ways:
1. Don't do anything.
2. Make manual better (sorry, i'm not native english
speaker, so i can't).
3. Add quirk to ipfw(8) ti add_proto0 function, something
similar:
--- src/sbin/ipfw/ipfw2.c 27 Feb 2008 13:52:33 -0000 1.118
+++ src/sbin/ipfw/ipfw2.c 4 May 2008 04:38:24 -0000
@@ -4580,6 +4580,11 @@ add_proto0(ipfw_insn *cmd, char *av, u_c
if (*ep != '\0' || proto <= 0) {
if ((pe = getprotobyname(av)) == NULL)
return NULL;
+
+ /* Is it an IP proto? */
+ if (pr->p_proto == 0)
+ return (0);
+
proto = pe->p_proto;
}
--
WBR, Andrey V. Elsukov
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200805040450.m444o2pR072250>