Date: Fri, 23 Apr 2004 07:27:27 -0700 (PDT) From: Andre Oppermann <andre@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/netinet ip_fw.h ip_fw2.c Message-ID: <200404231427.i3NERR34063763@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
andre 2004/04/23 07:27:27 PDT FreeBSD src repository Modified files: sys/netinet ip_fw.h ip_fw2.c Log: Add the option versrcreach to verify that a valid route to the source address of a packet exists in the routing table. The default route is ignored because it would match everything and render the check pointless. This option is very useful for routers with a complete view of the Internet (BGP) in the routing table to reject packets with spoofed or unrouteable source addresses. Example: ipfw add 1000 deny ip from any to any not versrcreach also known in Cisco-speak as: ip verify unicast source reachable-via any Reviewed by: luigi Revision Changes Path 1.84 +1 -0 src/sys/netinet/ip_fw.h 1.57 +31 -7 src/sys/netinet/ip_fw2.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200404231427.i3NERR34063763>