Date: Mon, 29 Nov 2010 11:58:18 GMT From: Aleksey <otim@mail.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/152667: [ipfw][patch]: Change of result of a rule containing "not" after "skipto" Message-ID: <201011291158.oATBwI3M091637@red.freebsd.org> Resent-Message-ID: <201011291200.oATC0cgE009394@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 152667 >Category: kern >Synopsis: [ipfw][patch]: Change of result of a rule containing "not" after "skipto" >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Nov 29 12:00:37 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Aleksey >Release: 8.1-RELEASE >Organization: MKC >Environment: FreeBSD nas2.test 8.1-RELEASE-p1 FreeBSD 8.1-RELEASE-p1 #1: Sat Nov 27 10:06:28 OMST 2010 root@nas2.test:/usr/obj/usr/src/sys/GW i386 >Description: In a rule of the following after "skipto" change the logic of the modifier "not" >How-To-Repeat: The elementary firewall allow only outgoing connections: ipfw add 310 check-state ipfw add 400 skipto 500 ip from not me to any ipfw add 410 allow ip from any to any keep-state ipfw add 500 deny all from any to any Allow all incoming connections if add: ipfw add 300 skipto 400 ip from not me to any >Fix: Patch attached with submission follows: --- /usr/src/sys/netinet/ipfw/ip_fw2.c.orig 2010-06-14 09:09:06.000000000 +0700 +++ /usr/src/sys/netinet/ipfw/ip_fw2.c 2010-11-29 15:53:28.000000000 +0600 @@ -2016,7 +2016,7 @@ f = chain->map[f_pos]; l = f->cmd_len; cmd = f->cmd; - match = 1; + if (!cmd->len & F_NOT) match = 1; cmdlen = 0; skip_or = 0; break; >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201011291158.oATBwI3M091637>