From owner-freebsd-ipfw@FreeBSD.ORG  Sat Nov 26 20:20:21 2005
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
X-Original-To: freebsd-ipfw@hub.freebsd.org
Delivered-To: freebsd-ipfw@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9FDCE16A41F
	for <freebsd-ipfw@hub.freebsd.org>;
	Sat, 26 Nov 2005 20:20:21 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id CE0E243DAD
	for <freebsd-ipfw@hub.freebsd.org>;
	Sat, 26 Nov 2005 20:20:10 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id jAQKK6Iw054742
	for <freebsd-ipfw@freefall.freebsd.org>; Sat, 26 Nov 2005 20:20:06 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id jAQKK6rF054741;
	Sat, 26 Nov 2005 20:20:06 GMT (envelope-from gnats)
Date: Sat, 26 Nov 2005 20:20:06 GMT
Message-Id: <200511262020.jAQKK6rF054741@freefall.freebsd.org>
To: freebsd-ipfw@FreeBSD.org
From: Hajimu UMEMOTO <ume@freebsd.org>
Cc: 
Subject: Re: kern/89472: ipfw2 no longer supports filtering IPv6-over-IPv4
	on 6.0-RELEASE
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Hajimu UMEMOTO <ume@freebsd.org>
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Nov 2005 20:20:21 -0000

The following reply was made to PR kern/89472; it has been noted by GNATS.

From: Hajimu UMEMOTO <ume@freebsd.org>
To: Gael Roualland <gael.roualland@dial.oleane.com>
Cc: FreeBSD-gnats-submit@freebsd.org, freebsd-ipfw@freebsd.org
Subject: Re: kern/89472: ipfw2 no longer supports filtering IPv6-over-IPv4 on 6.0-RELEASE
Date: Sun, 27 Nov 2005 05:19:01 +0900

 Hi,
 
 >>>>> On Wed, 23 Nov 2005 22:43:07 +0100 (CET)
 >>>>> Gael Roualland <gael.roualland@dial.oleane.com> said:
 
 gael>  Hum, I didn't notice the "ipv6" string was handled a bit differently
 gael>  than the numeric proto number in ipfw.
 
 gael>  It does work, at least IPv6-over-IPv4 packets are not blocked, but ipfw
 gael>  list/show reports the rule as "allow ip from a.b.c.d to me" and it does
 gael>  filter it that way, opening a lot more than just protocol 41...
 
 Umm, 41 is treated as ipv6, internally.  With following patch,
 
 	allow ip from a.b.c.d to me proto 41
 
 should work for workaround.  However, it is still incomplete, and
 `ipfw show' shows
 
 	allow ip from any to any proto ipv6
 
 Apart from this limitation, it seems working to me here.
 
 Index: sbin/ipfw/ipfw2.c
 diff -u -p sbin/ipfw/ipfw2.c.orig sbin/ipfw/ipfw2.c
 --- sbin/ipfw/ipfw2.c.orig	Sat Aug 20 17:36:57 2005
 +++ sbin/ipfw/ipfw2.c	Sun Nov 27 04:18:43 2005
 @@ -3611,7 +3611,8 @@ add_proto(ipfw_insn *cmd, char *av, u_ch
  		*proto = pe->p_proto;
  	else
  		return NULL;
 -	if (*proto != IPPROTO_IP && *proto != IPPROTO_IPV6)
 +	if (strcmp(av, "ipv4") != 0 && strcmp(av, "ip4") != 0 &&
 +	    strcmp(av, "ipv6") != 0 && strcmp(av, "ip6") != 0)
  		fill_cmd(cmd, O_PROTO, 0, *proto);
  
  	return cmd;
 
 
 Sincerely,
 
 --
 Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
 ume@mahoroba.org  ume@{,jp.}FreeBSD.org
 http://www.imasy.org/~ume/