Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 27 Jun 2002 16:09:27 -0700
From:      Luigi Rizzo <>
Subject:   HEADS UP -- new ipfw in -current
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
If people feel like testing this and reporting any problems...


----- Forwarded message from Luigi Rizzo <> -----

Date: Thu, 27 Jun 2002 16:02:18 -0700 (PDT)
From: Luigi Rizzo <>
Subject: cvs commit: src/sbin/ipfw Makefile ipfw2.c src/sys/netinet
         ip_dummynet.c ip_fw.h ip_fw2.c src/sys/conf files src/lib/libalias

luigi       2002/06/27 16:02:18 PDT

  Modified files:
    sbin/ipfw            Makefile 
    sys/netinet          ip_dummynet.c ip_fw.h 
    sys/conf             files 
    lib/libalias         alias_db.c 
  Added files:
    sbin/ipfw            ipfw2.c 
    sys/netinet          ip_fw2.c 
  The new ipfw code.
  This code makes use of variable-size kernel representation of rules
  (exactly the same concept of BPF instructions, as used in the BSDI's
  firewall), which makes firewall operation a lot faster, and the
  code more readable and easier to extend and debug.
  The interface with the rest of the system is unchanged, as witnessed
  by this commit. The only extra kernel files that I am touching
  are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
  userland I only had to touch those programs which manipulate the
  internal representation of firewall rules).
  The code is almost entirely new (and I believe I have written the
  vast majority of those sections which were taken from the former
  ip_fw.c), so rather than modifying the old ip_fw.c I decided to
  create a new file, sys/netinet/ip_fw2.c .  Same for the user
  interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
  /sbin/ipfw).  The old files are still there, and will be removed
  in due time.
  I have not renamed the header file because it would have required
  touching a one-line change to a number of kernel files.
  In terms of user interface, the new "ipfw" is supposed to accepts
  the old syntax for ipfw rules (and produce the same output with
  "ipfw show". Only a couple of the old options (out of some 30 of
  them) has not been implemented, but they will be soon.
  On the other hand, the new code has some very powerful extensions.
  First, you can put "or" connectives between match fields (and soon
  also between options), and write things like
  ipfw add allow ip from { or } 10-23,25,1024-3000 to any
  This should make rulesets slightly more compact (and lines longer!),
  by condensing 2 or more of the old rules into single ones.
  Also, as an example of how easy the rules can be extended, I have
  implemented an 'address set' match pattern, where you can specify
  an IP address in a format like this:
  which will match the set of hosts listed in braces belonging to the
  subnet . The match is done using a bitmap, so it is
  essentially a constant time operation requiring a handful of CPU
  instructions (and a very small amount of memmory -- for a full /24
  subnet, the instruction only consumes 40 bytes).
  Again, in this commit I have focused on functionality and tried
  to minimize changes to the other parts of the system. Some performance
  improvement can be achieved with minor changes to the interface of
  ip_fw_chk_t. This will be done later when this code is settled.
  The code is meant to compile unmodified on RELENG_4 (once the
  PACKET_TAG_* changes have been merged), for this reason
  you will see #ifdef __FreeBSD_version in a couple of places.
  This should minimize errors when (hopefully soon) it will be time
  to do the MFC.
  Revision  Changes    Path
  1.48      +118 -0    src/lib/libalias/alias_db.c
  1.11      +2 -1      src/sbin/ipfw/Makefile
  1.1       +3178 -0   src/sbin/ipfw/ipfw2.c (new)
  1.655     +1 -1      src/sys/conf/files
  1.48      +26 -30    src/sys/netinet/ip_dummynet.c
  1.69      +292 -249  src/sys/netinet/ip_fw.h
  1.1       +2519 -0   src/sys/netinet/ip_fw2.c (new)

----- End forwarded message -----

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>