From owner-freebsd-ipfw@FreeBSD.ORG Sun Jul 19 03:00:36 2009 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2F6D4106566C for ; Sun, 19 Jul 2009 03:00:36 +0000 (UTC) (envelope-from webusers@n22.sivit.org) Received: from n22.sivit.org (n22.sivit.org [194.146.224.154]) by mx1.freebsd.org (Postfix) with ESMTP id AADAA8FC15 for ; Sun, 19 Jul 2009 03:00:35 +0000 (UTC) (envelope-from webusers@n22.sivit.org) Received: from n22.sivit.org (no-mail-server-here.eupencable.com [127.0.0.1]) by n22.sivit.org (8.12.8/8.12.8) with ESMTP id n6ILKq4F023756 for ; Sat, 18 Jul 2009 23:20:53 +0200 Received: (from webusers@localhost) by n22.sivit.org (8.12.8/8.12.8/Submit) id n6ILKqqB023752; Sat, 18 Jul 2009 23:20:52 +0200 Date: Sat, 18 Jul 2009 23:20:52 +0200 Message-Id: <200907182120.n6ILKqqB023752@n22.sivit.org> To: freebsd-ipfw@freebsd.org ScriptPath: www.eam2.fr/Annonces/Annonces.php From: Bryan James MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Subject: Order To New Zealand X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: bjsptyltd@gmail.com List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Jul 2009 03:00:36 -0000 <<< No Message Collected >>> From owner-freebsd-ipfw@FreeBSD.ORG Mon Jul 20 11:06:58 2009 Return-Path: Delivered-To: freebsd-ipfw@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0F7A81065670 for ; Mon, 20 Jul 2009 11:06:58 +0000 (UTC) (envelope-from owner-bugmaster@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id E7A538FC14 for ; Mon, 20 Jul 2009 11:06:57 +0000 (UTC) (envelope-from owner-bugmaster@FreeBSD.org) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n6KB6vEA002324 for ; Mon, 20 Jul 2009 11:06:57 GMT (envelope-from owner-bugmaster@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n6KB6vWY002320 for freebsd-ipfw@FreeBSD.org; Mon, 20 Jul 2009 11:06:57 GMT (envelope-from owner-bugmaster@FreeBSD.org) Date: Mon, 20 Jul 2009 11:06:57 GMT Message-Id: <200907201106.n6KB6vWY002320@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: gnats set sender to owner-bugmaster@FreeBSD.org using -f From: FreeBSD bugmaster To: freebsd-ipfw@FreeBSD.org Cc: Subject: Current problem reports assigned to freebsd-ipfw@FreeBSD.org X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 11:06:58 -0000 Note: to view an individual PR, use: http://www.freebsd.org/cgi/query-pr.cgi?pr=(number). The following is a listing of current problems submitted by FreeBSD users. These represent problem reports covering all versions including experimental development code and obsolete releases. S Tracker Resp. Description -------------------------------------------------------------------------------- o kern/136695 ipfw [ipfw] [patch] fwd reached after skipto in dynamic rul o kern/135476 ipfw [ipfw] IPFW table breaks after adding a large number o o bin/134975 ipfw [patch] ipfw(8) can't work with set in rule file. o kern/132553 ipfw [ipfw] ipfw doesn't understand ftp-data port o kern/131817 ipfw [ipfw] blocks layer2 packets that should not be blocke o kern/131601 ipfw [ipfw] [panic] 7-STABLE panic in nat_finalise (tcp=0) o kern/131558 ipfw [ipfw] Inconsistent "via" ipfw behavior o bin/130132 ipfw [patch] ipfw(8): no way to get mask from ipfw pipe sho o kern/129103 ipfw [ipfw] IPFW check state does not work =( o kern/129093 ipfw [ipfw] ipfw nat must not drop packets o kern/129036 ipfw [ipfw] 'ipfw fwd' does not change outgoing interface n o kern/128260 ipfw [ipfw] [patch] ipfw_divert damages IPv6 packets o kern/127230 ipfw [ipfw] [patch] Feature request to add UID and/or GID l o kern/127209 ipfw [ipfw] IPFW table become corrupted after many changes o bin/125370 ipfw [ipfw] [patch] increase a line buffer limit o conf/123119 ipfw [patch] rc script for ipfw does not handle IPv6 o kern/122963 ipfw [ipfw] tcpdump does not show packets redirected by 'ip s kern/121807 ipfw [request] TCP and UDP port_table in ipfw o kern/121382 ipfw [dummynet]: 6.3-RELEASE-p1 page fault in dummynet (cor o kern/121122 ipfw [ipfw] [patch] add support to ToS IP PRECEDENCE fields o kern/118993 ipfw [ipfw] page fault - probably it's a locking problem o kern/117234 ipfw [ipfw] [patch] ipfw send_pkt() and ipfw_tick() don't s o bin/117214 ipfw ipfw(8) fwd with IPv6 treats input as IPv4 o kern/116009 ipfw [ipfw] [patch] Ignore errors when loading ruleset from p kern/115755 ipfw [ipfw] [patch] unify message and add a rule number whe o bin/115172 ipfw [patch] ipfw(8) list show some rules with a wrong form o docs/113803 ipfw [patch] ipfw(8) - don't get bitten by the fwd rule p kern/113388 ipfw [ipfw] [patch] Addition actions with rules within spec o kern/112708 ipfw [ipfw] ipfw is seems to be broken to limit number of c o kern/112561 ipfw [ipfw] ipfw fwd does not work with some TCP packets o kern/107305 ipfw [ipfw] ipfw fwd doesn't seem to work o kern/105330 ipfw [ipfw] [patch] ipfw (dummynet) does not allow to set q o bin/104921 ipfw [patch] ipfw(8) sometimes treats ipv6 input as ipv4 (a o kern/104682 ipfw [ipfw] [patch] Some minor language consistency fixes a o kern/103454 ipfw [ipfw] [patch] [request] add a facility to modify DF b o kern/103328 ipfw [ipfw] [request] sugestions about ipfw table o kern/102471 ipfw [ipfw] [patch] add tos and dscp support o kern/98831 ipfw [ipfw] ipfw has UDP hickups o kern/97951 ipfw [ipfw] [patch] ipfw does not tie interface details to o kern/97504 ipfw [ipfw] IPFW Rules bug o kern/95084 ipfw [ipfw] [regression] [patch] IPFW2 ignores "recv/xmit/v o kern/93300 ipfw [ipfw] ipfw pipe lost packets o kern/91847 ipfw [ipfw] ipfw with vlanX as the device o kern/88659 ipfw [modules] ipfw and ip6fw do not work properly as modul o kern/87032 ipfw [ipfw] [patch] ipfw ioctl interface implementation o kern/86957 ipfw [ipfw] [patch] ipfw mac logging o kern/82724 ipfw [ipfw] [patch] [request] Add setnexthop and defaultrou s kern/80642 ipfw [ipfw] [patch] ipfw small patch - new RULE OPTION o bin/78785 ipfw [patch] ipfw(8) verbosity locks machine if /etc/rc.fir o kern/74104 ipfw [ipfw] ipfw2/1 conflict not detected or reported, manp o kern/73910 ipfw [ipfw] serious bug on forwarding of packets after NAT o kern/72987 ipfw [ipfw] ipfw/dummynet pipe/queue 'queue [BYTES]KBytes ( o kern/71366 ipfw [ipfw] "ipfw fwd" sometimes rewrites destination mac a o kern/69963 ipfw [ipfw] install_state warning about already existing en o kern/60719 ipfw [ipfw] Headerless fragments generate cryptic error mes o kern/55984 ipfw [ipfw] [patch] time based firewalling support for ipfw o kern/51274 ipfw [ipfw] [patch] ipfw2 create dynamic rules with parent o kern/48172 ipfw [ipfw] [patch] ipfw does not log size and flags o kern/46159 ipfw [ipfw] [patch] [request] ipfw dynamic rules lifetime f a kern/26534 ipfw [ipfw] Add an option to ipfw to log gid/uid of who cau 60 problems total. From owner-freebsd-ipfw@FreeBSD.ORG Wed Jul 22 10:00:31 2009 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B6CAC106566C; Wed, 22 Jul 2009 10:00:31 +0000 (UTC) (envelope-from raffaele.delorenzo@libero.it) Received: from cp-out3.libero.it (cp-out3.libero.it [212.52.84.103]) by mx1.freebsd.org (Postfix) with ESMTP id 4E5A08FC1A; Wed, 22 Jul 2009 10:00:30 +0000 (UTC) (envelope-from raffaele.delorenzo@libero.it) Received: from wmail6.libero.it (172.31.0.149) by cp-out3.libero.it (8.5.107) id 4A5F45D500449916; Wed, 22 Jul 2009 11:48:39 +0200 Message-ID: <3164304.442981248256119643.JavaMail.defaultUser@defaultHost> Date: Wed, 22 Jul 2009 11:48:39 +0200 (CEST) From: "raffaele.delorenzo@libero.it" To: , , freebsd-ipfw@freebsd.org MIME-Version: 1.0 Content-Type: text/plain;charset="UTF-8" Content-Transfer-Encoding: 7bit X-SenderIP: 213.182.95.50 Cc: rizzo@icir.org Subject: R: IPv6 and ipfw X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: "raffaele.delorenzo@libero.it" List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 10:00:32 -0000 Hi all, You has found a parser bug. When the protocol is "ipv6" and you are a comma separated ipv6 addresses, the parser work fine because the "add_srcip6" function is called and recognize all addresses. When the protocol is "!=ipv6" (like TCP,UDP,ICMP6) the "add_src" fuction is called and it cause troubles because the "inet_pton()" fails and erroneously is called the "add_srcip" function (see the code below). (from "ipfw2.c") add_src(ipfw_insn *cmd, char *av, u_char proto) { struct in6_addr a; char *host, *ch; ipfw_insn *ret = NULL; if ((host = strdup(av)) == NULL) return NULL; if ((ch = strrchr (host, '/')) != NULL) *ch = '\0'; if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || inet_pton(AF_INET6, host, &a)) ret = add_srcip6(cmd, av); /* XXX: should check for IPv4, not !IPv6 */ if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || !inet_pton(AF_INET6, host, &a))) ret = add_srcip(cmd, av); if (ret == NULL && strcmp(av, "any") != 0) ret = cmd; free(host); return ret; } I think that possibles solutions are the follows: 1) Create a new protocols types UPD6,TCP6 only for IPv6 rules to avoid parser confusions, and check about this protocol inside the "add_src" fuction (easy to implement). 2) Check the comma separated ip/ipv6 addresses inside the "add_src" function (a little too hard to implement). I appreciate suggestions from the community experts about this problem. Ciao Raffaele >----Messaggio originale---- >Da: wjw@digiware.nl >Data: 22/07/2009 10.20 >A: >Ogg: IPv6 and ipfw > >Hi, > >Running 7.2 I tried to insert this into my IPFW rules > ># ipfw add allow udp from any to 2001:xxx:3:: 113,2001:xxxx:3::116 \ > dst-port 10001-10100 keep-state >ipfw: bad netmask ``xxxx:3::113'' > >also: ># ipfw add allow udp from any to trixbox.ip6 dst-port 10001-10100 keep-state >ipfw: hostname ``trixbox.ip6'' unknown >Exit 68 ># host trixbox.ip6 >trixbox.ip6.digiware.nl has IPv6 address 2001:4cb8:3::116 > >So it looks like what is in the manual is overly optimistic: >---- > addr6-list: ip6-addr[,addr6-list] > > ip6-addr: > A host or subnet specified one of the following ways: > > numeric-ip | hostname > Matches a single IPv6 address as allowed by inet_pton(3) > or a hostname. Hostnames are resolved at the time the > rule is added to the firewall list. > > addr/masklen > Matches all IPv6 addresses with base addr (specified as > allowed by inet_pton or a hostname) and mask width of > masklen bits. > > No support for sets of IPv6 addresses is provided because IPv6 > addresses are typically random past the initial prefix. >---- > >Anybody else ran into this? >Or should I file this as a PR. > >--WjW >_______________________________________________ >freebsd-net@freebsd.org mailing list >http://lists.freebsd.org/mailman/listinfo/freebsd-net >To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" > From owner-freebsd-ipfw@FreeBSD.ORG Wed Jul 22 15:11:00 2009 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 22886106566B; Wed, 22 Jul 2009 15:11:00 +0000 (UTC) (envelope-from wjw@digiware.nl) Received: from mail.digiware.nl (mail.ip6.digiware.nl [IPv6:2001:4cb8:1:106::2]) by mx1.freebsd.org (Postfix) with ESMTP id 9D9EA8FC20; Wed, 22 Jul 2009 15:10:59 +0000 (UTC) (envelope-from wjw@digiware.nl) Received: from localhost (localhost.digiware.nl [127.0.0.1]) by mail.digiware.nl (Postfix) with ESMTP id 1C619153435; Wed, 22 Jul 2009 17:10:58 +0200 (CEST) X-Virus-Scanned: amavisd-new at digiware.nl Received: from mail.digiware.nl ([127.0.0.1]) by localhost (rack1.digiware.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tVqvVOexAWIL; Wed, 22 Jul 2009 17:10:55 +0200 (CEST) Received: from [192.168.10.67] (opteron [192.168.10.67]) by mail.digiware.nl (Postfix) with ESMTP id 9E167153436; Wed, 22 Jul 2009 17:10:55 +0200 (CEST) Message-ID: <4A672C79.3000006@digiware.nl> Date: Wed, 22 Jul 2009 17:12:57 +0200 From: Willem Jan Withagen Organization: Digiware User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: "raffaele.delorenzo@libero.it" References: <3164304.442981248256119643.JavaMail.defaultUser@defaultHost> In-Reply-To: <3164304.442981248256119643.JavaMail.defaultUser@defaultHost> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-ipfw@freebsd.org, rizzo@icir.org, net@freebsd.org Subject: Re: R: IPv6 and ipfw X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 15:11:00 -0000 Reply below, and an also reorganised the yours... raffaele.delorenzo@libero.it wrote: >> Hi, >> >> Running 7.2 I tried to insert > this into my IPFW rules >> # ipfw add allow udp from any to 2001:xxx:3:: > 113,2001:xxxx:3::116 \ >> dst-port 10001-10100 keep-state >> ipfw: bad netmask > ``xxxx:3::113'' >> also: >> # ipfw add allow udp from any to trixbox.ip6 dst-port > 10001-10100 keep-state >> ipfw: hostname ``trixbox.ip6'' unknown >> Exit 68 >> # host > trixbox.ip6 >> trixbox.ip6.digiware.nl has IPv6 address 2001:4cb8:3::116 >> >> So it > looks like what is in the manual is overly optimistic: >> ---- >> addr6-list: > ip6-addr[,addr6-list] >> ip6-addr: >> A host or subnet > specified one of the following ways: >> numeric-ip | hostname > >> Matches a single IPv6 address as allowed by inet_pton(3) > >> or a hostname. Hostnames are resolved at the time the > >> rule is added to the firewall list. >> >> > addr/masklen >> Matches all IPv6 addresses with base addr > (specified as >> allowed by inet_pton or a hostname) and > mask width of >> masklen bits. >> >> No support > for sets of IPv6 addresses is provided because IPv6 >> addresses > are typically random past the initial prefix. >> ---- >> >> Anybody else ran into > this? >> Or should I file this as a PR. > Hi all, > You has found a parser bug. > When the protocol is "ipv6" and you are a > comma separated ipv6 addresses, the parser work fine because the "add_srcip6" > function is called and recognize all addresses. > When the protocol is "!=ipv6" > (like TCP,UDP,ICMP6) the "add_src" fuction is called and it cause troubles > because the "inet_pton()" fails and erroneously is called the "add_srcip" > function (see the code below). > > (from "ipfw2.c") > add_src(ipfw_insn *cmd, char > *av, u_char proto) > { > struct in6_addr a; > char *host, *ch; > ipfw_insn *ret = > NULL; > > if ((host = strdup(av)) == NULL) > return NULL; > if ((ch = strrchr > (host, '/')) != NULL) > *ch = '\0'; > > if (proto == IPPROTO_IPV6 || strcmp(av, > "me6") == 0 || > inet_pton(AF_INET6, host, &a)) > ret = add_srcip6(cmd, av); > > /* XXX: should check for IPv4, not !IPv6 */ > if (ret == NULL && (proto == > IPPROTO_IP || strcmp(av, "me") == 0 || > !inet_pton(AF_INET6, host, &a))) > > ret = add_srcip(cmd, av); > if (ret == NULL && strcmp(av, "any") != 0) > ret = > cmd; > > free(host); > return ret; > } > > I think that possibles solutions are the > follows: > > 1) Create a new protocols types UPD6,TCP6 only for IPv6 rules to > avoid parser confusions, and check about this protocol inside the "add_src" > fuction (easy to implement). > 2) Check the comma separated ip/ipv6 addresses > inside the "add_src" function (a little too hard to implement). > > I appreciate > suggestions from the community experts about this problem. I would prefer not to make seperate tcp6 and udp6 items, since what i would like to do is things like: hostlist="a.b.c.d,A:B:C:D::F" and then in the firewall something like ipfw add allow tcp from any to ${hostlist} dst-port 80 setup and if tcp now goes into tcp and tcp6 I need to double my rules etc. Which raises one other point: using a FQDN with more A and AAAA records also just inserts the first reply in the list. Now I don't use FQDN since most of the time in the Firewall DNS is not quite up yet. --WjW From owner-freebsd-ipfw@FreeBSD.ORG Fri Jul 24 12:19:00 2009 Return-Path: Delivered-To: ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 91529106566B for ; Fri, 24 Jul 2009 12:19:00 +0000 (UTC) (envelope-from mail@proxy1073.tm.cbsig.net) Received: from proxy1073-fe.tm.cbsig.net (proxy1073-fe.tm.cbsig.net [64.30.239.238]) by mx1.freebsd.org (Postfix) with ESMTP id 419D48FC0C for ; Fri, 24 Jul 2009 12:18:59 +0000 (UTC) (envelope-from mail@proxy1073.tm.cbsig.net) Received: from proxy1073.tm.cbsig.net (localhost.localdomain [127.0.0.1]) by proxy1073.tm.cbsig.net (8.13.1/8.13.1) with ESMTP id n6OBqukH006913 for ; Fri, 24 Jul 2009 07:52:56 -0400 Received: (from mail@localhost) by proxy1073.tm.cbsig.net (8.13.1/8.13.1/Submit) id n6OBquHI006910 for ipfw@freebsd.org; Fri, 24 Jul 2009 07:52:56 -0400 Date: Fri, 24 Jul 2009 07:52:56 -0400 Message-Id: <200907241152.n6OBquHI006910@proxy1073.tm.cbsig.net> From: "ipfw" To: "© 2002-2009 Pfizer Inc." X-Loop: "ipfw" Cc: Subject: Problem Posting to League 'ipfw' X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2009 12:19:00 -0000 In order to send an e-mail to your league, the e-mail address which you are sending from must be associated with your team. You will need to update your e-mail address within the league, otherwise, your correspondence will be denied. To update your e-mail address, enter your league home page and select Options, Personal. You can enter more than one e-mail address by separating them with a comma and a space.