From owner-freebsd-current  Mon May  5 17:40:57 1997
Return-Path: <owner-current>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id RAA01623
          for current-outgoing; Mon, 5 May 1997 17:40:57 -0700 (PDT)
Received: from cheops.anu.edu.au (avalon@cheops.anu.edu.au [150.203.76.24])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id RAA01598;
          Mon, 5 May 1997 17:40:50 -0700 (PDT)
Message-Id: <199705060040.RAA01598@hub.freebsd.org>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA130179139; Tue, 6 May 1997 10:38:59 +1000
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: divert still broken?
To: archie@whistle.com (Archie Cobbs)
Date: Tue, 6 May 1997 10:38:59 +1000 (EST)
Cc: nnd@info.itfs.nsk.su, current@FreeBSD.ORG, hackers@FreeBSD.ORG
In-Reply-To: <199705051812.LAA05845@bubba.whistle.com> from "Archie Cobbs" at May 5, 97 11:12:33 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: owner-current@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

In some mail from Archie Cobbs, sie said:
> 
>  - Allow rules to have the form:
> 
>      1000 deny ip from any to any in via ed0 out via ed1
> 
>    so you can filter routed packets by both incoming AND outgoing
>    interface.

can you do this such that the route is only looked up once ?  Can you
be sure that the routing table won't change between the two lookups
if you can't do it with one (es. on SMP systems) ?  You could possibly
solve this by only enabling this sort of filter on the outbound side
of ed1.

>  - When a reject rule applies to an incoming TCP packet, send
>    the appropriate TCP response packet (ie., RST) instead of an
>    ICMP port unreachable.

I think you want to make this user configurable and perhaps on a per-rule
basis.

This is otherwise a rather major change in the behaviour of ipfw and
users may not agree with it (and they don't necessarily subscribe to
any freebsd mailling list either).