Date: Wed, 16 Jul 2003 23:03:40 -0700 (PDT) From: Luigi Rizzo <luigi@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/netinet ip_fw2.c ip_fw2.h src/sbin/ipfw ipfw.8 ipfw2.c Message-ID: <200307170603.h6H63eI6056163@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
luigi 2003/07/16 23:03:40 PDT
FreeBSD src repository
Modified files: (Branch: RELENG_4)
sys/netinet ip_fw2.c ip_fw2.h
sbin/ipfw ipfw.8 ipfw2.c
Log:
MFC: sync ipfw2 with the version in -current, including:
* implement a '-n' option to do a syntax-check only of ipfw2 rules;
* allow spaces after commas in ipfw rules;
* support for comma-separated address lists e.g.
ipfw add allow ip from not 10.0.0.0/8, 192.168.0.0/16, 1.2.3.4 to me
(note the possibility to put a 'not' in front of the entire list,
which was not possible with "or blocks");
* allow comments in ipfw rules which are stored together with rules and
appear upon an 'ipfw show':
ipfw add allow udp from any to any 53 // nameserver
* allow set 31 to be used for ordinary (non-default) rules, but with
the special feature that rules in set 31 cannot be disabled and
are not affected by a 'flush' command (so they must be deleted
explicitly). This permits a flexible form of "persistent" rules
which should survive across firewall reloads.
* allow ranges to be specified in the "ipfw show" and "ipfw list"
commands (the same ought to be done for ""ipfw delete"):
ipfw show 100-1000 2000 3000-5500
I believe the kernel side of these changes is entirely backward
compatible with the old /sbin/ipfw[2], though of course you need
to update the userland command to use the new features.
Revision Changes Path
1.63.2.37 +123 -66 src/sbin/ipfw/ipfw.8
1.4.2.16 +708 -476 src/sbin/ipfw/ipfw2.c
1.6.2.16 +66 -45 src/sys/netinet/ip_fw2.c
1.1.2.4 +18 -6 src/sys/netinet/ip_fw2.h
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200307170603.h6H63eI6056163>