From owner-freebsd-current@FreeBSD.ORG Mon May 23 10:29:24 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B15CC16A41C for ; Mon, 23 May 2005 10:29:24 +0000 (GMT) (envelope-from bu7cher@yandex.ru) Received: from mail.rdu.kirov.ru (ns.rdu.kirov.ru [217.9.151.217]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0FC4643D48 for ; Mon, 23 May 2005 10:29:23 +0000 (GMT) (envelope-from bu7cher@yandex.ru) Received: from kirov.so-cdu.ru (kirov [172.21.81.1]) by mail.rdu.kirov.ru (Postfix) with ESMTP id 805A7FE3F for ; Mon, 23 May 2005 14:29:21 +0400 (MSD) Received: from kirov.so-cdu.ru (localhost [127.0.0.1]) by rdu.kirov.ru (Postfix) with SMTP id 5E0921560D for ; Mon, 23 May 2005 14:29:21 +0400 (MSD) Received: from [172.21.81.52] (elsukov.kirov.so-cdu.ru [172.21.81.52]) by rdu.kirov.ru (Postfix) with ESMTP id 3858B155D8 for ; Mon, 23 May 2005 14:29:21 +0400 (MSD) Message-ID: <4291B081.4000308@yandex.ru> Date: Mon, 23 May 2005 14:29:21 +0400 From: "Andrey V. Elsukov" User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-current@freebsd.org Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 7bit Subject: IPFW2 patch X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: bu7cher@yandex.ru List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 May 2005 10:29:24 -0000 Hello, Developers! Sorry, my english is bad. :( Patch to IPFW2 for adding restrictions of the traffic with use IPFW bytes counters. It include two parts: * First part is ipfw_bound.patch, this part add ipfw rule options "bound VALUE" and "check-bound NUM". Example: # ipfw add 100 allow ip from any to any bound 10K # ipfw add 200 deny ip from any to any While bytes counter of rule 100 below 10 KBytes, it work. Example: # ipfw add 100 allow ip from A.B.C.D to any out xmit internet check-bound 200 # ipfw add 200 allow ip from any to A.B.C.D in recv internet bound 100M # ipfw add 300 deny ip from any to any via internet While bytes counter of rule 200 below 100 MBytes, rules 100 and 200 work. NOTE: Check-bound option search rule NUM like "ipfw skipto", but if rule NUM not contain bound option, then match fail. Second part is bound_change.patch, this part add control call to ipfw for boundary value change without bytes counter reset. Syntax: # ipfw bound NUM [set N] change VALUE. Files: For CURRENT: http://butcher.heavennet.ru/ipfw_bound/CURRENT/ipfw_bound.patch http://butcher.heavennet.ru/ipfw_bound/CURRENT/bound_change.patch For RELENG_5: http://butcher.heavennet.ru/ipfw_bound/RELENG_5/ipfw_bound.patch http://butcher.heavennet.ru/ipfw_bound/RELENG_5/bound_change.patch For RELENG_5_4: http://butcher.heavennet.ru/ipfw_bound/RELENG_5_4/ipfw_bound.patch http://butcher.heavennet.ru/ipfw_bound/RELENG_5_4/bound_change.patch -- WBR, Andrey V. Elsukov