From owner-freebsd-ipfw@FreeBSD.ORG Sun Sep 14 15:39:47 2014 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3EB985FB; Sun, 14 Sep 2014 15:39:47 +0000 (UTC) Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 07466300; Sun, 14 Sep 2014 15:39:47 +0000 (UTC) Received: by mail-pa0-f41.google.com with SMTP id bj1so4761236pad.0 for ; Sun, 14 Sep 2014 08:39:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type; bh=SwET4Y6I7HB4cEjZNIdsj31CmHdEudwUZalcd4F46T0=; b=RvO7dP4+lqB1uf6Sa6Mhzr1b99QnrG8PFZAgJO+6DRAzXr/5ICNIeUvCHUCMd8Scrc Nd3J1v+2W6CAtpu6aDdMS5a+iZfNobYXsvraZjrleg0RTBlWGUQZ8LsLG5GKPNkSUL1V UVsPrZi1nMxRLtpFudhaX+dgL5WBrj1Z9HLnaCgekYR8a+pah4KdpHiOxTW6vR2/ZM5a FNEbuE77JMevqajusa6F8Yk4eRqgWk/KshvG8nmqCNfZodKxQllLuEXaI6CwddOxsKGA HaJz3nxwWQ9gWoo/5c9OaTt8oT+2gU0Mx10QvajZr6/0Ht/8gA3WTkV2aawJVu5PbPHN nYGA== X-Received: by 10.68.102.132 with SMTP id fo4mr31223929pbb.96.1410709186201; Sun, 14 Sep 2014 08:39:46 -0700 (PDT) Received: from [192.168.1.99] ([203.117.37.212]) by mx.google.com with ESMTPSA id j5sm9123545pdp.9.2014.09.14.08.39.41 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 14 Sep 2014 08:39:45 -0700 (PDT) Message-ID: <5415B6BC.4090604@gmail.com> Date: Sun, 14 Sep 2014 23:39:40 +0800 From: bycn82 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.1.0 MIME-Version: 1.0 To: Willem Jan Withagen , Ian Smith Subject: Re: IPFW rule sets and automatic rule numbering References: <541469D4.6070107@gmail.com> <54156FBB.1030907@digiware.nl> <20140914204055.K61666@sola.nimnet.asn.au> <54158E49.7090102@digiware.nl> In-Reply-To: <54158E49.7090102@digiware.nl> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: "Alexander V. Chernikov" , Freddie Cash , freebsd-ipfw@freebsd.org X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Sep 2014 15:39:47 -0000 On 9/14/14 20:47, Willem Jan Withagen wrote: > On 14-9-2014 13:44, Ian Smith wrote: >> On Sun, 14 Sep 2014 12:36:43 +0200, Willem Jan Withagen wrote: >> > On 13-9-2014 21:51, Freddie Cash wrote: >> > > You can replicate it using 3 rules, loaded into two sets: >> > > >> > > ipfw set disable 1 >> > > ipfw add allow ip from any to any >> > > ipfw add 65524 allow ip from any to any >> > > ipfw add allow ip from any to any >> > > ipfw set swap 1 0 >> > > >> > > Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or >> > > 3rd run. >> > >> > > >> > > I expected it to be numbered 10, 65524, 65534 after every run. >> > > >> > > However, after reading the man page a few more times and thinking about it >> > > a little more, it makes sense that the numbering is global across all sets, >> > > as you can have multiple sets enabled simultaneously. >> > > >> > > It just doesn't mesh with my desire to use auto numbering. I'm in the midst >> > > of manually numbering all my rules now. :) >> >> > This is easily circumvented by making shure that the first rule is >> > >> > ipfw add 10 ..... >> > like: >> > ipfw add count ip4 from any to any via vlan126 >> > (vlan126 is my outside connection) >> > And then you are home free. >> > >> > I actually use this to also separate diffent types of block by injecting: >> > ipfw add count ip from any to any >> > >> > like: >> > 03000 713812041 425643462848 count ip from any to any >> > 03010 0 0 deny ip6 from fc00::/7 to any via vlan126 >> > >> > And the 3000 block contains all antispoofing and likes. >> >> I'd almost replied along the same lines - also tending to number first >> rules in a block and then add unnumbered rules until other sections - >> before realising that once Freddie had added his rule 65524, maybe in >> another set, it's game over; every unnumbered rule added after that is >> going to be >= 65524 and <= 65534. >> >> And even as you have it above, if you rerun your script again without >> flushing the entire ruleset, apart from specifically numbered rule/s, >> everything will get readded after the highest rule previously used. >> >> Alexander said: >> > I think we can consider implementing sysctl which permits per-set >> > auto-numbering. >> >> Perhaps rather than a separate high water mark per set that would be >> reset on set N flush - which I think is what Alexander means? - if one >> could set something like maybe 'net.inet.ip.fw.autoinc_last' which would >> default, as now, to the highest rule added so far, but could be reset to >> something else before adding more auto_inc rules? Might get tricky, and >> of course it has to not break older rule scripts - some VERY old :) > Could very well be. > I was for the same reason going to implement Freddy's strategy and swap > sets... So could be that I'd run into the same problem in near future. > > It is hard to imagine that people would depend on the fact that the last > rule used would survive a set swap, and actually build on it. > > Being able to actual set the last number used, aka the next number to be > assigned, would be equivalent to my trick using > 'ipfw add count....' > to preset a certain startingpoint. > It could even be made into either a flag on ipfw like > -k keep the last index for future increment > or an ipfw instruction > ipfw setautoincr > And that would not interfere with old scripts. > > tinkering it through sysctl would be possible too, but I'd prefer things > like this integrated in the command-interface. > > --WjW > > I think the per-set auto-numbering is a good idea. But we are there is because of the "set", the "set" in IPFW is a trouble maker. I stared to learn the IPFW in Apr this year, and I was disappoint on some features, and the "set" is one of them. I created a fix patch about it but not relevant to this topic. Regards, Bill Yuan