Date: Fri, 23 Apr 2004 07:27:27 -0700 (PDT) From: Andre Oppermann <andre@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/netinet ip_fw.h ip_fw2.c Message-ID: <200404231427.i3NERR34063763@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
andre 2004/04/23 07:27:27 PDT
FreeBSD src repository
Modified files:
sys/netinet ip_fw.h ip_fw2.c
Log:
Add the option versrcreach to verify that a valid route to the
source address of a packet exists in the routing table. The
default route is ignored because it would match everything and
render the check pointless.
This option is very useful for routers with a complete view of
the Internet (BGP) in the routing table to reject packets with
spoofed or unrouteable source addresses.
Example:
ipfw add 1000 deny ip from any to any not versrcreach
also known in Cisco-speak as:
ip verify unicast source reachable-via any
Reviewed by: luigi
Revision Changes Path
1.84 +1 -0 src/sys/netinet/ip_fw.h
1.57 +31 -7 src/sys/netinet/ip_fw2.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200404231427.i3NERR34063763>