From owner-freebsd-net  Tue Feb  6 10:46:13 2001
Delivered-To: freebsd-net@freebsd.org
Received: from fw.wintelcom.net (ns1.wintelcom.net [209.1.153.20])
	by hub.freebsd.org (Postfix) with ESMTP id 6DD1137B401
	for <net@freebsd.org>; Tue,  6 Feb 2001 10:45:54 -0800 (PST)
Received: (from bright@localhost)
	by fw.wintelcom.net (8.10.0/8.10.0) id f16Ijsk17564;
	Tue, 6 Feb 2001 10:45:54 -0800 (PST)
Date: Tue, 6 Feb 2001 10:45:53 -0800
From: Alfred Perlstein <bright@wintelcom.net>
To: Luigi Rizzo <rizzo@aciri.org>
Cc: net@freebsd.org
Subject: Re: IPFIREWALL + BRIDGE + IPDIVERT doesn't work?
Message-ID: <20010206104553.P26076@fw.wintelcom.net>
References: <20010206102958.N26076@fw.wintelcom.net> <200102061841.f16If1041610@iguana.aciri.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200102061841.f16If1041610@iguana.aciri.org>; from rizzo@aciri.org on Tue, Feb 06, 2001 at 10:39:40AM -0800
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

* Luigi Rizzo <rizzo@aciri.org> [010206 10:41] wrote:
> i assume you have upgraded the .h files in
> /usr/include/net and /usr/include/netinet and recompiled
> the userland ipfw, right ?

Yes, buildworld/installworld was done.

> your report is kind of strange because none of the recent
> changes (unless you mean the tcp security fixes) involves
> additional specifiers in ipfw rules.

This is post-security fixes.

> Sure the ipfw struct and the pipe descriptor have changed size,
> but then the problem would occur for all rules not just the "via"
> ones.

I thought so as well, but simple rules without via work...

> can you give use some more detail ?

Yea, I'll try, it would be helpful if you could try to boot a kernel
with all those options just to make sure it's not just me.

-Alfred

> > Let me apologize in advance for this shoddyish bug report.
> > 
> > In a recent -stable (since the new ipfw fixes) if you build
> > a kernel with options:
> > 
> > IPFIREWALL
> > IPFIREWALL_VERBOSE
> > IPFIREWALL_DEFAULT_TO_ACCEPT
> > IPDIVERT
> > BRIDGE
> > DUMMYNET
> > 
> > You wind up with a kernel that doesn't grok the ipfw 'via' keyword.
> > 
> > Basically any rule that has a 'via' in it makes the userland ipfw
> > tool get a 'invalid setsockopt'.  Anyone booting a kernel on a
> > system that relies on 'via' keywords is in for a big suprise as
> > all those rules won't load.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message