From nobody Fri Apr 28 05:52:39 2023
X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q71wS0ck1z481kP;
Fri, 28 Apr 2023 05:52:40 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4Q71wS09jBz4CYm;
Fri, 28 Apr 2023 05:52:40 +0000 (UTC)
(envelope-from git@FreeBSD.org)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim;
t=1682661160;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=GpgxVlu8cegnskMmhQ5QgdG0a37Q+5CkN194s83TCP0=;
b=xzMQE2VC4PB9/tHZD8HvzZMIKdQCY1k8vEvk6Wy20fLn/eaxw32nm/2gzGJ1LUpFpaBDJs
DfHRSKfQQMynG1aOyR89ubBG+p3QHFmkNF2mqOxRl7aLfqaOrxs0zi67la8z4t3yLZkJ77
7H+zrxwlUKSfJ0+w4VtRyzA0QXYl6JZz2p6C+dMVFvKFIATw3vINjE3s0SPRcFirECIhu8
oZJcoD0xic1fVn8OaTjdnagxEMsS9fshLb1sA6ZVYIh1XxPOmaqkeWbtlvxIMFjGqk3BVI
0Et3QNmU9HIGoVN0hb8qNff4QHTxFRKrPAALA/P/Qn1HiktS9QWCkjZRXQeNeQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org;
s=dkim; t=1682661160;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=GpgxVlu8cegnskMmhQ5QgdG0a37Q+5CkN194s83TCP0=;
b=l5rw4Q+HSRvhTNY2f5i4JGbEqfS5Akei3eF9ohP2EPChilZbVnbuUlzKlTPMCPJGZpoEzJ
mK1ZvYdPObQQIFwoeAKX6M2QC5dFggptTlvk580m5HZd/ISV3yw/rqdChPxzdftBVPLqXr
zyKkgjRrDsO3b9KA2uukfT0bDoU1fH2KcfJjLP7vfXuCYh/Vc3r91nzIPg7A/T6XhdoJ5q
IvJDt6aJz5BghZ/FrG0EmEB5i8jwWRL2vZcLk+jIsdGEqpt4aqEijTOIMZF4pdBHiGwZ6Y
lqMdTeq2gDl/dmYvgN3Ls+IV4RKBHs846SuzHXnCOJkToyr5lEegfgUuwiHREQ==
ARC-Authentication-Results: i=1;
mx1.freebsd.org;
none
ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1682661160; a=rsa-sha256; cv=none;
b=r45+l2dRVJGPpde13s8uOiKYqZa3WJ5XVxJ1tMkvLMVJd6xLbDW8+YKNLXEvnvL4z/TDE7
Pi29jdd39OiSFPQP4VHwpEl/nkXtwTS7ZoEEllex6zPBYFmbZtiSECV/4F1fWIjF2D0huW
ebVERv6hgPbD4V4d0XQi+OpqUiFs6I/KAUEf4o8HeyeU1jyPjsigkqRwSt1YhGpjZvhRgS
aQ6mbFkUgkklZnmI7DR+znqr0K1bvXDqvRPugDtvLyVzPiRbUqpF+FIF+sNpVotoOw4hUT
5nYthWQJmRm0c0N4U/B1Ga+X3hPitzvJW9WGuhXiK2evg/z6GfUtgdlazECDyg==
Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Q71wR6L7vzp2X;
Fri, 28 Apr 2023 05:52:39 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from gitrepo.freebsd.org ([127.0.1.44])
by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33S5qdj1019484;
Fri, 28 Apr 2023 05:52:39 GMT
(envelope-from git@gitrepo.freebsd.org)
Received: (from git@localhost)
by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33S5qdB9019483;
Fri, 28 Apr 2023 05:52:39 GMT
(envelope-from git)
Date: Fri, 28 Apr 2023 05:52:39 GMT
Message-Id: <202304280552.33S5qdB9019483@gitrepo.freebsd.org>
To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org,
dev-commits-src-branches@FreeBSD.org
From: Eugene Grosbein <eugen@FreeBSD.org>
Subject: git: f1c5c9353c0e - stable/13 - ipfw.8: MFC: improve description for interface matching
List-Id: Commits to the stable branches of the FreeBSD src repository <dev-commits-src-branches.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches
List-Help: <mailto:dev-commits-src-branches+help@freebsd.org>
List-Post: <mailto:dev-commits-src-branches@freebsd.org>
List-Subscribe: <mailto:dev-commits-src-branches+subscribe@freebsd.org>
List-Unsubscribe: <mailto:dev-commits-src-branches+unsubscribe@freebsd.org>
Sender: owner-dev-commits-src-branches@freebsd.org
X-BeenThere: dev-commits-src-branches@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Git-Committer: eugen
X-Git-Repository: src
X-Git-Refname: refs/heads/stable/13
X-Git-Reftype: branch
X-Git-Commit: f1c5c9353c0ea70fcf058666fbbfa648ad3637c6
Auto-Submitted: auto-generated
X-ThisMailContainsUnwantedMimeParts: N
The branch stable/13 has been updated by eugen:
URL: https://cgit.FreeBSD.org/src/commit/?id=f1c5c9353c0ea70fcf058666fbbfa648ad3637c6
commit f1c5c9353c0ea70fcf058666fbbfa648ad3637c6
Author: Eugene Grosbein <eugen@FreeBSD.org>
AuthorDate: 2023-04-25 11:12:11 +0000
Commit: Eugene Grosbein <eugen@FreeBSD.org>
CommitDate: 2023-04-28 05:52:15 +0000
ipfw.8: MFC: improve description for interface matching
The manual describes "if*" form only while kernel uses fnmatch(3)
and allows use for more versatile shell-like patterns.
Note that explicitly and provide an example.
(cherry picked from commit 9f5dc374d0dadb6947a9bd9ff8ff44931e1b6422)
---
sbin/ipfw/ipfw.8 | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
index 3c5308b29821..40299e70ed27 100644
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -1,7 +1,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd June 4, 2022
+.Dd April 25, 2023
.Dt IPFW 8
.Os
.Sh NAME
@@ -1912,13 +1912,24 @@ However, this option doesn't imply an implicit
.Cm check-state
in contrast to
.Cm keep-state .
-.It Cm recv | xmit | via Brq Ar ifX | Ar if Ns Cm * | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any
+.It Cm recv | xmit | via Brq Ar ifX | Ar ifmask | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any
Matches packets received, transmitted or going through,
respectively, the interface specified by exact name
.Po Ar ifX Pc ,
-by device name
-.Po Ar if* Pc ,
+by device mask
+.Po Ar ifmask Pc ,
by IP address, or through some interface.
+.Pp
+Interface
+name may be matched against
+.Ar ifmask
+with
+.Xr fnmatch 3
+according to the rules used by the shell (f.e. tun*).
+See also the
+.Sx EXAMPLES
+section.
+.Pp
Table
.Ar name
may be used to match interface by its kernel ifindex.
@@ -4217,6 +4228,12 @@ of clients, as below:
.Dl "ipfw add deny ip from ${badguys} to any"
.Dl "... normal policies ..."
.Pp
+Allow any transit packets coming from single vlan 10 and
+going out to vlans 100-1000:
+.Pp
+.Dl "ipfw add 10 allow out recv vlan10 \e"
+.Dl "{ xmit vlan1000 or xmit \*qvlan[1-9]??\*q }"
+.Pp
The
.Cm verrevpath
option could be used to do automated anti-spoofing by adding the
@@ -4740,6 +4757,7 @@ can be changed in a similar way as for
.Sh SEE ALSO
.Xr cpp 1 ,
.Xr m4 1 ,
+.Xr fnmatch 3 ,
.Xr altq 4 ,
.Xr divert 4 ,
.Xr dummynet 4 ,