From owner-freebsd-net Tue Feb 6 13: 1:55 2001 Delivered-To: freebsd-net@freebsd.org Received: from iguana.aciri.org (iguana.aciri.org [192.150.187.36]) by hub.freebsd.org (Postfix) with ESMTP id 0514C37B401 for ; Tue, 6 Feb 2001 13:01:36 -0800 (PST) Received: (from rizzo@localhost) by iguana.aciri.org (8.11.1/8.11.1) id f16L1PI44593; Tue, 6 Feb 2001 13:01:25 -0800 (PST) (envelope-from rizzo) From: Luigi Rizzo Message-Id: <200102062101.f16L1PI44593@iguana.aciri.org> Subject: Re: IPFIREWALL + BRIDGE + IPDIVERT doesn't work? In-Reply-To: <20010206104553.P26076@fw.wintelcom.net> from Alfred Perlstein at "Feb 6, 2001 10:45:53 am" To: bright@wintelcom.net (Alfred Perlstein) Date: Tue, 6 Feb 2001 13:01:25 -0800 (PST) Cc: rizzo@aciri.org, net@freebsd.org X-Mailer: ELM [version 2.4ME+ PL43 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org well i just tested things here and everything works fine. "via" rules are accepted. i have the same set of options that you mentioned IPFW DIVERT open firewall dummynet and bridge. This is on an essentially up-to-date STABLE (net/ and netinet/ are same as in -stable). cheers luigi > * Luigi Rizzo [010206 10:41] wrote: > > i assume you have upgraded the .h files in > > /usr/include/net and /usr/include/netinet and recompiled > > the userland ipfw, right ? > > Yes, buildworld/installworld was done. > > > your report is kind of strange because none of the recent > > changes (unless you mean the tcp security fixes) involves > > additional specifiers in ipfw rules. > > This is post-security fixes. > > > Sure the ipfw struct and the pipe descriptor have changed size, > > but then the problem would occur for all rules not just the "via" > > ones. > > I thought so as well, but simple rules without via work... > > > can you give use some more detail ? > > Yea, I'll try, it would be helpful if you could try to boot a kernel > with all those options just to make sure it's not just me. > > -Alfred > > > > Let me apologize in advance for this shoddyish bug report. > > > > > > In a recent -stable (since the new ipfw fixes) if you build > > > a kernel with options: > > > > > > IPFIREWALL > > > IPFIREWALL_VERBOSE > > > IPFIREWALL_DEFAULT_TO_ACCEPT > > > IPDIVERT > > > BRIDGE > > > DUMMYNET > > > > > > You wind up with a kernel that doesn't grok the ipfw 'via' keyword. > > > > > > Basically any rule that has a 'via' in it makes the userland ipfw > > > tool get a 'invalid setsockopt'. Anyone booting a kernel on a > > > system that relies on 'via' keywords is in for a big suprise as > > > all those rules won't load. > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message