Date: Thu, 27 Nov 2003 22:15:40 +0700 (KRAT) From: Eugene Grosbein <eugen@grosbein.pp.ru> To: FreeBSD-gnats-submit@FreeBSD.org Subject: docs/59835: ipfw(8) man page does not warn about accepted but meaningless rules Message-ID: <200311271515.hARFFe2J005405@grosbein.pp.ru> Resent-Message-ID: <200311301350.hAUDoKB2065391@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 59835
>Category: docs
>Synopsis: ipfw(8) man page does not warn about accepted but meaningless rules
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-doc
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: doc-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Nov 30 05:50:20 PST 2003
>Closed-Date:
>Last-Modified:
>Originator: Eugene Grosbein
>Release: FreeBSD 4.9-STABLE i386
>Organization:
Svyaz Service JSC
>Environment:
System: FreeBSD grosbein.pp.ru 4.9-STABLE FreeBSD 4.9-STABLE #2: Tue Nov 25 23:13:47 KRAT 2003 eu@grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386
IPFW2
>Description:
ipfw2 accepts rules like this:
divert 10000 ip from any to any via fxp0 MAC 00:90:27:a7:5c:72 any
But this rules will never match a packet. And ipfw(8) man page
mentiones this nowhere. Yes, it says something:
/* quote start */
Note that as packets flow through the stack, headers can be stripped or
added to it, and so they may or may not be available for inspection.
E.g., incoming packets will include the MAC header when ipfw is invoked
from ether_demux(), but the same packets will have the MAC header
stripped off when ipfw is invoked from ip_input().
Also note that each packet is always checked against the complete rule-
set, irrespective of the place where the check occurs, or the source of
the packet. If a rule contains some match patterns or actions which are
not valid for the place of invocation (e.g. trying to match a MAC header
within ip_input() ), the match pattern will not match, but a not operator
in front of such patterns will cause the pattern to always match on those
packets.
/* quote stop */
However, man page does not say that divertion will occur when
ipfw is invoked from ip_input().
>How-To-Repeat:
See description. I needed to count and divert unicast-only packets
to an application, tried to use mentioned rule and failed.
I'm forced to rewrite it as a set of three rules (count,
skip broadcast and divert) but it took some time to understand
what's going wrong.
>Fix:
Correct ipfw(8) man page. It should clearly state that divert
can never be used with layer2 packets.
Eugene Grosbein
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200311271515.hARFFe2J005405>