From owner-cvs-src@FreeBSD.ORG  Wed May 24 15:22:53 2006
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8314B16A575
	for <cvs-src@FreeBSD.org>; Wed, 24 May 2006 15:22:53 +0000 (UTC)
	(envelope-from andre@freebsd.org)
Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EF92C43D48
	for <cvs-src@FreeBSD.org>; Wed, 24 May 2006 15:22:51 +0000 (GMT)
	(envelope-from andre@freebsd.org)
Received: (qmail 68833 invoked from network); 24 May 2006 15:19:53 -0000
Received: from c00l3r.networx.ch (HELO [127.0.0.1]) ([62.48.2.2])
	(envelope-sender <andre@freebsd.org>)
	by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP
	for <oleg@FreeBSD.org>; 24 May 2006 15:19:53 -0000
Message-ID: <44747A4C.9090800@freebsd.org>
Date: Wed, 24 May 2006 17:22:52 +0200
From: Andre Oppermann <andre@freebsd.org>
User-Agent: Thunderbird 1.5.0.2 (Windows/20060308)
MIME-Version: 1.0
To: Oleg Bulyzhin <oleg@FreeBSD.org>
References: <200605241309.k4OD9tex003002@repoman.freebsd.org>
	<20060524131602.GA57006@lath.rinet.ru>
In-Reply-To: <20060524131602.GA57006@lath.rinet.ru>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/netinet ip_fw.h ip_fw2.c src/sbin/ipfw
 ipfw.8 ipfw2.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 24 May 2006 15:22:53 -0000

Oleg Bulyzhin wrote:
> On Wed, May 24, 2006 at 01:09:55PM +0000, Oleg Bulyzhin wrote:
>> oleg        2006-05-24 13:09:55 UTC
>>
>>   FreeBSD src repository
>>
>>   Modified files:
>>     sys/netinet          ip_fw.h ip_fw2.c 
>>     sbin/ipfw            ipfw.8 ipfw2.c 
>>   Log:
>>   Implement internal (i.e. inside kernel) packet tagging using mbuf_tags(9).
>>   Since tags are kept while packet resides in kernelspace, it's possible to
>>   use other kernel facilities (like netgraph nodes) for altering those tags.
>>   
>>   Submitted by:   Andrey Elsukov <bu7cher at yandex dot ru>
>>   Submitted by:   Vadim Goncharov <vadimnuclight at tpu dot ru>
>>   Approved by:    glebius (mentor)
>>   Idea from:      OpenBSD PF
>>   MFC after:      1 month
>>   
>>   Revision  Changes    Path
>>   1.188     +61 -1     src/sbin/ipfw/ipfw.8
>>   1.89      +72 -8     src/sbin/ipfw/ipfw2.c
>>   1.106     +6 -0      src/sys/netinet/ip_fw.h
>>   1.132     +57 -1     src/sys/netinet/ip_fw2.c
> 
> Examples of ipfw rules syntax:
> 	count tag 100 ip from any to any
> 	allow untag 10 ip from any to any tagged 10

Does this accept the packet and untag it at the same time?  Wouldn't
it make more sense to have [tag|untag] as its own operators like
[allow|deny]?

> 	allow tag 200 ip from any to any not tagged 0-65535
> 

-- 
Andre