From owner-freebsd-net@FreeBSD.ORG  Thu Aug 28 13:07:11 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CA6E916A4C2
	for <freebsd-net@freebsd.org>; Thu, 28 Aug 2003 13:07:11 -0700 (PDT)
Received: from relay.macomnet.ru (relay.macomnet.ru [195.128.64.10])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3C76E43FFD
	for <freebsd-net@freebsd.org>; Thu, 28 Aug 2003 13:07:10 -0700 (PDT)
	(envelope-from maxim@macomnet.ru)
Received: from news1.macomnet.ru (n0prwcam@news1.macomnet.ru [195.128.64.14])
	by relay.macomnet.ru (8.11.6/8.11.6) with ESMTP id h7SK71O13392278;
	Fri, 29 Aug 2003 00:07:01 +0400 (MSD)
Date: Fri, 29 Aug 2003 00:07:01 +0400 (MSD)
From: Maxim Konovalov <maxim@macomnet.ru>
To: Petri Helenius <pete@he.iki.fi>
In-Reply-To: <3F4E5FAF.2080705@he.iki.fi>
Message-ID: <20030829000533.K65653@news1.macomnet.ru>
References: <3F4E5FAF.2080705@he.iki.fi>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: freebsd-net@freebsd.org
Subject: Re: ipfw parsing bug
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Aug 2003 20:07:11 -0000

On Thu, 28 Aug 2003, 23:01+0300, Petri Helenius wrote:

>
> ipfw seems to have developed a bug lately on 5-CURRENT;
> # ipfw add 2042 allow tcp from 0.0.0.0/0 to me
> 42
> 02042 allow tcp from me to me dst-port 42
>
> It used to work that 0.0.0.0/0 was "any" instead of "me". Last I checked
> the notation is also widely used in networking gear for default route which
> is a "catch any" definition.

Known ipfw2 bug.  Try this:

Index: ipfw2.c
===================================================================
RCS file: /home/ncvs/src/sbin/ipfw/ipfw2.c,v
retrieving revision 1.38
diff -u -r1.38 ipfw2.c
--- ipfw2.c	21 Jul 2003 09:56:05 -0000	1.38
+++ ipfw2.c	28 Jul 2003 15:51:26 -0000
@@ -2046,7 +2046,7 @@
 				errx(EX_DATAERR, "not any never matches");
 		}
 		/* else do nothing and skip this entry */
-		continue;
+		return;
 	}
 	/* A single IP can be stored in an optimized format */
 	if (d[1] == IP_MASK_ALL && av == NULL && len == 0) {
%%%

-- 
Maxim Konovalov, maxim@macomnet.ru, maxim@FreeBSD.org