Date: Thu, 12 Mar 2009 00:20:03 GMT From: Christoph Weber-Fahr <cwf-ml@arcor.de> To: freebsd-bugs@FreeBSD.org Subject: Re: misc/132553: ipfw doesnt understand ftp-data port Message-ID: <200903120020.n2C0K3Tn089861@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/132553; it has been noted by GNATS.
From: Christoph Weber-Fahr <cwf-ml@arcor.de>
To: Maxim Konovalov <maxim@macomnet.ru>
Cc: bug-followup@FreeBSD.org
Subject: Re: misc/132553: ipfw doesnt understand ftp-data port
Date: Wed, 11 Mar 2009 23:35:03 +0100
Hello,
Maxim Konovalov <maxim@macomnet.ru> wrote:
>> # ipfw add 1770 allow tcp from any to any ftp-data keep-state
>>
>> but now it produces
>>
>> ipfw: unrecognised option [-1] ftp-data
[...]
> $ ipfw -n add 1770 allow tcp from any to any ftp\\-data keep-state
>
> 01770 allow tcp from any to any dst-port 20 keep-state
>
> works for me.
Two problems with that:
1. it is neither obvious nor documented that you need
to escape the minus.
The manpage says you can use names from /etc/services.
No restrictions. The minus sign is not a shell token
either, so ipfw gets it as it is. Furthermore, ipfw
can handle minus signs on various parts of its syntax
tree, so its not a general problem.
So there is no reason for the plain user to escape that.
Actually, even though it might be obvious to you, I have no
clue why actually escaping is necessary now when it wasn't
needed before.
2. it breaks compatibility with older firewall scripts.
I ran against that when migrating a larger firewall rule
set from freebsd 4.x to 6.x. That line worked quite
nicely in freebsd 4.x. (don't know about 5.x)
So I suggest fixing it, or, at least, document the problem
in the man page.
Regards
Christoph Weber-Fahr
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903120020.n2C0K3Tn089861>