>Number: 152667
>Category: kern
>Synopsis: [ipfw][patch]: Change of result of a rule containing "not"
>after "skipto"
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Nov 29 12:00:37 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator: Aleksey
>Release: 8.1-RELEASE
>Organization:
MKC
>Environment:
FreeBSD nas2.test 8.1-RELEASE-p1 FreeBSD 8.1-RELEASE-p1 #1: Sat Nov 27 10:06:28
OMST 2010 r...@nas2.test:/usr/obj/usr/src/sys/GW i386
>Description:
In a rule of the following after "skipto" change the logic of the modifier "not"
>How-To-Repeat:
The elementary firewall allow only outgoing connections:
ipfw add 310 check-state
ipfw add 400 skipto 500 ip from not me to any
ipfw add 410 allow ip from any to any keep-state
ipfw add 500 deny all from any to any
Allow all incoming connections if add:
ipfw add 300 skipto 400 ip from not me to any
>Fix:
Patch attached with submission follows:
--- /usr/src/sys/netinet/ipfw/ip_fw2.c.orig 2010-06-14 09:09:06.000000000
+0700
+++ /usr/src/sys/netinet/ipfw/ip_fw2.c 2010-11-29 15:53:28.000000000 +0600
@@ -2016,7 +2016,7 @@
f = chain->map[f_pos];
l = f->cmd_len;
cmd = f->cmd;
- match = 1;
+ if (!cmd->len & F_NOT) match = 1;
cmdlen = 0;
skip_or = 0;
break;
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
