* Luigi Rizzo <[EMAIL PROTECTED]> [010206 10:41] wrote:
> i assume you have upgraded the .h files in
> /usr/include/net and /usr/include/netinet and recompiled
> the userland ipfw, right ?
Yes, buildworld/installworld was done.
> your report is kind of strange because none of the recent
> changes (unless you mean the tcp security fixes) involves
> additional specifiers in ipfw rules.
This is post-security fixes.
> Sure the ipfw struct and the pipe descriptor have changed size,
> but then the problem would occur for all rules not just the "via"
> ones.
I thought so as well, but simple rules without via work...
> can you give use some more detail ?
Yea, I'll try, it would be helpful if you could try to boot a kernel
with all those options just to make sure it's not just me.
-Alfred
> > Let me apologize in advance for this shoddyish bug report.
> >
> > In a recent -stable (since the new ipfw fixes) if you build
> > a kernel with options:
> >
> > IPFIREWALL
> > IPFIREWALL_VERBOSE
> > IPFIREWALL_DEFAULT_TO_ACCEPT
> > IPDIVERT
> > BRIDGE
> > DUMMYNET
> >
> > You wind up with a kernel that doesn't grok the ipfw 'via' keyword.
> >
> > Basically any rule that has a 'via' in it makes the userland ipfw
> > tool get a 'invalid setsockopt'. Anyone booting a kernel on a
> > system that relies on 'via' keywords is in for a big suprise as
> > all those rules won't load.
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
