well i just tested things here and everything works fine.
"via" rules are accepted. i have the same set of options
that you mentioned IPFW DIVERT open firewall dummynet and bridge.
This is on an essentially up-to-date STABLE (net/ and netinet/
are same as in -stable).
cheers
luigi
> * Luigi Rizzo <[EMAIL PROTECTED]> [010206 10:41] wrote:
> > i assume you have upgraded the .h files in
> > /usr/include/net and /usr/include/netinet and recompiled
> > the userland ipfw, right ?
>
> Yes, buildworld/installworld was done.
>
> > your report is kind of strange because none of the recent
> > changes (unless you mean the tcp security fixes) involves
> > additional specifiers in ipfw rules.
>
> This is post-security fixes.
>
> > Sure the ipfw struct and the pipe descriptor have changed size,
> > but then the problem would occur for all rules not just the "via"
> > ones.
>
> I thought so as well, but simple rules without via work...
>
> > can you give use some more detail ?
>
> Yea, I'll try, it would be helpful if you could try to boot a kernel
> with all those options just to make sure it's not just me.
>
> -Alfred
>
> > > Let me apologize in advance for this shoddyish bug report.
> > >
> > > In a recent -stable (since the new ipfw fixes) if you build
> > > a kernel with options:
> > >
> > > IPFIREWALL
> > > IPFIREWALL_VERBOSE
> > > IPFIREWALL_DEFAULT_TO_ACCEPT
> > > IPDIVERT
> > > BRIDGE
> > > DUMMYNET
> > >
> > > You wind up with a kernel that doesn't grok the ipfw 'via' keyword.
> > >
> > > Basically any rule that has a 'via' in it makes the userland ipfw
> > > tool get a 'invalid setsockopt'. Anyone booting a kernel on a
> > > system that relies on 'via' keywords is in for a big suprise as
> > > all those rules won't load.
>
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
