The following reply was made to PR kern/157867; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/157867: commit references a PR
Date: Tue, 14 Jun 2011 13:35:34 + (UTC)
Author: ae
Date: Tue Jun 14 13:35:24 2011
New Revision: 223080
URL: http://svn.freebsd.org/changeset/base/223080
Log:
Implement "global" mode for ipfw nat. It is similar to natd(8)
"globalport" option for multiple NAT instances.
If ipfw rule contains "global" keyword instead of nat_number, then
for each outgoing packet ipfw_nat looks up translation state in all
configured nat instances. If an entry is found, packet aliased
according to that entry, otherwise packet is passed unchanged.
User can specify "skip_global" option in NAT configuration to exclude
an instance from the lookup in global mode.
PR: kern/157867
Submitted by:Alexander V. Chernikov (previous version)
Tested by: Eugene Grosbein
Modified:
head/sbin/ipfw/ipfw.8
head/sbin/ipfw/ipfw2.c
head/sbin/ipfw/ipfw2.h
head/sbin/ipfw/nat.c
head/sys/netinet/ipfw/ip_fw2.c
head/sys/netinet/ipfw/ip_fw_nat.c
head/sys/netinet/libalias/alias.h
Modified: head/sbin/ipfw/ipfw.8
==
--- head/sbin/ipfw/ipfw.8 Tue Jun 14 13:02:26 2011(r223079)
+++ head/sbin/ipfw/ipfw.8 Tue Jun 14 13:35:24 2011(r223080)
@@ -1,7 +1,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd May 30, 2011
+.Dd June 14, 2011
.Dt IPFW 8
.Os
.Sh NAME
@@ -2435,6 +2435,27 @@ Reset table of the packet aliasing engin
Reverse the way libalias handles aliasing.
.It Cm proxy_only
Obey transparent proxy rules only, packet aliasing is not performed.
+.It Cm skip_global
+Skip instance in case of global state lookup (see below).
+.El
+.Pp
+Some specials value can be supplied instead of
+.Va nat_number:
+.Bl -tag -width indent
+.It Cm global
+Looks up translation state in all configured nat instances.
+If an entry is found, packet is aliased according to that entry.
+If no entry was found in any of the instances, packet is passed unchanged,
+and no new entry will be created.
+See section
+.Sx MULTIPLE INSTANCES
+in
+.Xr natd 8
+for more information.
+.It Cm tablearg
+Uses argument supplied in lookup table. See
+.Sx LOOKUP TABLES
+section below for more information on lookup tables.
.El
.Pp
To let the packet continue after being (de)aliased, set the sysctl variable
Modified: head/sbin/ipfw/ipfw2.c
==
--- head/sbin/ipfw/ipfw2.c Tue Jun 14 13:02:26 2011(r223079)
+++ head/sbin/ipfw/ipfw2.c Tue Jun 14 13:35:24 2011(r223080)
@@ -1121,8 +1121,11 @@ show_ipfw(struct ip_fw *rule, int pcwidt
break;
case O_NAT:
- PRINT_UINT_ARG("nat ", cmd->arg1);
- break;
+ if (cmd->arg1 != 0)
+ PRINT_UINT_ARG("nat ", cmd->arg1);
+ else
+ printf("nat global");
+ break;
case O_SETFIB:
PRINT_UINT_ARG("setfib ", cmd->arg1);
@@ -2738,9 +2741,14 @@ ipfw_add(char *av[])
break;
case TOK_NAT:
- action->opcode = O_NAT;
- action->len = F_INSN_SIZE(ipfw_insn_nat);
- goto chkarg;
+ action->opcode = O_NAT;
+ action->len = F_INSN_SIZE(ipfw_insn_nat);
+ if (_substrcmp(*av, "global") == 0) {
+ action->arg1 = 0;
+ av++;
+ break;
+ } else
+ goto chkarg;
case TOK_QUEUE:
action->opcode = O_QUEUE;
Modified: head/sbin/ipfw/ipfw2.h
==
--- head/sbin/ipfw/ipfw2.h Tue Jun 14 13:02:26 2011(r223079)
+++ head/sbin/ipfw/ipfw2.h Tue Jun 14 13:35:24 2011(r223080)
@@ -178,6 +178,7 @@ enum tokens {
TOK_DENY_INC,
TOK_SAME_PORTS,
TOK_UNREG_ONLY,
+ TOK_SKIP_GLOBAL,
TOK_RESET_ADDR,
TOK_ALIAS_REV,
TOK_PROXY_ONLY,
Modified: head/sbin/ipfw/nat.c
==
--- head/sbin/ipfw/nat.c Tue Jun 14 13:02:26 2011(r223079)
+++ head/sbin/ipfw/nat.c Tue Jun 14 13:35:24 2011(r223080)
@@ -53,6 +53,7 @@ static struct _s_x nat_params[] = {
{ "deny_in",TOK_DENY_INC },
{ "same_ports", TOK_SAME_PORTS },
{ "unreg_only", TOK_UNREG_ONLY },
+ { "skip_global",TOK_SKIP_GLOBAL },
{ "reset", TOK_
