Re: kern/150798: [ipfw] ipfw2 fwd rule matches packets but does not do the job in fact.
Synopsis: [ipfw] ipfw2 fwd rule matches packets but does not do the job in fact. State-Changed-From-To: patched->closed State-Changed-By: ae State-Changed-When: Wed Jul 6 06:59:20 UTC 2011 State-Changed-Why: Merged to stable/7 and stable/8. Thanks! http://www.freebsd.org/cgi/query-pr.cgi?pr=150798 ___ freebsd-ipfw@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/136695: commit references a PR
The following reply was made to PR kern/136695; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/136695: commit references a PR
Date: Wed, 6 Jul 2011 06:56:40 + (UTC)
Author: ae
Date: Wed Jul 6 06:56:31 2011
New Revision: 223819
URL: http://svn.freebsd.org/changeset/base/223819
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR:kern/136695, kern/147720, kern/150798
Modified:
stable/8/sys/netinet/ipfw/ip_fw2.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
Modified: stable/8/sys/netinet/ipfw/ip_fw2.c
==
--- stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:34:08 2011
(r223818)
+++ stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
@@ -2070,7 +2070,8 @@ do {
\
case O_FORWARD_IP:
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
struct sockaddr_in *sa;
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (sa->sin_addr.s_addr == INADDR_ANY) {
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/147720: commit references a PR
The following reply was made to PR kern/147720; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/147720: commit references a PR
Date: Wed, 6 Jul 2011 06:56:41 + (UTC)
Author: ae
Date: Wed Jul 6 06:56:31 2011
New Revision: 223819
URL: http://svn.freebsd.org/changeset/base/223819
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR:kern/136695, kern/147720, kern/150798
Modified:
stable/8/sys/netinet/ipfw/ip_fw2.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
Modified: stable/8/sys/netinet/ipfw/ip_fw2.c
==
--- stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:34:08 2011
(r223818)
+++ stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
@@ -2070,7 +2070,8 @@ do {
\
case O_FORWARD_IP:
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
struct sockaddr_in *sa;
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (sa->sin_addr.s_addr == INADDR_ANY) {
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/136695: commit references a PR
The following reply was made to PR kern/136695; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/136695: commit references a PR
Date: Wed, 6 Jul 2011 06:57:16 + (UTC)
Author: ae
Date: Wed Jul 6 06:57:07 2011
New Revision: 223820
URL: http://svn.freebsd.org/changeset/base/223820
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR: kern/136695, kern/147720, kern/150798
Modified:
stable/7/sys/netinet/ip_fw2.c
Directory Properties:
stable/7/sys/ (props changed)
stable/7/sys/cddl/contrib/opensolaris/ (props changed)
stable/7/sys/contrib/dev/acpica/ (props changed)
stable/7/sys/contrib/pf/ (props changed)
Modified: stable/7/sys/netinet/ip_fw2.c
==
--- stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
+++ stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:57:07 2011
(r223820)
@@ -3284,7 +3284,8 @@ check_body:
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
if (sa->sin_addr.s_addr == INADDR_ANY) {
bcopy(sa, &args->hopstore,
sizeof(*sa));
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/147720: commit references a PR
The following reply was made to PR kern/147720; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/147720: commit references a PR
Date: Wed, 6 Jul 2011 06:57:17 + (UTC)
Author: ae
Date: Wed Jul 6 06:57:07 2011
New Revision: 223820
URL: http://svn.freebsd.org/changeset/base/223820
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR: kern/136695, kern/147720, kern/150798
Modified:
stable/7/sys/netinet/ip_fw2.c
Directory Properties:
stable/7/sys/ (props changed)
stable/7/sys/cddl/contrib/opensolaris/ (props changed)
stable/7/sys/contrib/dev/acpica/ (props changed)
stable/7/sys/contrib/pf/ (props changed)
Modified: stable/7/sys/netinet/ip_fw2.c
==
--- stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
+++ stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:57:07 2011
(r223820)
@@ -3284,7 +3284,8 @@ check_body:
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
if (sa->sin_addr.s_addr == INADDR_ANY) {
bcopy(sa, &args->hopstore,
sizeof(*sa));
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/150798: commit references a PR
The following reply was made to PR kern/150798; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/150798: commit references a PR
Date: Wed, 6 Jul 2011 06:57:17 + (UTC)
Author: ae
Date: Wed Jul 6 06:57:07 2011
New Revision: 223820
URL: http://svn.freebsd.org/changeset/base/223820
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR: kern/136695, kern/147720, kern/150798
Modified:
stable/7/sys/netinet/ip_fw2.c
Directory Properties:
stable/7/sys/ (props changed)
stable/7/sys/cddl/contrib/opensolaris/ (props changed)
stable/7/sys/contrib/dev/acpica/ (props changed)
stable/7/sys/contrib/pf/ (props changed)
Modified: stable/7/sys/netinet/ip_fw2.c
==
--- stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
+++ stable/7/sys/netinet/ip_fw2.c Wed Jul 6 06:57:07 2011
(r223820)
@@ -3284,7 +3284,8 @@ check_body:
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
if (sa->sin_addr.s_addr == INADDR_ANY) {
bcopy(sa, &args->hopstore,
sizeof(*sa));
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: kern/150798: commit references a PR
The following reply was made to PR kern/150798; it has been noted by GNATS.
From: dfil...@freebsd.org (dfilter service)
To: bug-follo...@freebsd.org
Cc:
Subject: Re: kern/150798: commit references a PR
Date: Wed, 6 Jul 2011 06:56:41 + (UTC)
Author: ae
Date: Wed Jul 6 06:56:31 2011
New Revision: 223819
URL: http://svn.freebsd.org/changeset/base/223819
Log:
MFC r222582:
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR:kern/136695, kern/147720, kern/150798
Modified:
stable/8/sys/netinet/ipfw/ip_fw2.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
Modified: stable/8/sys/netinet/ipfw/ip_fw2.c
==
--- stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:34:08 2011
(r223818)
+++ stable/8/sys/netinet/ipfw/ip_fw2.c Wed Jul 6 06:56:31 2011
(r223819)
@@ -2070,7 +2070,8 @@ do {
\
case O_FORWARD_IP:
if (args->eh) /* not valid on layer2 pkts */
break;
- if (!q || dyn_dir == MATCH_FORWARD) {
+ if (q == NULL || q->rule != f ||
+ dyn_dir == MATCH_FORWARD) {
struct sockaddr_in *sa;
sa = &(((ipfw_insn_sa *)cmd)->sa);
if (sa->sin_addr.s_addr == INADDR_ANY) {
___
svn-src-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
___
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
Re: ipfw fwd on FreeBSD 8.1, does it work? [SOLVED]
--- On Wed, 7/6/11, Andrey V. Elsukov wrote: > From: Andrey V. Elsukov > Subject: Re: ipfw fwd on FreeBSD 8.1, does it work? > To: "Unga" > Cc: freebsd-ipfw@freebsd.org, "Fabian Wenk" > Date: Wednesday, July 6, 2011, 1:51 AM > On 05.07.2011 21:20, Unga wrote: > > Thanks for the reply. > > > > The 'options IPFIREWALL_FORWARD' is already built in > the custom kernel. > > > > Both rules you suggested develop the same error: > > ipfw: getsockopt(IP_FW_ADD): Invalid argument > > Hi, > > You should add 'options IPFIREWALL' in the your kernel > config too. > > -- > WBR, Andrey V. Elsukov > Hi Andrey I have added 'options IPFIREWALL' and rebuilt all, now 'ipfw fwd' works well. So the 'options IPFIREWALL_FORWARD' alone is insufficient, the 'options IPFIREWALL' is also required. Thank you and all others who helped me in this regard. Cheers Unga ___ freebsd-ipfw@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
