FreeBSD source tree https://cgit-dev.freebsd.org/src-test2/atom?h=stable%2F4 2004-06-16T06:57:49Z 2004-06-16T06:57:49Z Ruslan Ermilov ru@FreeBSD.org 2004-06-16T06:57:49Z urn:sha1:2e194f788922e182ec6f7bc939765d1d2ed007e4 2003-07-17T06:03:39Z Luigi Rizzo luigi@FreeBSD.org 2003-07-17T06:03:39Z urn:sha1:4eb5891102f83618295f2c1282a8046fe4d5dd66 * implement a '-n' option to do a syntax-check only of ipfw2 rules; * allow spaces after commas in ipfw rules; * support for comma-separated address lists e.g. ipfw add allow ip from not 10.0.0.0/8, 192.168.0.0/16, 1.2.3.4 to me (note the possibility to put a 'not' in front of the entire list, which was not possible with "or blocks"); * allow comments in ipfw rules which are stored together with rules and appear upon an 'ipfw show': ipfw add allow udp from any to any 53 // nameserver * allow set 31 to be used for ordinary (non-default) rules, but with the special feature that rules in set 31 cannot be disabled and are not affected by a 'flush' command (so they must be deleted explicitly). This permits a flexible form of "persistent" rules which should survive across firewall reloads. * allow ranges to be specified in the "ipfw show" and "ipfw list" commands (the same ought to be done for ""ipfw delete"): ipfw show 100-1000 2000 3000-5500 I believe the kernel side of these changes is entirely backward compatible with the old /sbin/ipfw[2], though of course you need to update the userland command to use the new features. 2003-06-28T16:12:14Z Luigi Rizzo luigi@FreeBSD.org 2003-06-28T16:12:14Z urn:sha1:fa5ea78421dd6f0309c3db00b589f85ad719be71 Among other things, this includes the following: + pass to the preprocessor all command-line options after -p (except the last one, the ruleset file) + add the "verrevpath" option + support strong alignment architectures such as alpha and sparc64; + support multiple values and ranges for "iplen", "ipttl", "ipid" options. + support range notations such as 1.2.3.4/24{5,6,7,10-20,60-90} for sets of IP addresses The changes (also those in sys/netinet/ip_dummynet.c) are all IPFW2-specific, which is entirely optional in RELENG_4 so there are no ABI issues for those using the standard ipfw[1]. Note, however, that ipfw2 users MUST REBUILD /sbin/ipfw together with the new kernel. 2002-08-16T11:03:11Z Luigi Rizzo luigi@FreeBSD.org 2002-08-16T11:03:11Z urn:sha1:473b8522ddb21b84525ca5dac0f1672d68941286 prevention of loops in keepalive generation, better defaults on size of dynamic rule table). For documentation, please refer to the ipfw manpage in -current (which I am going to MFC as soon as I have completed the section listing differences between ipfw1-stable and ipfw2). In particular have a look at the sections "PACKET FLOW", "IPFW2 ENHANCEMENTS" and "EXAMPLES" to see if your ruleset can be simplified with the new commands. 2002-07-24T03:21:24Z Luigi Rizzo luigi@FreeBSD.org 2002-07-24T03:21:24Z urn:sha1:489e451968935d9b0494271a82e41bef54210157 chance to test it, and hopefully accelerate the transition from the old to the new ipfw code. NOTE: THIS COMMIT WILL NOT CHANGE THE FIREWALL YOU USE, NOR A SINGLE BIT IN YOUR KERNEL AND BINARIES. YOU WILL KEEP USING YOUR OLD "ipfw" UNLESS YOU: + add "options IPFW2" (undocumented) to your kernel config file; + compile and install sbin/ipfw and lib/libalias with make -DIPFW2 in other words, you must really want it. On the other hand, i believe you do really want to use this new code. In addition to being twice as fast in processing individual rules, you can use more powerful match patterns such as ... ip from 1.2.3.0/24{50,6,27,158} to ... ... ip from { 1.2.3.4/26 or 5.6.7.8/22 } to ... ... ip from any 5-7,9-66,1020-3000,4000-5000 to ... i.e. match sparse sets of IP addresses in constant time; use "or" connectives between match patterns; have multiple port ranges; etc. which I believe will dramatically reduce your ruleset size. As an additional bonus, "keep-state" rules will now send keepalives when the rule is about to expire, so you will not have your remote login sessions die while you are idle. The syntax is backward compatible with the old ipfw. A manual page documenting the extensions has yet to be completed.