cvs commit: src/sys/netinet ip_fw2.c ip_fw2.h src/sbin/ipfw ipfw.8 ipfw2.c

[Luigi Rizzo]

luigi       2003/07/16 23:03:40 PDT

  FreeBSD src repository

  Modified files:        (Branch: RELENG_4)
    sys/netinet          ip_fw2.c ip_fw2.h 
    sbin/ipfw            ipfw.8 ipfw2.c 
  Log:
  MFC: sync ipfw2 with the version in -current, including:
  
   * implement a '-n' option to do a syntax-check only of ipfw2 rules;
  
   * allow spaces after commas in ipfw rules;
  
   * support for comma-separated address lists e.g.
  
      ipfw add allow ip from not 10.0.0.0/8, 192.168.0.0/16, 1.2.3.4 to me
  
     (note the possibility to put a 'not' in front of the entire list,
     which was not possible with "or blocks");
  
   * allow comments in ipfw rules which are stored together with rules and
     appear upon an 'ipfw show':
  
          ipfw add allow udp from any to any 53 // nameserver
  
   * allow set 31 to be used for ordinary (non-default) rules, but with
     the special feature that rules in set 31 cannot be disabled and
     are not affected by a 'flush' command (so they must be deleted
     explicitly). This permits a flexible form of "persistent" rules
     which should survive across firewall reloads.
  
   * allow ranges to be specified in the "ipfw show" and "ipfw list"
     commands (the same ought to be done for ""ipfw delete"):
  
          ipfw show 100-1000 2000 3000-5500
  
  I believe the kernel side of these changes is entirely backward
  compatible with the old /sbin/ipfw[2], though of course you need
  to update the userland command to use the new features.
  
  Revision   Changes    Path
  1.63.2.37  +123 -66   src/sbin/ipfw/ipfw.8
  1.4.2.16   +708 -476  src/sbin/ipfw/ipfw2.c
  1.6.2.16   +66 -45    src/sys/netinet/ip_fw2.c
  1.1.2.4    +18 -6     src/sys/netinet/ip_fw2.h