misc/132553: ipfw doesnt understand ftp-data port
cwf-ml at arcor.de
Wed Mar 11 17:20:04 PDT 2009
The following reply was made to PR misc/132553; it has been noted by GNATS.
From: Christoph Weber-Fahr <cwf-ml at arcor.de>
To: Maxim Konovalov <maxim at macomnet.ru>
Cc: bug-followup at FreeBSD.org
Subject: Re: misc/132553: ipfw doesnt understand ftp-data port
Date: Wed, 11 Mar 2009 23:35:03 +0100
Maxim Konovalov <maxim at macomnet.ru> wrote:
>> # ipfw add 1770 allow tcp from any to any ftp-data keep-state
>> but now it produces
>> ipfw: unrecognised option [-1] ftp-data
> $ ipfw -n add 1770 allow tcp from any to any ftp\\-data keep-state
> 01770 allow tcp from any to any dst-port 20 keep-state
> works for me.
Two problems with that:
1. it is neither obvious nor documented that you need
to escape the minus.
The manpage says you can use names from /etc/services.
No restrictions. The minus sign is not a shell token
either, so ipfw gets it as it is. Furthermore, ipfw
can handle minus signs on various parts of its syntax
tree, so its not a general problem.
So there is no reason for the plain user to escape that.
Actually, even though it might be obvious to you, I have no
clue why actually escaping is necessary now when it wasn't
2. it breaks compatibility with older firewall scripts.
I ran against that when migrating a larger firewall rule
set from freebsd 4.x to 6.x. That line worked quite
nicely in freebsd 4.x. (don't know about 5.x)
So I suggest fixing it, or, at least, document the problem
in the man page.
More information about the freebsd-bugs