misc/147720: ipfw dynamic rules and fwd

[Dmitriy Demidov]

>Number:         147720
>Category:       misc
>Synopsis:       ipfw dynamic rules and fwd
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 09 12:30:04 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Dmitriy Demidov
>Release:        FreeBSD 7-STABLE
>Organization:
>Environment:
FreeBSD evo.local.home 7.3-PRERELEASE FreeBSD 7.3-PRERELEASE #0: Sat Feb 20 22:57:09 EET 2010 root at evo.local.home:/usr/obj/usr/src/sys/STABLE i386
>Description:
There is one bug with ipfw keep-state rules and fwd action.

You are unable to make source based routing of incoming connections using this ruleset:

=======
# $ext_if1 - ISP1
# $gw1 - ISP1 GW
# $ext_if2 - ISP2
# $gw2 - ISP2 GW
# $int_if - internal net

ipfw add 100 skipto 300 tag 1 in recv $ext_if1 keep-state
ipfw add 200 skipto 300 tag 2 in recv $ext_if2 keep-state
ipfw add 300 allow { recv $ext_if1 or recv $ext_if2 }
ipfw add 400 allow in recv $int_if
ipfw add 500 fwd $gw1 tagged 1
ipfw add 600 fwd $gw2 tagged 2
=======


To make it working you should patch /sys/netinet/ipfw/ip_fw2.c with this:

====
(find this line)
if (!q || dyn_dir == MATCH_FORWARD)

(change it to this)
if (sa->sin_port && (!q || dyn_dir == MATCH_FORWARD))
====



This problem is presend in FreeBSD 9-CURRENT as well.


Can somebody please merge this patch to CURRENT?


Credits for this patch goes to Vadim Goncharov 
nuclight.livejournal.com/124348.html
>How-To-Repeat:
have FreeBSD host with two NIC's connected to different networks with different GW each. Applay ipfw rules from example provided. Start some service (SSH/Apache/etc). Make a try to connect to connect to service from network behing GW that is not configured as default gateway on FreeBSD host - answer will go via second NIC/default GW. keep-state ruleset do not works.
>Fix:
applay patch

>Release-Note:
>Audit-Trail:
>Unformatted: