From nobody Fri Apr 28 05:52:39 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q71wS0ck1z481kP; Fri, 28 Apr 2023 05:52:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Q71wS09jBz4CYm; Fri, 28 Apr 2023 05:52:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682661160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GpgxVlu8cegnskMmhQ5QgdG0a37Q+5CkN194s83TCP0=; b=xzMQE2VC4PB9/tHZD8HvzZMIKdQCY1k8vEvk6Wy20fLn/eaxw32nm/2gzGJ1LUpFpaBDJs DfHRSKfQQMynG1aOyR89ubBG+p3QHFmkNF2mqOxRl7aLfqaOrxs0zi67la8z4t3yLZkJ77 7H+zrxwlUKSfJ0+w4VtRyzA0QXYl6JZz2p6C+dMVFvKFIATw3vINjE3s0SPRcFirECIhu8 oZJcoD0xic1fVn8OaTjdnagxEMsS9fshLb1sA6ZVYIh1XxPOmaqkeWbtlvxIMFjGqk3BVI 0Et3QNmU9HIGoVN0hb8qNff4QHTxFRKrPAALA/P/Qn1HiktS9QWCkjZRXQeNeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682661160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GpgxVlu8cegnskMmhQ5QgdG0a37Q+5CkN194s83TCP0=; b=l5rw4Q+HSRvhTNY2f5i4JGbEqfS5Akei3eF9ohP2EPChilZbVnbuUlzKlTPMCPJGZpoEzJ mK1ZvYdPObQQIFwoeAKX6M2QC5dFggptTlvk580m5HZd/ISV3yw/rqdChPxzdftBVPLqXr zyKkgjRrDsO3b9KA2uukfT0bDoU1fH2KcfJjLP7vfXuCYh/Vc3r91nzIPg7A/T6XhdoJ5q IvJDt6aJz5BghZ/FrG0EmEB5i8jwWRL2vZcLk+jIsdGEqpt4aqEijTOIMZF4pdBHiGwZ6Y lqMdTeq2gDl/dmYvgN3Ls+IV4RKBHs846SuzHXnCOJkToyr5lEegfgUuwiHREQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1682661160; a=rsa-sha256; cv=none; b=r45+l2dRVJGPpde13s8uOiKYqZa3WJ5XVxJ1tMkvLMVJd6xLbDW8+YKNLXEvnvL4z/TDE7 Pi29jdd39OiSFPQP4VHwpEl/nkXtwTS7ZoEEllex6zPBYFmbZtiSECV/4F1fWIjF2D0huW ebVERv6hgPbD4V4d0XQi+OpqUiFs6I/KAUEf4o8HeyeU1jyPjsigkqRwSt1YhGpjZvhRgS aQ6mbFkUgkklZnmI7DR+znqr0K1bvXDqvRPugDtvLyVzPiRbUqpF+FIF+sNpVotoOw4hUT 5nYthWQJmRm0c0N4U/B1Ga+X3hPitzvJW9WGuhXiK2evg/z6GfUtgdlazECDyg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Q71wR6L7vzp2X; Fri, 28 Apr 2023 05:52:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33S5qdj1019484; Fri, 28 Apr 2023 05:52:39 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33S5qdB9019483; Fri, 28 Apr 2023 05:52:39 GMT (envelope-from git) Date: Fri, 28 Apr 2023 05:52:39 GMT Message-Id: <202304280552.33S5qdB9019483@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: f1c5c9353c0e - stable/13 - ipfw.8: MFC: improve description for interface matching List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: f1c5c9353c0ea70fcf058666fbbfa648ad3637c6 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=f1c5c9353c0ea70fcf058666fbbfa648ad3637c6 commit f1c5c9353c0ea70fcf058666fbbfa648ad3637c6 Author: Eugene Grosbein AuthorDate: 2023-04-25 11:12:11 +0000 Commit: Eugene Grosbein CommitDate: 2023-04-28 05:52:15 +0000 ipfw.8: MFC: improve description for interface matching The manual describes "if*" form only while kernel uses fnmatch(3) and allows use for more versatile shell-like patterns. Note that explicitly and provide an example. (cherry picked from commit 9f5dc374d0dadb6947a9bd9ff8ff44931e1b6422) --- sbin/ipfw/ipfw.8 | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 3c5308b29821..40299e70ed27 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1,7 +1,7 @@ .\" .\" $FreeBSD$ .\" -.Dd June 4, 2022 +.Dd April 25, 2023 .Dt IPFW 8 .Os .Sh NAME @@ -1912,13 +1912,24 @@ However, this option doesn't imply an implicit .Cm check-state in contrast to .Cm keep-state . -.It Cm recv | xmit | via Brq Ar ifX | Ar if Ns Cm * | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any +.It Cm recv | xmit | via Brq Ar ifX | Ar ifmask | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any Matches packets received, transmitted or going through, respectively, the interface specified by exact name .Po Ar ifX Pc , -by device name -.Po Ar if* Pc , +by device mask +.Po Ar ifmask Pc , by IP address, or through some interface. +.Pp +Interface +name may be matched against +.Ar ifmask +with +.Xr fnmatch 3 +according to the rules used by the shell (f.e. tun*). +See also the +.Sx EXAMPLES +section. +.Pp Table .Ar name may be used to match interface by its kernel ifindex. @@ -4217,6 +4228,12 @@ of clients, as below: .Dl "ipfw add deny ip from ${badguys} to any" .Dl "... normal policies ..." .Pp +Allow any transit packets coming from single vlan 10 and +going out to vlans 100-1000: +.Pp +.Dl "ipfw add 10 allow out recv vlan10 \e" +.Dl "{ xmit vlan1000 or xmit \*qvlan[1-9]??\*q }" +.Pp The .Cm verrevpath option could be used to do automated anti-spoofing by adding the @@ -4740,6 +4757,7 @@ can be changed in a similar way as for .Sh SEE ALSO .Xr cpp 1 , .Xr m4 1 , +.Xr fnmatch 3 , .Xr altq 4 , .Xr divert 4 , .Xr dummynet 4 ,