From nobody Fri Apr 28 06:02:37 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q727x5HJdz48299; Fri, 28 Apr 2023 06:02:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Q727x4RPVz4CyM; Fri, 28 Apr 2023 06:02:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682661757; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tX2pm+4OJijv/1BxXjUOG/FxAsubjPMb/IX4RD4p4fg=; b=gaji0ibPxIScYPdyKm8xXCJLqII14UI8+8GbKO1mz6O79r3+Nr4YrKbUjlJxb7TOV7qlXW 7UPi6O/HWxS9PpVIsuK98FT1KYbw5YEOgEZoS24CFInHUzeJju8Em+06rQaUVwzVzT34dv dWGtWMz4Oq7pTLGYXXeTaUXWSzMvgU1bn6eWTZb3emUXACAM69VSYl0ERzCimKKYmUYgGq SM+fip3IajTy81qMB6WEc4i0g8nYmRoaUyan0QiaLKYLSsygqUBXekp8ENPSy6siaOy9tE nE0udSc+OaltAxcmJuoOlcxu1h5LFX9llGwtZ0HnMBqiEhMJN/GGLyB3mK/tDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682661757; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tX2pm+4OJijv/1BxXjUOG/FxAsubjPMb/IX4RD4p4fg=; b=RKmDgkMCuLH5z0uDVhNkfUKC/xxNiupPNpBIYa+s1Ml1UcF54cjKWZ6q1K5HOEKqc4VsPD HsPJSpswQ5JQD8ovjSReGTZqSOyj5B2H5HHDryd4cyLKwavGWPpfP/5EvRuJxOG06ASo0t bNyTbsAgy3oVLoNVRS7MMVI2ZZqi6ReA4tioL3OgJvfXThzHXVG3ipBxGbJ/WrZvy6tC15 9Lg5glxKMsmfQFQOmPrZeb6pBig3Mi/xplefZcmDpKoFSsdpTX3KWE2vNK98aQRM3MdBea YlxpDhBRGtmBuGYGH3+KOjlWK4KH5gHQNCseSoGOtJfwuWnR/1HyI/B4HaMvJg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1682661757; a=rsa-sha256; cv=none; b=IiEAz3O8Hqy1xHuTGGe5hm0DL015k171leTcrGtitUS4gaEzhlIVHw5wzGHArfXEoKoAih p+0GOzYi2A6+zsM1RCtyWh3iIi0RWU1TL2lTTo3rlFODyAHX7BW4Ym7gNryhqAx36EZrmo VIWqTfJukYjfllQl6YIMu4hWgpVemaXzaczqEq/MB0c5JYmPg83hD4rz17iX9iBE1DcIjJ M1Y5Bn22Apo4fAS8VLOmyILKSk/tjXaZUPFEmFYUytkmb46Fo8/OI2ZQJXncT9Sg34XHi5 mNijplRzFex2x3P4/u9SFPoEkczu6h9F5ilFkmG/b3oXr7ZCsAdCuookN2eP9Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Q727x3VZmzp5c; Fri, 28 Apr 2023 06:02:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33S62b98036931; Fri, 28 Apr 2023 06:02:37 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33S62b7x036930; Fri, 28 Apr 2023 06:02:37 GMT (envelope-from git) Date: Fri, 28 Apr 2023 06:02:37 GMT Message-Id: <202304280602.33S62b7x036930@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: dffde5aa070b - stable/12 - ipfw.8: MFC: improve description for interface matching List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: dffde5aa070b0a473a06441c50dc8c796436a7fc Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=dffde5aa070b0a473a06441c50dc8c796436a7fc commit dffde5aa070b0a473a06441c50dc8c796436a7fc Author: Eugene Grosbein AuthorDate: 2023-04-25 11:12:11 +0000 Commit: Eugene Grosbein CommitDate: 2023-04-28 06:02:17 +0000 ipfw.8: MFC: improve description for interface matching The manual describes "if*" form only while kernel uses fnmatch(3) and allows use for more versatile shell-like patterns. Note that explicitly and provide an example. (cherry picked from commit 9f5dc374d0dadb6947a9bd9ff8ff44931e1b6422) --- sbin/ipfw/ipfw.8 | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index ba477f379532..512ad5baf90e 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1,7 +1,7 @@ .\" .\" $FreeBSD$ .\" -.Dd June 14, 2021 +.Dd April 25, 2023 .Dt IPFW 8 .Os .Sh NAME @@ -1896,13 +1896,24 @@ However, this option doesn't imply an implicit .Cm check-state in contrast to .Cm keep-state . -.It Cm recv | xmit | via Brq Ar ifX | Ar if Ns Cm * | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any +.It Cm recv | xmit | via Brq Ar ifX | Ar ifmask | Ar table Ns Po Ar name Ns Oo , Ns Ar value Oc Pc | Ar ipno | Ar any Matches packets received, transmitted or going through, respectively, the interface specified by exact name .Po Ar ifX Pc , -by device name -.Po Ar if* Pc , +by device mask +.Po Ar ifmask Pc , by IP address, or through some interface. +.Pp +Interface +name may be matched against +.Ar ifmask +with +.Xr fnmatch 3 +according to the rules used by the shell (f.e. tun*). +See also the +.Sx EXAMPLES +section. +.Pp Table .Ar name may be used to match interface by its kernel ifindex. @@ -4185,6 +4196,12 @@ of clients, as below: .Dl "ipfw add deny ip from ${badguys} to any" .Dl "... normal policies ..." .Pp +Allow any transit packets coming from single vlan 10 and +going out to vlans 100-1000: +.Pp +.Dl "ipfw add 10 allow out recv vlan10 \e" +.Dl "{ xmit vlan1000 or xmit \*qvlan[1-9]??\*q }" +.Pp The .Cm verrevpath option could be used to do automated anti-spoofing by adding the @@ -4708,6 +4725,7 @@ can be changed in a similar way as for .Sh SEE ALSO .Xr cpp 1 , .Xr m4 1 , +.Xr fnmatch 3 , .Xr altq 4 , .Xr divert 4 , .Xr dummynet 4 ,