cvs commit: src/sbin/ipfw ipfw2.c

Luigi Rizzo rizzo at
Fri Sep 5 09:35:33 PDT 2003

On Fri, Sep 05, 2003 at 01:28:11PM -0300, Daniel C. Sobral wrote:
> Luigi Rizzo wrote:
> > On Tue, Sep 02, 2003 at 03:36:41AM -0700, Maxim Konovalov wrote:
> > ...
> > 
> >>  # We need a regression test suit for ipfw(2)/ipfw(8) badly.
> > 
> > 
> > indeed. This is also why i introduced the '-n' flag so one can
> > implement it in an easier way. I do have some scripts for that,
> > but at the moment they only test the program's output
> > with correct arguments :(
> So let me take this opportunity to mention that that thingy I asked 
> where you would specify protocol/addresses/ports/flags and it would 
> indicate which rule that would have triggered (or rules, if processing 
> continues) would make it possible to do all sorts of regression testing 
> of ipfw features. :-)

i think the only reasonable way to implement it is to
generate the actual packet and inject it to the kernel where it is
filtered thorugh ip_fw_chk().

Now, the kernel part should not be too hard (basically have a new
ioctl that calls ip_fw_chk()) but the userland part is somewhat
boring to write... i wonder if there is some other tool that
can produce custom packets from a spec...

also this would only test the kernel part, not the userland part
(the parser is historically the part where the most bugs have
been found).

and finally, packets have side effects (e.g. create stateful
entries, increment counters, etc.) so i am bit unsure on how
clean is this approach.


> -- 
> Daniel C. Sobral                   (8-DCS)
> Gerencia de Operacoes
> Divisao de Comunicacao de Dados
> Coordenacao de Seguranca
> VIVO Centro Oeste Norte
> Fones: 55-61-313-7654/Cel: 55-61-9618-0904
> E-mail: Daniel.Capo at
>          Daniel.Sobral at
>          dcs at
> Outros:
> 	dcs at
> 	dcs at
> 	capo at
> I get up each morning, gather my wits.
> Pick up the paper, read the obits.
> If I'm not there I know I'm not dead.
> So I eat a good breakfast and go back to bed.
> Oh, how do I know my youth is all spent?
> My get-up-and-go has got-up-and-went.
> But in spite of it all, I'm able to grin,
> And think of the places my get-up has been.
> 		-- Pete Seeger
> _______________________________________________
> cvs-all at mailing list
> To unsubscribe, send any mail to "cvs-all-unsubscribe at"

More information about the cvs-src mailing list