kern/111121: After the latest changes ipfw2 complains: "ipfw: opcode 50 size 2 wrong"

[Jukka A. Ukkonen]

>Number:         111121
>Category:       kern
>Synopsis:       After the latest changes ipfw2 complains: "ipfw: opcode 50 size 2 wrong"
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 02 05:40:04 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Jukka A. Ukkonen
>Release:        FreeBSD 6.2-STABLE (2007-04-01)
>Organization:
private
>Environment:
FreeBSD mjolnir 6.2-STABLE FreeBSD 6.2-STABLE #0: Sun Apr  1 16:59:00 EET DST 2007     root at mjolnir:/usr/obj/usr/src/sys/Mjolnir  i386
>Description:
After the latest updates to ipfw2 it has started complaining
"ipfw: opcode 50 size 2 wrong"
Apparently this also causes the rest of the rules to be rejected starting
from the rule triggering the opcode error.

As a side effect one firewall instance that has been using ipfw2 has stopped
passing packets out through it internal interface, because the rules allowing
the internal transmissions are no longer loaded.

If I counted correctly the opcodes in the header file,
opcode 50 corresponds to the "pipe" rules.

In the ipfw2 instance in which the problem was found there are only a few
pipe related rules...

pipe 100 config bw 512kbit/s
pipe 101 config bw 128Kbit/s
add 04500 pipe 101 tcp from SLOWLANE to any 80,443 
add 65533 pipe 100 tcp from any 80,443 to SLOWLANE

It seems that ipfw gives up when trying the rule 04500.

The SLOWLANE in capital letters is a macro which expands to "table(13)".
This table is intended to hold a dynamically adjustable list of bandwidth
hog internal addresses. Initially it is an empty table.


>How-To-Repeat:
Try enough rules triggering opcode 50 (pipe) I guess.

>Fix:
None yet.
>Release-Note:
>Audit-Trail:
>Unformatted: