bin/131558: Inconsistent "via" ipfw behavior

[Borja Marcos]

>Number:         131558
>Category:       bin
>Synopsis:       Inconsistent "via" ipfw behavior
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Feb 10 12:40:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Borja Marcos
>Release:        7.1
>Organization:
>Environment:
FreeBSD host.sare.net 7.1-RELEASE-p1 FreeBSD 7.1-RELEASE-p1 #8: Mon Jan 12 11:23:00 GMT 2009     root at host.sare.net:/usr/obj/usr/src/sys/KERNEL  amd64


>Description:
Two issues with ipfw.

1) It would be very useful to allow an interface list to be passed as a parameter to the "via" rule option, something like

ipfw add deny whatever from this to that via interface,anotherinterface

It would be useful and consistent with the possibility of specifying a list of IP addresses separated by commas.

2) There is actually a bug. If I try to specify a rule with multiple interfaces, say,
ipfw add 10 deny icmp from any to me in via bge0,bge1

ipfw doesn't return an error, "ipfw list" shows that the rule has been loaded as expected,
00010 deny icmp from any to me in via bge0,bge1

But the rule doesn't work. Maybe it would interpret the interfaces list as an AND list, instead of an OR?



>How-To-Repeat:
See the example. Creating a rule that specifies a list of interfaces in the "via" option of the ipfw command.

It can be seen that the rule is accepted but it doesn't work.


>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: