docs/59835: ipfw(8) man page does not warn about accepted but meaningless rules

[Eugene Grosbein]

>Number:         59835
>Category:       docs
>Synopsis:       ipfw(8) man page does not warn about accepted but meaningless rules
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-doc
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          doc-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 30 05:50:20 PST 2003
>Closed-Date:
>Last-Modified:
>Originator:     Eugene Grosbein
>Release:        FreeBSD 4.9-STABLE i386
>Organization:
Svyaz Service JSC
>Environment:
System: FreeBSD grosbein.pp.ru 4.9-STABLE FreeBSD 4.9-STABLE #2: Tue Nov 25 23:13:47 KRAT 2003 eu at grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386
	IPFW2

>Description:
	
	ipfw2 accepts rules like this:
	
	divert 10000 ip from any to any via fxp0 MAC 00:90:27:a7:5c:72 any

	But this rules will never match a packet. And ipfw(8) man page
	mentiones this nowhere. Yes, it says something:

/* quote start */
     Note that as packets flow through the stack, headers can be stripped or
     added to it, and so they may or may not be available for inspection.
     E.g., incoming packets will include the MAC header when ipfw is invoked
     from ether_demux(), but the same packets will have the MAC header
     stripped off when ipfw is invoked from ip_input().

     Also note that each packet is always checked against the complete rule-
     set, irrespective of the place where the check occurs, or the source of
     the packet.  If a rule contains some match patterns or actions which are
     not valid for the place of invocation (e.g. trying to match a MAC header
     within ip_input() ), the match pattern will not match, but a not operator
     in front of such patterns will cause the pattern to always match on those
     packets.
/* quote stop */

	However, man page does not say that divertion will occur when
	ipfw is invoked from ip_input().

>How-To-Repeat:

	See description. I needed to count and divert unicast-only packets
	to an application, tried to use mentioned rule and failed.
	I'm forced to rewrite it as a set of three rules (count,
	skip broadcast and divert) but it took some time to understand
	what's going wrong.

>Fix:

	Correct ipfw(8) man page. It should clearly state that divert
	can never be used with layer2 packets.

Eugene Grosbein
>Release-Note:
>Audit-Trail:
>Unformatted: