Could you have a look at kern/63961

[Andre Oppermann]

Christian,

thanks for your quick response.  Could you please take over the PR
and get directly in touch with the Originator.

-- 
Andre


"Christian S.J. Peron" wrote:
> 
> Hey Andre,
> 
> I took a quick look at the PR and I dont think this is a bug.
> If you want to match setup packets for TCP connections it
> does work, but only if the connection has a PCB associated with it.
> For instance, outgoing setup would have a PCB associated with it,
> so ipfw could match on that:
> 
> dev0# ipfw show
> 00400     1      64 count tcp from any to any dst-port 4296 setup uid csjp
> 
> It should be noted that all the "setup" keyword does is set the
> O_TCPFLAGS opcode and set the operand to TH_SYN for SYN packets.
> I dont think Incoming TCP connection requests would not have a
> PCB associated with it, so there is no-way that ipfw can look
> up the credential associated with it.
> 
> However the UID negation problem looks like it could be a bug
> either in how ipfw(8) reports the rule or how the kernel is
> processing it. In either case I will look into it.
> 
> --
> Christian S.J. Peron
> csjp at FreeBSD.ORG
> FreeBSD Committer