kern/176503: [ipfw] ipfw layer2 problem

[Ian Smith]

The following reply was made to PR kern/176503; it has been noted by GNATS.

From: Ian Smith <smithi at nimnet.asn.au>
To: bug-followup at FreeBSD.org, freebsd at heron.pl
Cc:  
Subject: Re: kern/176503: [ipfw] ipfw layer2 problem
Date: Wed, 19 Jun 2013 01:34:58 +1000

   > net.link.ether.ipfw=1
 
   > 1000 allow ip from any to any layer2 in MAC any any
 
 You don't show the next rule mentioned, but with net.link.ether.ipfw=1 
 (and not bridging) the packet traverses the ruleset up to four times. 
 Your rule 1000 accepts the packet when invoked from ether_demux.  When 
 the packet (thus) gets to ip(6)_input the ruleset is run again at layer 
 3 (IP), which rule 1000 does not match.  It may match any next rule that 
 is not explicitly layer2.  You'll similarly need to pass layer2 packets 
 going 'out', after passing them at layer3.
 
 man ipfw
 /PACKET FLOW
 
 cheers, Ian