svn commit: r248552 - in head: sbin/ipfw sys/netinet sys/netpfil/ipfw

Andriy Gapon avg at FreeBSD.org
Sun Mar 31 20:51:00 UTC 2013


on 20/03/2013 12:35 Alexander V. Chernikov said the following:
> Author: melifaro
> Date: Wed Mar 20 10:35:33 2013
> New Revision: 248552
> URL: http://svnweb.freebsd.org/changeset/base/248552
> 
> Log:
>   Add ipfw support for setting/matching DiffServ codepoints (DSCP).
>   
>   Setting DSCP support is done via O_SETDSCP which works for both
>   IPv4 and IPv6 packets. Fast checksum recalculation (RFC 1624) is done for IPv4.
>   Dscp can be specified by name (AFXY, CSX, BE, EF), by value
>   (0..63) or via tablearg.
>   
>   Matching DSCP is done via another opcode (O_DSCP) which accepts several
>   classes at once (af11,af22,be). Classes are stored in bitmask (2 u32 words).
[snip]
> Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c
> ==============================================================================
> --- head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed Mar 20 09:56:20 2013	(r248551)
> +++ head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed Mar 20 10:35:33 2013	(r248552)
> @@ -671,6 +671,10 @@ check_ipfw_struct(struct ip_fw *rule, in
>  		case O_IPID:
>  		case O_IPTTL:
>  		case O_IPLEN:
> +		case O_DSCP:
> +			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
> +				goto bad_size;
> +			break;
>  		case O_TCPDATALEN:
>  		case O_TCPWIN:
>  		case O_TAGGED:

Could you please double-check this part of the change?
Handling of the new O_DSCP opcode is inserted in the middle of the long
fall-through list of cases and thus it modifies behavior of the preceding cases.
The commit message does not say anything about that.

I've just done my bi-monthly release/upgrade and ipfw now chokes on my ruleset.
There is the following message in system log:
kernel: ipfw: opcode 0 size 8 wrong
Offending rule seems to be:
allow ip from any to any via tun*

Reverting this commit fixes the problem.
Thank you.
-- 
Andriy Gapon


More information about the svn-src-head mailing list