ipfw: Add "me4" to refer to the host's IPv4 address only in add_src() and add_dst().
Also, don't assume that !IPv6 is IPv4.
Submitted by: Neel Chauhan <neel AT neelc DOT org>
Differential D24021
ipfw: Add me4 as to refer to an host's IPv4 address in add_src() and add_dst(). nc on Mar 11 2020, 1:48 AM. Authored by
Details
Diff Detail
Event TimelineComment Actions Does this mean that for a current dual stack IPFW rule like: allow tcp from any to me 443 It will only match for IPv4 packets, as "me" is only working with IPv4 addresses under the hood with the current behavior? I would really be a backer to fixing this properly so that "me" both matches "me4" and "me6" address families. This comment was removed by driesm.michiels_gmail.com. Comment Actions Adding me4 as an explicit ipv4 keyword is a good idea. Comment Actions Thank you! Looks good, please see some comments inline.
Comment Actions As long as it doesn't break existing rulesets :-). After this patch, will "me" still match both "me4" and "me6"? Comment Actions Here is the updated diff. Here are the few changes:
I am still using rc.firewall in the tests, primarily so I don't mess around with configuring the firewall myself.
Comment Actions I do not see how this makes any difference between the values me, me4 and me6. There still only appears to be one class of opcode, O_IP_{SRC,DST}_ME. Is that the intent?
Comment Actions Makes complete sense. I just consolidated into one "if" statement, and removed the IPv4 code from ipv6.c. Comment Actions Note: I did some testing and the patch does not work as intended. "me4" also blocks IPv6, so I'm rewriting it.
Comment Actions What I meant is that "me4" also takes action on IPv6, it does not "block" it. The "block" means I tested with "deny". I was in a rush to write a comment, sorry. I have a patch which fixes this, but it uses new kernel opcodes. It will be posted soon. Comment Actions In this patch, "me4" is IPv4-only and "me" is dual-stack. It uses kernel opcodes, however. Comment Actions Please go read my comment #1. I'll review this if I get time, but this is what is needed as far as opcodes to make me4 and me6 different Comment Actions O_IP_SRC_ME/O_IP_DST_ME is dual-stack. In sys/netpfil/ipfw/ip_fw2.c, O_IP_SRC_ME/O_IP_DST_ME currently falls down to the IPv6 case. My new opcodes O_IP_SRC_ME4/O_IP_DST_ME4 prevent it from doing so for the new ones, while existing O_IP_SRC_ME/O_IP_DST_ME can function normally. In the said file, there is a variable is_ipv4 which skips IPv6, but didn't know how to get there from ipfw(8) so that's the reason I added opcodes. Comment Actions Ah, if you can leave a comment at those lines to guide the innocent reader, I'm fine. Comment Actions It appears that this needs to be rebased. The current patch doesn't apply on latest main.
|