cvs commit: src/sys/netinet ip_fw.h ip_fw2.c

[Andre Oppermann]

andre       2004/04/23 07:27:27 PDT

  FreeBSD src repository

  Modified files:
    sys/netinet          ip_fw.h ip_fw2.c 
  Log:
  Add the option versrcreach to verify that a valid route to the
  source address of a packet exists in the routing table.  The
  default route is ignored because it would match everything and
  render the check pointless.
  
  This option is very useful for routers with a complete view of
  the Internet (BGP) in the routing table to reject packets with
  spoofed or unrouteable source addresses.
  
  Example:
  
   ipfw add 1000 deny ip from any to any not versrcreach
  
  also known in Cisco-speak as:
  
    ip verify unicast source reachable-via any
  
  Reviewed by:    luigi
  
  Revision  Changes    Path
  1.84      +1 -0      src/sys/netinet/ip_fw.h
  1.57      +31 -7     src/sys/netinet/ip_fw2.c