cvs commit: src/sbin/ipfw ipfw2.c

[Christian S.J. Peron]

csjp        2004-09-11 19:44:29 UTC

  FreeBSD src repository

  Modified files:
    sbin/ipfw            ipfw2.c 
  Log:
  Currently when ipfw(8) generates the micro-instructions for rules which
  contain O_UID, O_GID and O_JAIL opcodes, the F_NOT or F_OR logical
  operator bits get clobbered. Making it impossible to use the ``NOT'' or
  ``OR'' operators with uid, gid and jail based constraints.
  
  The ipfw_insn instruction template contains a ``len'' element which
  stores two pieces of information, the size of the instruction
  (in 32-bit words) in the low 6 bits of "len" with the 2 remaining
  bits to implement OR and NOT.
  
  The current code clobbers the OR and NOT bits by initializing the
  ``len'' element to the size, rather than OR'ing the bits. This change
  fixes this by changing the initialization of cmd->len to an OR operation
  for the O_UID, O_GID and O_JAIL opcodes.
  
  This may be a MFC candidate for RELENG_5.
  
  Reviewed by:    andre
  Approved by:    luigi
  PR:             kern/63961 (partially)
  
  Revision  Changes    Path
  1.58      +3 -3      src/sbin/ipfw/ipfw2.c