One OR MORE of source and destination addresses?

[Bill Moran]

Mark <admin at asarian-host.net> wrote:

> Mark wrote:
> 
> > Bill Moran wrote:
> >
> >> How about using skipto instead of allow?  Thus, if it passes the
> >> first one, it can just skipto the next rule to be checked.  i.e.:
> >>
> >> ipfw add 11 skipto 12 tcp from any to me 25 setup limit dst-addr 32
> >> ipfw add 12 allow tcp from any to me 25 setup limit src-addr 4
> >>
> >> Thus, if rule 11 pases, it skips to rule 12.  If it fails, it should
> >> reject as always.  The end result is that a packet _must_ pass both
> >> rules to be allowed.
> >
> > I spoke too soon. :( It seems this sort of rules evokes a bug:
> >
> > http://lists.freebsd.org/pipermail/freebsd-ipfw/2004-April/001084.html
> >
> > My whole console is flooded with messages like these:
> >
> >     "ipfw: install_state: entry already present, done"
> >
> > Is there a known patch?
> 
> I just took a look at the code:
> 
>  if (q != NULL) { /* should never occur */
>   if (last_log != time_second) {
>    last_log = time_second;
>    printf("ipfw: install_state: entry already present, done\n");
>   }
>   return 0;
>  }
> 
> What if I just hack the "printf ..." line out of there? Would that 'solve'
> it? I know it's dirty; but would things still work?

Theoretically, yes (note that I'm certainly no expert on this chunk of
code)  My reason for saying yes is:
1) The error seems to be that IPFW is trying to add the same stateful
   rule twice ... which means it _did_ get successfully added once.
2) When that condition occurs, the function returns 0.  The comment at
   the top of the file states that the function returns 1 on failure,
   so it would appear that this condition is still considered successful.

-- 
Bill Moran
Potential Technologies
http://www.potentialtech.com