From nobody@FreeBSD.org  Thu Nov 20 20:10:50 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3BCF11065675
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 20 Nov 2008 20:10:50 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 27F2D8FC1B
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 20 Nov 2008 20:10:50 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id mAKKAnZP003708
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 20 Nov 2008 20:10:49 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id mAKKAnxY003707;
	Thu, 20 Nov 2008 20:10:49 GMT
	(envelope-from nobody)
Message-Id: <200811202010.mAKKAnxY003707@www.freebsd.org>
Date: Thu, 20 Nov 2008 20:10:49 GMT
From: Eugen Konkov <kes-kes@yandex.ru>
To: freebsd-gnats-submit@FreeBSD.org
Subject: IPFW improvements
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         129024
>Category:       docs
>Synopsis:       [patch] ipfw(8) improvements
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    keramida
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 20 20:20:01 UTC 2008
>Closed-Date:    
>Last-Modified:  Tue Jan 27 00:02:20 UTC 2009
>Originator:     Eugen Konkov
>Release:        7.1-BETA
>Organization:
ISP Konkov
>Environment:
FreeBSD home.kes.net.ua 7.1-BETA FreeBSD 7.1-BETA #0: Sun Sep  7 13:49:18 UTC 2008     root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
     divert port
	     Divert packets that match this rule to the divert(4) socket bound
-	     to port port.  The search terminates.
+	     to port port.  The search terminates. however,
+	     on exit from the pipe and if the sysctl(8) variable
+	     net.inet.ip.fw.one_pass is not set, the packet is passed again to
+            the firewall code starting from the next rule.

     fwd | forward ipaddr | tablearg[,port]
	     Change the next-hop on matching packets to ipaddr, which can be
	     an IP address or a host name.  The next hop can also be supplied
	     by the last table looked up for the packet by using the tablearg
	     keyword instead of an explicit address.  The search terminates if
-	     this rule matches.
+	     this rule matches. however,
+	     on exit from the pipe and if the sysctl(8) variable
+	     net.inet.ip.fw.one_pass is not set, the packet is passed again to
+            the firewall code starting from the next rule.


-----------------

-     addr: [not] {any | me | me6 | table(number[,value]) | addr-list |
-             addr-set}
+     addr: [not] {any | me | me6 | iface | table(number[,value]) | addr-list |
+             addr-set}

     any     matches any IP address.

-     me      matches any IP address configured on an interface in the system.
+     me      matches any IP address configured on any interface in the system.

     me6     matches any IPv6 address configured on an interface in the sys-
             tem.  The address list is evaluated at the time the packet is an-
             alysed.

+     iface   where iface is interface on system. In this case
+             addresses configures only on this interface will match

------------------

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-doc 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Nov 20 22:40:32 UTC 2008 
Responsible-Changed-Why:  
Reclassify. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=129024 
Responsible-Changed-From-To: freebsd-doc->keramida 
Responsible-Changed-By: keramida 
Responsible-Changed-When: Tue Jan 27 00:01:56 UTC 2009 
Responsible-Changed-Why:  
Parts of this look interesting.  I'll take care of that. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=129024 
>Unformatted:
