Attachment #70964 for bug #103454

View | Details | Raw Unified | Return to bug 103454
Collapse All | Expand All

Lines 822-827 Link Here

(-)sbin/ipfw/ipfw.8 (+5 lines)
822	and	822	and
823	.Cm ngtee	823	.Cm ngtee
824	actions.	824	actions.
		825	.It Cm setdf Ar value
		826	Changes
		827	.Cm DF
		828	bit of the IP packet.
		829	Value may be 0 (May Fragment) or 1 (Don't Fragment).
825	.El	830	.El
826	.Ss RULE BODY	831	.Ss RULE BODY
827	The body of a rule contains zero or more patterns (such as	832	The body of a rule contains zero or more patterns (such as

Lines 247-253 Link Here

(-)sbin/ipfw/ipfw2.c (-2 / +22 lines)
247	TOK_RESET,	247	TOK_RESET,
248	TOK_UNREACH,	248	TOK_UNREACH,
249	TOK_CHECKSTATE,	249	TOK_CHECKSTATE,
250		250	TOK_SETDF,
		251
251	TOK_ALTQ,	252	TOK_ALTQ,
252	TOK_LOG,	253	TOK_LOG,
253	TOK_TAG,	254	TOK_TAG,
Lines 374-379 Link Here
374	{ "unreach6", TOK_UNREACH6 },	375	{ "unreach6", TOK_UNREACH6 },
375	{ "unreach", TOK_UNREACH },	376	{ "unreach", TOK_UNREACH },
376	{ "check-state", TOK_CHECKSTATE },	377	{ "check-state", TOK_CHECKSTATE },
		378	{ "setdf", TOK_SETDF },
377	{ "//", TOK_COMMENT },	379	{ "//", TOK_COMMENT },
378	{ NULL, 0 } /* terminator */	380	{ NULL, 0 } /* terminator */
379	};	381	};
Lines 1555-1560 Link Here
1555	}	1557	}
1556	break;	1558	break;
1557		1559
		1560	case O_SET_IPDF:
		1561	PRINT_UINT_ARG("setdf ", cmd->arg1);
		1562	break;
		1563
1558	case O_LOG: /* O_LOG is printed last */	1564	case O_LOG: /* O_LOG is printed last */
1559	logptr = (ipfw_insn_log *)cmd;	1565	logptr = (ipfw_insn_log *)cmd;
1560	break;	1566	break;
Lines 2635-2641 Link Here
2635	"RULE-BODY: check-state [PARAMS] \| ACTION [PARAMS] ADDR [OPTION_LIST]\n"	2641	"RULE-BODY: check-state [PARAMS] \| ACTION [PARAMS] ADDR [OPTION_LIST]\n"
2636	"ACTION: check-state \| allow \| count \| deny \| unreach{,6} CODE \|\n"	2642	"ACTION: check-state \| allow \| count \| deny \| unreach{,6} CODE \|\n"
2637	" skipto N \| {divert\|tee} PORT \| forward ADDR \|\n"	2643	" skipto N \| {divert\|tee} PORT \| forward ADDR \|\n"
2638	" pipe N \| queue N\n"	2644	" pipe N \| queue N \| setdf DF\n"
2639	"PARAMS: [log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n"	2645	"PARAMS: [log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n"
2640	"ADDR: [ MAC dst src ether_type ] \n"	2646	"ADDR: [ MAC dst src ether_type ] \n"
2641	" [ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n"	2647	" [ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n"
Lines 3970-3975 Link Here
3970	action->opcode = O_COUNT;	3976	action->opcode = O_COUNT;
3971	break;	3977	break;
3972		3978
		3979	case TOK_SETDF:
		3980	{
		3981	int df;
		3982
		3983	NEED1("need setdf arg\n");
		3984	df = strtoul(*av, NULL, 0);
		3985	if (df < 0 \|\| df > 1)
		3986	errx(EX_DATAERR, "illegal argument for %s",
		3987	*(av - 1));
		3988	fill_cmd(action, O_SET_IPDF, 0, df);
		3989	ac--; av++;
		3990	}
		3991	break;
		3992
3973	case TOK_QUEUE:	3993	case TOK_QUEUE:
3974	action->opcode = O_QUEUE;	3994	action->opcode = O_QUEUE;
3975	goto chkarg;	3995	goto chkarg;

Lines 160-165 Link Here

(-)sys/netinet/ip_fw.h (+2 lines)
160	O_TAG, /* arg1=tag number */	160	O_TAG, /* arg1=tag number */
161	O_TAGGED, /* arg1=tag number */	161	O_TAGGED, /* arg1=tag number */
162		162
		163	O_SET_IPDF, /* arg1=[0\|1] */
		164
163	O_LAST_OPCODE /* not an opcode! */	165	O_LAST_OPCODE /* not an opcode! */
164	};	166	};
165		167




				goto done;
			}

			case O_SET_IPDF:
				switch (cmd->arg1) {
					case 0:
						ip->ip_off &= ~IP_DF;
						break;
					case 1:
						ip->ip_off |= IP_DF;
						break;
					default:
						break;
				}
				f->pcnt++;
				f->bcnt += pktlen;
				f->timestamp = time_second;
				goto next_rule;

			case O_COUNT:
			case O_SKIPTO:
				f->pcnt++;	/* update stats */

				goto bad_size;
			break;

		case O_SET_IPDF:
			have_action = 1;
			break;

		case O_UID:
		case O_GID:
		case O_JAIL:

Return to bug 103454

Lines 3127-3132 Link Here

(-)sys/netinet/ip_fw2.c (+20 lines)
3127	goto done;	3127	goto done;
3128	}	3128	}
3129		3129
		3130	case O_SET_IPDF:
		3131	switch (cmd->arg1) {
		3132	case 0:
		3133	ip->ip_off &= ~IP_DF;
		3134	break;
		3135	case 1:
		3136	ip->ip_off \|= IP_DF;
		3137	break;
		3138	default:
		3139	break;
		3140	}
		3141	f->pcnt++;
		3142	f->bcnt += pktlen;
		3143	f->timestamp = time_second;
		3144	goto next_rule;
		3145
3130	case O_COUNT:	3146	case O_COUNT:
3131	case O_SKIPTO:	3147	case O_SKIPTO:
3132	f->pcnt++; /* update stats */	3148	f->pcnt++; /* update stats */
Lines 3654-3659 Link Here
3654	goto bad_size;	3670	goto bad_size;
3655	break;	3671	break;
3656		3672
		3673	case O_SET_IPDF:
		3674	have_action = 1;
		3675	break;
		3676
3657	case O_UID:	3677	case O_UID:
3658	case O_GID:	3678	case O_GID:
3659	case O_JAIL:	3679	case O_JAIL: