Bug 22065

Hello,

When using ipfw's dynamic stateful rules, while users CAN use the sysctl
variables to control expiration times globally, it cannot yet be done
on a rule-by-rule basis.  The patch below fixes this, adding the ability
to append "lifetime X" (where X is a number) to any keep-state rule.
For keep-state rules that do NOT append this new option, the old behavior
guided by the sysctl variables remains.  For those rules that add this
option, on a rule-by-rule basis the expiration time may be customized.

While writing these patches, I came across what LOOKS like a bug but
may not. In ip_fw.c, I noticed that both TCP and non-TCP keep-state
rules are updated using the net.inet.ip.fw_syn_lifetime where I
would think that non-TCP keep-state rules should instead be using
the net.inet.ip.fw.dyn_short_lifetime variable instead.  This patch
also fixes this issue.  If this is NOT a bug but is deliberate,
I would encourage that it be documented as such.  I believe it is
around line 798 of ip_fw.c (at least on FreeBSD-4.1.1-STABLE as of
17 Oct. 2000).

This patch also adds documentation for the "lifetime X" option
to the ipfw man page.

I have been using these patches on several moderate-traffic Internet
hosts and on several firewall boxes, all running various versions of
FreeBSD 4.0 and 4.1 for several months now with absolutely no problems
at all.  I belive these changes to be VERY stable.

This change would be extremely useful.  I use it right now like this:
(This is a small subset of my rules, edited for this example)

  ipfw add check-state
  ### UDP filters:
  # Keep state on UDP sent to ICQ servers for up to 5 minutes
  # so ICQ clients won't keep getting disconnected:
  ipfw add pass udp from ${MYIP} to ${ICQ_NETWORK} out keep-state lifetime 300
  # All other UDP will use the default net.inet.ip.fw.dyn_short_lifetime
  # expiration:
  ipfw add pass udp from ${MYIP} to any out keep-state
  ### TCP filters:
  # Drop bogus "established" traffic:
  ipfw add deny tcp from any to any established
  # Keep my SSH sessions around for up to a whole day:
  ipfw add pass tcp from ${MYIP} to any out setup keep-state lifetime 86400
  # All other outgoing TCP gets the default expiration as set in the
  # system variable net.inet.ip.fw_syn_lifetime:
  ipfw add pass tcp from ${MYIP} to any out setup keep-state

I really hope that this new feature will be adopted.  It has been very
useful.  And that would also let me be more lazy -- I wouldn't have to
patch my system after each cvsup.  :)

If the patch submitted below (in the "Fix to the problem if known:" part) doesn't come through clearly, email me and I'll email the patch to you.

Sincerely,
Aaron Gifford

Fix: struct ip_fw_chain {
         LIST_ENTRY(ip_fw_chain) chain;
@@ -147,6 +149,7 @@
     struct ipfw_flow_id mask ;
     struct ip_fw_chain *chain ;                /* pointer to parent rule       */
     u_int32_t type ;                   /* rule type                    */
+    u_int32_t lifetime ;               /* per-rule specified lifetime  */
     u_int32_t expire ;                 /* expire time                  */
     u_int64_t pcnt, bcnt;              /* match counters               */
     u_int32_t bucket ;                 /* which bucket in hash table   */
How-To-Repeat: This is a feature request