Bug 245381 - ipfw protocol or-block parsing bug when ip protocol is first in list
Summary: ipfw protocol or-block parsing bug when ip protocol is first in list
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.1-RELEASE
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-bugs mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-05 18:49 UTC by Jim B.
Modified: 2020-04-20 01:59 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jim B. 2020-04-05 18:49:58 UTC
ipfw cannot parse an or-block when protocol 'ip' is first in the list.

To reproduce:

# ipfw flush
Are you sure? [yn] y

Flushed all rules.

# Add rule with or-block without 'ip' protocol - success
# ipfw add 1000 deny \{ igmp or ggp or eigrp \} from any to me 
01000 deny { igmp or ggp or eigrp } from any to me

# Try to add or-block with 'ip' protocol first in list - error
# ipfw add 1100 deny \{ ip or igmp or ggp or eigrp \} from any to me
ipfw: invalid OR block

# Reorder or-block so 'ip' protocol is not first in list - success
# ipfw add 1200 deny \{ igmp or ip or ggp or eigrp \} from any to me
01200 deny { igmp or ggp or eigrp } from any to me
# 

Note also that the ip protocol does not show up in the last accepted rule.
Comment 1 Neel Chauhan 2020-04-10 01:08:05 UTC
I am interested in working on this ticket.
Comment 2 Neel Chauhan 2020-04-10 03:35:44 UTC
It appears that even on commands like:

# ipfw add 1 deny \{ igmp or ip or ggp or eigrp \} from any to me
00001 deny { igmp or ggp or eigrp } from any to me

It doesn't add ip. I tried this on my laptop and pings went through.

However, this works:

# ipfw add 1 deny \{ ipv4 or igmp or ggp or eigrp \} from any to me
00001 deny { ip4 or igmp or ggp or eigrp } from any to me

The problem is that the command for just "ip" in the kernel/tool is blank.

Theoretically, this problem is solvable but why would you want to block both IPv4 AND IPv6?
Comment 3 Jim B. 2020-04-20 01:59:10 UTC
(In reply to Neel Chauhan from comment #2)

The 'deny' action keyword is immaterial to the bug report.

You correctly noted that both "ip4" and "ipv4" work as the first element in the list. 

While this is a workaround, "ip4" and "ipv4" do not exist as valid protocol names in /etc/protocols.

I suggest that the code be fixed to accommodate "ip" as an acceptable value even if it is the first element in the list.