K 10
svn:author
V 5
luigi
K 8
svn:date
V 27
2002-07-24T03:21:24.000000Z
K 7
svn:log
V 1342
Bring ipfw2 into the -stable tree. This will give more people a
chance to test it, and hopefully accelerate the transition from the
old to the new ipfw code.

NOTE: THIS COMMIT WILL NOT CHANGE THE FIREWALL YOU USE,
NOR A SINGLE BIT IN YOUR KERNEL AND BINARIES.
YOU WILL KEEP USING YOUR OLD "ipfw" UNLESS YOU:

  + add "options IPFW2" (undocumented) to your kernel config file;

  + compile and install sbin/ipfw and lib/libalias with
        make -DIPFW2

in other words, you must really want it.

On the other hand, i believe you do really want to use this new
code. In addition to being twice as fast in processing individual
rules, you can use more powerful match patterns such as

        ... ip from 1.2.3.0/24{50,6,27,158} to ...
        ... ip from { 1.2.3.4/26 or 5.6.7.8/22 } to ...
        ... ip from any 5-7,9-66,1020-3000,4000-5000 to ...

i.e. match sparse sets of IP addresses in constant time; use "or"
connectives between match patterns; have multiple port ranges; etc.
which I believe will dramatically reduce your ruleset size.

As an additional bonus, "keep-state" rules will now send keepalives
when the rule is about to expire, so you will not have your remote
login sessions die while you are idle.

The syntax is backward compatible with the old ipfw.
A manual page documenting the extensions has yet to be completed.

END