K 10
svn:author
V 5
luigi
K 8
svn:date
V 27
2003-07-17T06:03:39.000000Z
K 7
svn:log
V 1241
MFC: sync ipfw2 with the version in -current, including:

 * implement a '-n' option to do a syntax-check only of ipfw2 rules;

 * allow spaces after commas in ipfw rules;

 * support for comma-separated address lists e.g.

    ipfw add allow ip from not 10.0.0.0/8, 192.168.0.0/16, 1.2.3.4 to me

   (note the possibility to put a 'not' in front of the entire list,
   which was not possible with "or blocks");

 * allow comments in ipfw rules which are stored together with rules and
   appear upon an 'ipfw show':

	ipfw add allow udp from any to any 53 // nameserver

 * allow set 31 to be used for ordinary (non-default) rules, but with
   the special feature that rules in set 31 cannot be disabled and
   are not affected by a 'flush' command (so they must be deleted
   explicitly). This permits a flexible form of "persistent" rules
   which should survive across firewall reloads.

 * allow ranges to be specified in the "ipfw show" and "ipfw list"
   commands (the same ought to be done for ""ipfw delete"):

	ipfw show 100-1000 2000 3000-5500

I believe the kernel side of these changes is entirely backward
compatible with the old /sbin/ipfw[2], though of course you need
to update the userland command to use the new features.

END