Re: ipfw2 net.inet.ip.fw.verbose_limit broken

[ CC: Luigi ]

On Mon, 16 Aug 2004, 23:05-0700, Jeremy Chadwick wrote:

> Just wanted to toss this one up here.  Also, apologies for not
> cross-posting this to freebsd-ipfw, but I'm not on the list; although
> they seem to be aware of it:
>
> http://lists.freebsd.org/mailman/htdig/freebsd-ipfw/2004-July/001239.html
>
> Seems that ipfw2's support for net.inet.ip.fw.verbose_limit is, to
> put it bluntly, broken.  This applies to both -STABLE and -CURRENT.
> The following PR has been sitting around for quite some time...
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/46080
>
> I've managed to confirm this still exists even as of an August 5th build
> of -CURRENT.  Using `logamount' directives per rule works properly as
> a workaround.
>
> I've also looked at the patch, although I'm not sure about the performance
> implications of looking up a sysctl value per packet with a matching
> ipfw2 `log' directive.
>
> The ipfw2 code isn't something I feel even remotely comfortable tinkering
> with, so if someone could take a poke at this (or contact the correct
> people), that'd be great.

I discussed that patch with Luigi almost two years ago but Luigi was
against it because a changing net.inet.ip.fw.verbose_limit does not
affect the existent rules.  While I more or less agree with Luigi I
think we should commit this code until we find a more correct or more
logic solution.  The current version of the patch is below.

Index: ipfw2.c
===================================================================
RCS file: /home/ncvs/src/sbin/ipfw/ipfw2.c,v
retrieving revision 1.54
diff -u -r1.54 ipfw2.c
--- ipfw2.c	12 Aug 2004 22:06:55 -0000	1.54
+++ ipfw2.c	17 Aug 2004 06:37:48 -0000
_at__at_ -2775,6 +2775,7 _at__at_
 	 * various flags used to record that we entered some fields.
 	 */
 	ipfw_insn *have_state = NULL;	/* check-state or keep-state */
+	size_t len;

 	int i;

_at__at_ -2956,6 +2957,12 _at__at_
 				errx(EX_DATAERR, "logamount must be positive");
 			c->max_log = l;
 			ac--; av++;
+		} else {
+			len = sizeof(c->max_log);
+			if (sysctlbyname("net.inet.ip.fw.verbose_limit",
+			    &c->max_log, &len, NULL, 0) == -1)
+				errx(1, "sysctlbyname(\"%s\")",
+				    "net.inet.ip.fw.verbose_limit");
 		}
 		cmd = next_cmd(cmd);
 	}
%%%

-- 
Maxim Konovalov