diff options
author | csjp <csjp@FreeBSD.org> | 2005-10-23 16:15:02 +0000 |
---|---|---|
committer | csjp <csjp@FreeBSD.org> | 2005-10-23 16:15:02 +0000 |
commit | 855920faa4f785fbfa9ea814374356f8f68784e5 (patch) | |
tree | 8d4cdeb4cc4b63c55560c1e1570b51cb76248989 /sbin | |
parent | 01c93e49496793c2e81170455d90d7248d50b1a5 (diff) | |
download | FreeBSD-src-855920faa4f785fbfa9ea814374356f8f68784e5.zip FreeBSD-src-855920faa4f785fbfa9ea814374356f8f68784e5.tar.gz |
Restore the documentation about uid, gid or prison based rules requiring
that debug.mpsafenet be set to 0. It is still possible for dead locks to
occur while these filtering options are used due to the layering violation
inherent in their implementation.
Discussed: -current, rwatson, glebius
Diffstat (limited to 'sbin')
-rw-r--r-- | sbin/ipfw/ipfw.8 | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 5737aa9..d536120 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1074,10 +1074,14 @@ Matches all TCP or UDP packets sent by or received for a A .Ar group may be specified by name or number. +This option should be used only if debug.mpsafenet=0 to avoid possible +deadlocks due to layering violations in its implementation. .It Cm jail Ar prisonID Matches all TCP or UDP packets sent by or received for the jail whos prison ID is .Ar prisonID . +This option should be used only if debug.mpsafenet=0 to avoid possible +deadlocks due to layering violations in its implementation. .It Cm icmptypes Ar types Matches ICMP packets whose ICMP type is in the list .Ar types . @@ -1413,6 +1417,8 @@ Match all TCP or UDP packets sent by or received for a A .Ar user may be matched by name or identification number. +This option should be used only if debug.mpsafenet=0 to avoid possible +deadlocks due to layering violations in its implementation. .It Cm verrevpath For incoming packets, a routing table lookup is done on the packet's source address. @@ -2517,3 +2523,7 @@ to a TCP connection, and the uid/gid associated with a packet may not be as expected if the associated process calls .Xr setuid 2 or similar system calls. +.Pp +Rules which use uid, gid or jail based matching should be used only +if debug.mpsafenet=0 to avoid possible deadlocks due to layering +violations in its implementation. |