One bugfix and one new feature.

The bugfix (ipfw2.c) makes the handling of port numbers with
a dash in the name, e.g. ftp-data, consistent with old ipfw:
use \\ before the - to consider it as part of the name and not
a range separator.

The new feature (all this description will go in the manpage):

each rule now belongs to one of 32 different sets, which can
be optionally specified in the following form:

	ipfw add 100 set 23 allow ip from any to any

If "set N" is not specified, the rule belongs to set 0.

Individual sets can be disabled, enabled, and deleted with the commands:

	ipfw disable set N
	ipfw enable set N
	ipfw delete set N

Enabling/disabling of a set is atomic. Rules belonging to a disabled
set are skipped during packet matching, and they are not listed
unless you use the '-S' flag in the show/list commands.
Note that dynamic rules, once created, are always active until
they expire or their parent rule is deleted.
Set 31 is reserved for the default rule and cannot be disabled.

All sets are enabled by default. The enable/disable status of the sets
can be shown with the command

	ipfw show sets

Hopefully, this feature will make life easier to those who want to
have atomic ruleset addition/deletion/tests. Examples:

To add a set of rules atomically:

	ipfw disable set 18
	ipfw add ... set 18 ...		# repeat as needed
	ipfw enable set 18

To delete a set of rules atomically

	ipfw disable set 18
	ipfw delete set 18
	ipfw enable set 18

To test a ruleset and disable it and regain control if something
goes wrong:

	ipfw disable set 18
	ipfw add ... set 18 ...         # repeat as needed
	ipfw enable set 18 ; echo "done "; sleep 30 && ipfw disable set 18

    here if everything goes well, you press control-C before
    the "sleep" terminates, and your ruleset will be left
    active. Otherwise, e.g. if you cannot access your box,
    the ruleset will be disabled after the sleep terminates.

I think there is only one more thing that one might want, namely
a command to assign all rules in set X to set Y, so one can
test a ruleset using the above mechanisms, and once it is
considered acceptable, make it part of an existing ruleset.

2 files changed, 98 insertions, 21 deletions

diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h
index 12073b5..90bac5c 100644
--- a/sys/netinet/ip_fw.h
+++ b/sys/netinet/ip_fw.h
@@ -88,7 +88,6 @@ enum ipfw_opcodes {		/* arguments (4 byte each)	*/
 	O_TCPACK,		/* u32 = desired seq.		*/
 	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
 	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/
-	O_IPOPTS,		/* arg1 = 2*u8 bitmap		*/
 
 	O_PROBE_STATE,		/* none				*/
 	O_KEEP_STATE,		/* none				*/
@@ -276,11 +275,12 @@ typedef struct  _ipfw_insn_log {
 
 struct ip_fw {
 	struct ip_fw	*next;		/* linked list of rules		*/
-	struct ip_fw *next_rule;	/* ptr to next [skipto] rule	*/
+	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
 	u_int16_t	act_ofs;	/* offset of action in 32-bit units */
 	u_int16_t	cmd_len;	/* # of 32-bit words in cmd	*/
 	u_int16_t	rulenum;	/* rule number			*/
-	u_int16_t	_pad;		/* padding			*/
+	u_int8_t	set;		/* rule set (0..31)		*/
+	u_int8_t	_pad;		/* padding			*/
 
 	/* These fields are present in all rules.			*/
 	u_int64_t	pcnt;		/* Packet counter		*/
diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c
index a8c9e1a..fbd8e59 100644
--- a/sys/netinet/ip_fw2.c
+++ b/sys/netinet/ip_fw2.c
@@ -77,6 +77,14 @@
 
 #include <machine/in_cksum.h>	/* XXX for in_cksum */
 
+/*
+ * set_disable contains one bit per set value (0..31).
+ * If the bit is set, all rules with the corresponding set
+ * are disabled. Set 31 is reserved for the default rule
+ * and CANNOT be disabled.
+ */
+static u_int32_t set_disable;
+
 static int fw_verbose;
 static int verbose_limit;
 
@@ -1371,6 +1379,9 @@ after_ip_checks:
 		int skip_or; /* skip rest of OR block */
 
 again:
+		if (set_disable & (1 << f->set) )
+			continue;
+
 		skip_or = 0;
 		for (l = f->cmd_len, cmd = f->cmd ; l > 0 ;
 		    l -= cmdlen, cmd += cmdlen) {
@@ -1863,6 +1874,8 @@ check_body:
 next_rule:;		/* try next rule		*/
 	    
 	}		/* end of outer for, scan rules */
+	printf("+++ ipfw: ouch!, skip past end of rules, denying packet\n");
+	return(IP_FW_PORT_DENY_FLAG);
 
 done:
 	/* Update statistics */
@@ -2042,34 +2055,86 @@ free_chain(struct ip_fw **chain, int kill_default)
 }
 
 /**
- * Remove all rules with given number.
+ * Remove all rules with given number, and also do set manipulation.
+ *
+ * The argument is an int. The low 16 bit are the
+ * rule or set number, the upper 16 bits are the
+ * function, namely:
+ * 
+ *      0       DEL_SINGLE_RULE
+ *      1       DELETE_RULESET
+ *      2       DISABLE_SET
+ *      3       ENABLE_SET
  */
 static int
-del_entry(struct ip_fw **chain, u_short rulenum)
+del_entry(struct ip_fw **chain, u_int32_t arg)
 {
 	struct ip_fw *prev, *rule;
 	int s;
+	
+	u_int16_t rulenum, cmd;
 
-	if (rulenum == IPFW_DEFAULT_RULE)
+	rulenum = arg & 0xffff;
+	cmd = (arg >> 16) & 0xffff;
+
+	if (cmd > 3)
+		return EINVAL;
+	if (cmd == 0 && rulenum == IPFW_DEFAULT_RULE)
 		return EINVAL;
 	
-	/*
-	 * locate first rule to delete
-	 */
-	for (prev = NULL, rule = *chain; rule && rule->rulenum < rulenum;
-	     prev = rule, rule = rule->next)
-		;
-	if (rule->rulenum != rulenum)
+	if (cmd != 0 && rulenum > 30) {
+		printf("ipfw: del_entry: invalid set number %d\n",
+			rulenum);
 		return EINVAL;
+	}
 
-	s = splimp(); /* no access to rules while removing */
-	flush_rule_ptrs(); /* more efficient to do outside the loop */
-	/*
-	 * prev remains the same throughout the cycle
-	 */
-	while (rule && rule->rulenum == rulenum)
-		rule = delete_rule(chain, prev, rule);
-	splx(s);
+	switch (cmd) {
+	case 0:	/* DEL_SINGLE_RULE */
+		/*
+		 * locate first rule to delete
+		 */
+		for (prev = NULL, rule = *chain;
+		    rule && rule->rulenum < rulenum;
+		     prev = rule, rule = rule->next)
+			;
+		if (rule->rulenum != rulenum)
+			return EINVAL;
+
+		s = splimp(); /* no access to rules while removing */
+		flush_rule_ptrs(); /* more efficient to do outside the loop */
+		/*
+		 * prev remains the same throughout the cycle
+		 */
+		while (rule && rule->rulenum == rulenum)
+			rule = delete_rule(chain, prev, rule);
+		splx(s);
+		break;
+
+	case 1:	/* DELETE_RULESET */
+		s = splimp(); /* no access to rules while removing */
+		flush_rule_ptrs(); /* more efficient to do outside the loop */
+		for (prev = NULL, rule = *chain; rule ; )
+			if (rule->set == rulenum)
+				rule = delete_rule(chain, prev, rule);
+			else {
+				prev = rule;
+				rule = rule->next;
+			}
+		splx(s);
+		break;
+
+	case 2:	/* DISABLE SET */
+		s = splimp();
+		set_disable |= 1 << rulenum;
+		splx(s);
+		break;
+
+	case 3:	/* ENABLE SET */
+		s = splimp();
+		set_disable &= ~(1 << rulenum);
+		splx(s);
+		break;
+	}
 	return 0;
 }
 
@@ -2379,6 +2444,11 @@ ipfw_ctl(struct sockopt *sopt)
 		for (rule = layer3_chain; rule ; rule = rule->next) {
 			int i = RULESIZE(rule);
 			bcopy(rule, bp, i);
+			/*
+			 * abuse 'next_rule' to store the set_disable word
+			 */
+			(u_int32_t)(((struct ip_fw *)bp)->next_rule) =
+				set_disable;
 			bp = (struct ip_fw *)((char *)bp + i);
 		}
 		if (ipfw_dyn_v) {
@@ -2446,6 +2516,12 @@ ipfw_ctl(struct sockopt *sopt)
 		break;
 
 	case IP_FW_DEL: /* argument is an int, the rule number */
+		/*
+		 * IP_FW_DEL is used for deleting single rules,
+		 * set of rules, and manipulating set_disable.
+		 *
+		 * Everything is managed in del_entry();
+		 */
 		error = sooptcopyin(sopt, &rulenum, sizeof(int), sizeof(int));
 		if (error)
 			break;
@@ -2535,6 +2611,7 @@ ipfw_init(void)
 	default_rule.act_ofs = 0;
 	default_rule.rulenum = IPFW_DEFAULT_RULE;
 	default_rule.cmd_len = 1;
+	default_rule.set = 31;
 
 	default_rule.cmd[0].len = 1;
 	default_rule.cmd[0].opcode =