diff options
Diffstat (limited to 'sbin/ipfw')
| -rw-r--r-- | sbin/ipfw/ipfw.8 | 12 | ||||
| -rw-r--r-- | sbin/ipfw/ipfw2.c | 10 |
2 files changed, 22 insertions, 0 deletions
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 42d1956..ba2ded6 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -927,6 +927,18 @@ with a .It Cm ipprecedence Ar precedence Matches IP packets whose precedence field is equal to .Ar precedence . +.It Cm ipsec +Matches packets that have IPSEC history associated with them +(i.e. the packet comes encapsulated in IPSEC, the kernel +has IPSEC support and IPSEC_FILTERGIF option, and can correctly +decapsulate it). +.Pp +Note that specifying +.Cm ipsec +is different from specifying +.Cm proto Ar ipsec +as the latter will only look at the specific IP protocol field, +irrespective of IPSEC kernel support and the validity of the IPSEC data. .It Cm iptos Ar spec Matches IP packets whose .Cm tos diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index cef3752..12d774f 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -225,6 +225,7 @@ enum tokens { TOK_MAC, TOK_MACTYPE, TOK_VERREVPATH, + TOK_IPSEC, TOK_PLR, TOK_NOERROR, @@ -335,6 +336,7 @@ struct _s_x rule_options[] = { { "mac", TOK_MAC }, { "mac-type", TOK_MACTYPE }, { "verrevpath", TOK_VERREVPATH }, + { "ipsec", TOK_IPSEC }, { "not", TOK_NOT }, /* pseudo option */ { "!", /* escape ? */ TOK_NOT }, /* pseudo option */ @@ -1226,6 +1228,10 @@ show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth) printf(" verrevpath"); break; + case O_IPSEC: + printf(" ipsec"); + break; + case O_KEEP_STATE: printf(" keep-state"); break; @@ -3270,6 +3276,10 @@ read_options: fill_cmd(cmd, O_VERREVPATH, 0, 0); break; + case TOK_IPSEC: + fill_cmd(cmd, O_IPSEC, 0, 0); + break; + default: errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s); } |
