d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipfw: implement ngtee/netgraph actions for layer-2 frames.

Browse Source 
Kernel part of ipfw does not support and ignores rules other than
"pass", "deny" and dummynet-related for layer-2 (ethernet frames).
Others are processed as "pass".

Make it support ngtee/netgraph rules just like they are supported
for IP packets. For example, this allows us to mirror some frames
selectively to another interface for delivery to remote network analyzer
over RSPAN vlan. Assuming ng_ipfw(4) netgraph node has a hook named "900"
attached to "lower" hook of vlan900's ng_ether(4) node, that would be
as simple as:

ipfw add ngtee 900 ip from any to 8.8.8.8 layer2 out xmit igb0

PR:		213452
MFC after:	1 month
Tested-by:	Fyodor Ustinov <ufm@ufm.su>
This commit is contained in:
eugen 2018-10-27 07:32:26 +00:00
parent 3b50e64714
commit da9980e04a
1 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sys/netpfil/ipfw/ip_fw_pfil.c
View File

@ -317,11 +317,12 @@ ipfw_check_frame(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
struct ip_fw_args args;
struct m_tag *mtag;
bzero(&args, sizeof(args));
again:
/* fetch start point from rule, if any. remove the tag if present. */
mtag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL);
if (mtag == NULL) {
args.rule.slot = 0;
} else {
if (mtag != NULL) {
args.rule = *((struct ipfw_rule_ref *)(mtag+1));
m_tag_delete(*m0, mtag);
if (args.rule.info & IPFW_ONEPASS)
@ -378,15 +379,28 @@ ipfw_check_frame(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
case IP_FW_DUMMYNET:
ret = EACCES;
int dir2;
if (ip_dn_io_ptr == NULL)
break; /* i.e. drop */
*m0 = NULL;
dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
ip_dn_io_ptr(&m, dir | PROTO_LAYER2, &args);
dir2 = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
ip_dn_io_ptr(&m, dir2 | PROTO_LAYER2, &args);
return 0;
case IP_FW_NGTEE:
case IP_FW_NETGRAPH:
if (ng_ipfw_input_p == NULL) {
ret = EACCES;
break; /* i.e. drop */
}
ret = ng_ipfw_input_p(m0, (dir == PFIL_IN) ? DIR_IN : DIR_OUT,
&args, (i == IP_FW_NGTEE) ? 1 : 0);
if (i == IP_FW_NGTEE) /* ignore errors for NGTEE */
goto again; /* continue with packet */
break;
default:
KASSERT(0, ("%s: unknown retval", __func__));
}