Date: Wed, 04 Nov 2009 09:44:46 -0800 From: Julian Elischer <julian@elischer.org> To: jakub <jakub.bednar@avg.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: Diverting sockets and streams Message-ID: <4AF1BD8E.207@elischer.org> In-Reply-To: <1257352643.7731.8.camel@dell> References: <1257352643.7731.8.camel@dell>
next in thread | previous in thread | raw e-mail | index | archive | help
jakub wrote: > Hi list, > > I have a newbie question about divert sockets but I can't find a direct > answer. > > I have a rule like this: > > ipfw add divert 5555 tcp from me to any 80 keep-state > > If I understand it correctly, in order to check the data stream properly > I have to deal with: > > 1. packet reordering > 2. packet duplication yes, divert treats each packet individually with the exception of frags which it reassembles. > > so basically I have to implement part of the TCP stack in my app. yes, though there may be other ways to do what you want.. what DO you want to do? > > I don't have to bother with fragmentation (according to man pages). > I won't be able to understand IPSec packets as I will get encrypted IP > frames. yes > > Am I correct? Or can you please tell me how it really works? packets enter the system and are run through the IP stack where the first thing they hit is ipfw. in ipfw the divert rule forces them to the divert code (which does reassembly but that's all) and passes the result to a divert socket. there is apossibilty that done correctly with ESP one migh tb eab;e to get to the unencrypted packet but you'd have to read the code starting at ip_input() in ip_input.c to check for sure. > > Thanks a lot, > > Jakub > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4AF1BD8E.207>