From owner-freebsd-ipfw@FreeBSD.ORG Sun Oct 8 08:32:23 2006 Return-Path: X-Original-To: freebsd-ipfw@freebsd.org Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4250816A403 for ; Sun, 8 Oct 2006 08:32:23 +0000 (UTC) (envelope-from dudu.meyer@gmail.com) Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.168]) by mx1.FreeBSD.org (Postfix) with ESMTP id 234BF43D46 for ; Sun, 8 Oct 2006 08:32:21 +0000 (GMT) (envelope-from dudu.meyer@gmail.com) Received: by ug-out-1314.google.com with SMTP id m2so453022uge for ; Sun, 08 Oct 2006 01:32:21 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=RFwIDhI/r1bgV4nEs5rP3B4kGI36s4ACYwaJRCrsbLWDeMDnnO3a+5G68wc86IEpu3yiakTSvjAF4Xl11b67IxRt8AY8j826xgkATABM5hKuCCe8UQcX0DWqHTaIw7LvPN/JTQm+Axn8ox8iZchlO8b7uCodqIqKZGk3Jy1Z23M= Received: by 10.67.24.13 with SMTP id b13mr5394497ugj; Sun, 08 Oct 2006 01:32:21 -0700 (PDT) Received: by 10.66.248.4 with HTTP; Sun, 8 Oct 2006 01:32:20 -0700 (PDT) Message-ID: Date: Sun, 8 Oct 2006 05:32:20 -0300 From: "Eduardo Meyer" To: freebsd-ipfw@freebsd.org, melifaro@su29.net MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Cc: Subject: Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility) X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Oct 2006 08:32:23 -0000 Mr Chernikov, could you please post the full content of your "bpf.script" file? ------------ On Mon Jun 12 21:45:48 UTC 2006 Alexander V. Chernikov wrote: Hi, I have recent 7.0-current and this node seems to work for me. Node code compiles and loads into kernel without any problems. After some time experimenting with ng_bpf(4) i was able to tag packets matched by bpf filter. Of course, the following is not a real-world example, but it confirms module is working. Great job! [root at ws /home/melifaro/ng]# make @ -> /usr/src/sys machine -> /usr/src/sys/i386/include touch opt_netgraph.h cc -O2 -fno-strict-aliasing -pipe -g -Werror -D_KERNEL -DKLD_MODULE -nostdinc -I- -I/usr/home/melifaro/ng -I. -I@ -I@/contrib/altq -finline-limit=8000 --param inline-unit-growth=100 --param large-function-growth=1000 -fno-common -mno-align-long-strings -mpreferred-stack-boundary=2 -mno-mmx -mno-3dnow -mno-sse -mno-sse2 -mno-sse3 -ffreestanding -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Winline -Wcast-qual -Wundef -fformat-extensions -std=c99 -c ng_tag.c ld -d -warn-common -r -d -o ng_tag.kld ng_tag.o touch export_syms awk -f /sys/conf/kmod_syms.awk ng_tag.kld export_syms | xargs -J% objcopy % ng_tag.kld ld -Bshareable -d -warn-common -o ng_tag.ko ng_tag.kld objcopy --strip-debug ng_tag.ko [root at ws /home/melifaro/ng]# make load /sbin/kldload -v /usr/home/melifaro/ng/ng_tag.ko Loaded /usr/home/melifaro/ng/ng_tag.ko, id=14 [root at ws /usr/home/melifaro/ng]# sysctl -w net.inet.ip.fw.one_pass=0 net.inet.ip.fw.one_pass: 1 -> 0 [root at ws /home/melifaro/ng]# ngctl mkpeer ipfw: bpf 41 ipfw [root at ws /home/melifaro/ng]# ngctl name ipfw:41 dcbpf [root at ws /home/melifaro/ng]# ngctl mkpeer dcbpf: tag matched th1 [root at ws /home/melifaro/ng]# ngctl name dcbpf:matched ngdc root at ws /usr/home/melifaro/ng]# [root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookin { thisHook=\"th1\" ifNotMatch=\"th1\" } [root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookout { thisHook=\"th1\" tag_cookie=1148380143 tag_id=412 } root at ws /usr/home/melifaro/ng]# [root at ws /home/melifaro/ng]# ngctl msg dcbpf: setprogram '{ thisHook="matched" ifMatch="ipfw" bpf_prog_len=1 bpf_prog=[ { code=6 k=8192 } ] }' root at ws /usr/home/melifaro/ng]# ; Matching part now, generated by script from ng_bpf(4) man page ; We are trying to tag all packets with dst port = 8888 ; link layer is cut, so offset is 20 + 2 [root at ws /usr/home/melifaro/ng]# head -n 5 bpf.script PATTERN="ether[22:2]=8888" NODEPATH="dcbpf:" INHOOK="ipfw" MATCHHOOK="matched" NOTMATCHHOOK="ipfw" root at ws /usr/home/melifaro/ng]# ./bpf.script root at ws /usr/home/melifaro/ng]# [root at ws /usr/home/melifaro/ng]# ipfw add 100 netgraph 41 tcp from me to 1.2.3.4 8888 00100 netgraph 41 tcp from me to 1.2.3.4 dst-port 8888 [root at ws /usr/home/melifaro/ng]# ipfw add 110 reset tcp from any to any tagged 412 00110 reset tcp from any to any tagged 412 [root at ws /usr/home/melifaro/ng]# [root at ws /usr/home/melifaro/ng]# telnet 1.2.3.4 8888 Trying 1.2.3.4... telnet: connect to address 1.2.3.4: Connection refused telnet: Unable to connect to remote host [root at ws /usr/home/melifaro/ng]# ipfw show 100-110 00100 1 64 netgraph 41 tcp from me to 1.2.3.4 dst-port 8888 00110 1 64 reset tcp from any to any tagged 412