Date: Sun, 8 Oct 2006 05:32:20 -0300 From: "Eduardo Meyer" <dudu.meyer@gmail.com> To: freebsd-ipfw@freebsd.org, melifaro@su29.net Subject: Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility) Message-ID: <d3ea75b30610080132p78903613i57091f61998304e7@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Mr Chernikov, could you please post the full content of your "bpf.script" file?
------------
On Mon Jun 12 21:45:48 UTC 2006 Alexander V. Chernikov wrote:
Hi,
I have recent 7.0-current and this node seems to work for me.
Node code compiles and loads into kernel without any problems.
After some time experimenting with ng_bpf(4) i was able to tag
packets matched by bpf filter.
Of course, the following is not a real-world example, but it
confirms module is working. Great job!
[root at ws /home/melifaro/ng]# make
@ -> /usr/src/sys
machine -> /usr/src/sys/i386/include
touch opt_netgraph.h
cc -O2 -fno-strict-aliasing -pipe -g -Werror -D_KERNEL -DKLD_MODULE
-nostdinc -I- -I/usr/home/melifaro/ng -I. -I@ -I@/contrib/altq
-finline-limit=8000 --param inline-unit-growth=100 --param
large-function-growth=1000 -fno-common -mno-align-long-strings
-mpreferred-stack-boundary=2 -mno-mmx -mno-3dnow -mno-sse -mno-sse2
-mno-sse3 -ffreestanding -Wall -Wredundant-decls -Wnested-externs
-Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Winline
-Wcast-qual -Wundef -fformat-extensions -std=c99 -c ng_tag.c
ld -d -warn-common -r -d -o ng_tag.kld ng_tag.o
touch export_syms
awk -f /sys/conf/kmod_syms.awk ng_tag.kld export_syms | xargs -J%
objcopy % ng_tag.kld
ld -Bshareable -d -warn-common -o ng_tag.ko ng_tag.kld
objcopy --strip-debug ng_tag.ko
[root at ws /home/melifaro/ng]# make load
/sbin/kldload -v /usr/home/melifaro/ng/ng_tag.ko
Loaded /usr/home/melifaro/ng/ng_tag.ko, id=14
[root at ws /usr/home/melifaro/ng]# sysctl -w net.inet.ip.fw.one_pass=0
net.inet.ip.fw.one_pass: 1 -> 0
[root at ws /home/melifaro/ng]# ngctl mkpeer ipfw: bpf 41 ipfw
[root at ws /home/melifaro/ng]# ngctl name ipfw:41 dcbpf
[root at ws /home/melifaro/ng]# ngctl mkpeer dcbpf: tag matched th1
[root at ws /home/melifaro/ng]# ngctl name dcbpf:matched ngdc
root at ws /usr/home/melifaro/ng]#
[root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookin {
thisHook=\"th1\" ifNotMatch=\"th1\" }
[root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookout {
thisHook=\"th1\" tag_cookie=1148380143 tag_id=412 }
root at ws /usr/home/melifaro/ng]#
[root at ws /home/melifaro/ng]# ngctl msg dcbpf: setprogram '{
thisHook="matched" ifMatch="ipfw" bpf_prog_len=1 bpf_prog=[ { code=6
k=8192 } ] }'
root at ws /usr/home/melifaro/ng]#
; Matching part now, generated by script from ng_bpf(4) man page
; We are trying to tag all packets with dst port = 8888
; link layer is cut, so offset is 20 + 2
[root at ws /usr/home/melifaro/ng]# head -n 5 bpf.script
PATTERN="ether[22:2]=8888"
NODEPATH="dcbpf:"
INHOOK="ipfw"
MATCHHOOK="matched"
NOTMATCHHOOK="ipfw"
root at ws /usr/home/melifaro/ng]# ./bpf.script
root at ws /usr/home/melifaro/ng]#
[root at ws /usr/home/melifaro/ng]# ipfw add 100 netgraph 41 tcp from me to
1.2.3.4 8888
00100 netgraph 41 tcp from me to 1.2.3.4 dst-port 8888
[root at ws /usr/home/melifaro/ng]# ipfw add 110 reset tcp from any to any
tagged 412
00110 reset tcp from any to any tagged 412
[root at ws /usr/home/melifaro/ng]#
[root at ws /usr/home/melifaro/ng]# telnet 1.2.3.4 8888
Trying 1.2.3.4...
telnet: connect to address 1.2.3.4: Connection refused
telnet: Unable to connect to remote host
[root at ws /usr/home/melifaro/ng]# ipfw show 100-110
00100 1 64 netgraph 41 tcp from me to 1.2.3.4 dst-port 8888
00110 1 64 reset tcp from any to any tagged 412
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d3ea75b30610080132p78903613i57091f61998304e7>