From owner-cvs-all  Mon May 13  3:37:27 2002
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3786937B401; Mon, 13 May 2002 03:37:20 -0700 (PDT)
Received: (from luigi@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g4DAbKq89983;
	Mon, 13 May 2002 03:37:20 -0700 (PDT)
	(envelope-from luigi)
Message-Id: <200205131037.g4DAbKq89983@freefall.freebsd.org>
From: Luigi Rizzo <luigi@FreeBSD.org>
Date: Mon, 13 May 2002 03:37:20 -0700 (PDT)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/net if_ethersubr.c src/sys/netinet
         ip_dummynet.c ip_dummynet.h
X-FreeBSD-CVS-Branch: HEAD
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG

luigi       2002/05/13 03:37:20 PDT

  Modified files:
    sys/net              if_ethersubr.c 
    sys/netinet          ip_dummynet.c ip_dummynet.h 
  Log:
  Add ipfw hooks to ether_demux() and ether_output_frame().
  Ipfw processing of frames at layer 2 can be enabled by the sysctl variable
  
          net.link.ether.ipfw=1
  
  Consider this feature experimental, because right now, the firewall
  is invoked in the places indicated below, and controlled by the
  sysctl variables listed on the right.  As a consequence, a packet
  can be filtered from 1 to 4 times depending on the path it follows,
  which might make a ruleset a bit hard to follow.
  
  I will add an ipfw option to tell if we want a given rule to apply
  to ether_demux() and ether_output_frame(), but we have run out of
  flags in the struct ip_fw so i need to think a bit on how to implement
  this.
  
                  to upper layers
               |                       |
               +----------->-----------+
               ^                       V
          [ip_input]              [ip_output]     net.inet.ip.fw.enable=1
               |                       |
               ^                       V
          [ether_demux]      [ether_output_frame] net.link.ether.ipfw=1
               |                       |
               +->- [bdg_forward]-->---+          net.link.ether.bridge_ipfw=1
               ^                       V
               |                       |
                   to devices
  
  Revision  Changes    Path
  1.111     +146 -0    src/sys/net/if_ethersubr.c
  1.46      +27 -5     src/sys/netinet/ip_dummynet.c
  1.19      +2 -0      src/sys/netinet/ip_dummynet.h

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message