Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 8 Oct 2006 05:32:20 -0300
From:      "Eduardo Meyer" <>
Subject:   Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
Mr Chernikov, could you please post the full content of your "bpf.script" file?


On Mon Jun 12 21:45:48 UTC 2006 Alexander V. Chernikov wrote:

   I have recent 7.0-current and this node seems to work for me.

   Node code compiles and loads into kernel without any problems.
   After some time experimenting with ng_bpf(4) i was able to tag
   packets matched by bpf filter.
   Of course, the following is not a real-world example, but it
   confirms module is working. Great job!

[root at ws /home/melifaro/ng]# make
@ -> /usr/src/sys
machine -> /usr/src/sys/i386/include
touch opt_netgraph.h
cc -O2 -fno-strict-aliasing -pipe -g -Werror -D_KERNEL -DKLD_MODULE
-nostdinc -I-  -I/usr/home/melifaro/ng -I. -I@ -I@/contrib/altq
-finline-limit=8000 --param inline-unit-growth=100 --param
large-function-growth=1000 -fno-common  -mno-align-long-strings
-mpreferred-stack-boundary=2  -mno-mmx -mno-3dnow -mno-sse -mno-sse2
-mno-sse3 -ffreestanding -Wall -Wredundant-decls -Wnested-externs
-Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Winline
-Wcast-qual  -Wundef -fformat-extensions -std=c99 -c ng_tag.c
ld  -d -warn-common -r -d -o ng_tag.kld ng_tag.o
touch export_syms
awk -f /sys/conf/kmod_syms.awk ng_tag.kld  export_syms | xargs -J%
objcopy % ng_tag.kld
ld -Bshareable  -d -warn-common -o ng_tag.ko ng_tag.kld
objcopy --strip-debug ng_tag.ko

[root at ws /home/melifaro/ng]# make load
/sbin/kldload -v /usr/home/melifaro/ng/ng_tag.ko
Loaded /usr/home/melifaro/ng/ng_tag.ko, id=14

[root at ws /usr/home/melifaro/ng]# sysctl -w net.inet.ip.fw.one_pass=0
net.inet.ip.fw.one_pass: 1 -> 0

[root at ws /home/melifaro/ng]# ngctl mkpeer ipfw: bpf 41 ipfw
[root at ws /home/melifaro/ng]# ngctl name ipfw:41 dcbpf
[root at ws /home/melifaro/ng]# ngctl mkpeer dcbpf: tag matched th1
[root at ws /home/melifaro/ng]# ngctl name dcbpf:matched ngdc
root at ws /usr/home/melifaro/ng]#

[root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookin {
thisHook=\"th1\" ifNotMatch=\"th1\" }
[root at ws /home/melifaro/ng]# ngctl msg ngdc: sethookout {
thisHook=\"th1\" tag_cookie=1148380143 tag_id=412 }
root at ws /usr/home/melifaro/ng]#

[root at ws /home/melifaro/ng]# ngctl msg dcbpf: setprogram '{
thisHook="matched" ifMatch="ipfw" bpf_prog_len=1 bpf_prog=[ { code=6
k=8192 } ] }'
root at ws /usr/home/melifaro/ng]#

; Matching part now, generated by script from ng_bpf(4) man page
; We are trying to tag all packets with dst port = 8888
; link layer is cut, so offset is 20 + 2

[root at ws /usr/home/melifaro/ng]# head -n 5 bpf.script

root at ws /usr/home/melifaro/ng]# ./bpf.script
root at ws /usr/home/melifaro/ng]#

[root at ws /usr/home/melifaro/ng]# ipfw add 100 netgraph 41 tcp from me to 8888
00100 netgraph 41 tcp from me to dst-port 8888
[root at ws /usr/home/melifaro/ng]# ipfw add 110 reset tcp from any to any
tagged 412
00110 reset tcp from any to any tagged 412
[root at ws /usr/home/melifaro/ng]#
[root at ws /usr/home/melifaro/ng]# telnet 8888
telnet: connect to address Connection refused
telnet: Unable to connect to remote host
[root at ws /usr/home/melifaro/ng]# ipfw show 100-110
00100       1         64 netgraph 41 tcp from me to dst-port 8888
00110       1         64 reset tcp from any to any tagged 412

Want to link to this message? Use this URL: <>