Date: Wed, 26 Dec 2001 18:26:18 -0800 From: "Henry Su" <henrysu@nttmcl.com> To: "Julian Elischer" <julian@elischer.org> Cc: <freebsd-net@FreeBSD.ORG> Subject: RE: socket call in the kernel Message-ID: <AJEHKCJLENGKGEHDIOJGCEOACGAA.henrysu@nttmcl.com> In-Reply-To: <Pine.BSF.4.21.0112261559410.83776-100000@InterJet.elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Thanks a lot for your help. I add "log" into the rule, here's the log info. It seems it does forward or divert to localhost at port 8800. [18:10:13][root@test2:/var/log]$ tail -f security Dec 26 17:50:34 test2 last message repeated 2 times Dec 26 17:51:34 test2 last message repeated 6 times Dec 26 17:51:52 test2 /kernel: ipfw: 65534 Forward to 127.0.0.1:8800 TCP 216.69.69.248:1037 216.115.102.75:80 in via dc2 Dec 26 17:51:52 test2 /kernel: ipfw: limit 10 reached on entry 65534 Dec 26 17:59:45 test2 /kernel: ipfw: 65534 Forward to 127.0.0.1:8800 TCP 216.69.69.248:1041 216.115.102.81:80 in via dc2 Dec 26 17:59:55 test2 last message repeated 7 times Dec 26 18:00:45 test2 /kernel: ipfw: 65534 Forward to 127.0.0.1:8800 TCP 216.69.69.248:1041 216.115.102.81:80 in via dc2 Dec 26 18:00:45 test2 /kernel: ipfw: 65534 Forward to 127.0.0.1:8800 TCP 216.69.69.248:1042 216.115.102.77:80 in via dc2 Dec 26 18:00:45 test2 /kernel: ipfw: limit 10 reached on entry 65534 Dec 26 18:11:14 test2 /kernel: ipfw: 65534 Divert 8800 TCP 216.69.69.248:1048 216.115.102.82:80 in via dc2 Dec 26 18:11:14 test2 /kernel: ipfw: 65534 Divert 8800 TCP 216.69.69.248:1048 216.115.102.82:80 in via dc2 Dec 26 18:12:14 test2 last message repeated 7 times Dec 26 18:12:38 test2 /kernel: ipfw: 65534 Divert 8800 TCP 216.69.69.248:1049 216.115.102.79:80 in via dc2 Dec 26 18:13:10 test2 last message repeated 7 times Dec 26 18:13:44 test2 /kernel: ipfw: 65534 Divert 8800 TCP 216.69.69.248:1049 216.115.102.79:80 in via dc2 Dec 26 18:13:44 test2 /kernel: ipfw: 65534 Divert 8800 TCP 216.69.69.248:1050 216.115.102.77:80 in via dc2 But my redirection server at port 8800 did not recv these packets somehow. I tried a telnet to the server at port 8800, it works very well. [18:16:00][henrysu@test1:~]$ telnet 216.69.69.254 8800 Trying 216.69.69.254... Connected to dhcp254.nttmcl.com. Escape character is '^]'. 1234 HTTP/1.1 302 Moved Date: Wed, 26 Dec 2001 18:15:11 PST Location: https://216.69.69.254/cgi-bin/login 0 Connection closed by foreign host. Do you have any clue, why the packet can not be received at port 8800. Thanks. -----Original Message----- From: owner-freebsd-net@FreeBSD.ORG [mailto:owner-freebsd-net@FreeBSD.ORG]On Behalf Of Julian Elischer Sent: Wednesday, December 26, 2001 4:08 PM To: Henry Su Cc: freebsd-net@FreeBSD.ORG Subject: RE: socket call in the kernel On Wed, 26 Dec 2001, Henry Su wrote: > I tried your answer 1. It did not succeed. > > I have a rule to do forwarding: > > 65534 0 0 fwd 127.0.0.1,8800 tcp from any to any 80 > > and I have a server listenning on port 8800 at local host. > > I also modified the ip_fw.c to log forwarding packet: > > Dec 26 13:33:09 yarn /kernel: Forward packet: src_port:2414 > src_ip:-62569000 dst_port:80 dst_ip:1298559960 > Dec 26 13:33:15 yarn /kernel: Forward packet: src_port:2414 > src_ip:-62569000 dst_port:80 dst_ip:1298559960 why not just add a log entry to the rule? also your rule should be a lot more specific about where the packets should be coming from, e.g. recv in fxp0 (or similar) what do you get if you telnet to 80 and telnet to 8800? they should act the same. ipfw add 65534 fwd 127.0.0.1,8800 log from any to me 80 in recv fxp0 > > > My redirect server on port 8800 works perfect, I tried telnet, http etc on > 8800, it all works. I run my server @ port 8800 in debug mode, it did not > receive forwarded packet from ipfirewall. how are you forwarding the packet? > > I am running 4.5 prerelease, with ipfw and bridge, the bridge code had > problem earlier, I manully fixed according to the message from the group. > > Thanks. > > -----Original Message----- > From: owner-freebsd-net@FreeBSD.ORG > [mailto:owner-freebsd-net@FreeBSD.ORG]On Behalf Of Julian Elischer > Sent: Thursday, December 20, 2001 3:08 PM > To: Henry Su > Cc: freebsd-net@FreeBSD.ORG > Subject: RE: socket call in the kernel > > > > > I have two answers: > > 1/ Use ipfw add NNN fwd localhost,8001 [deny criteria] > to make the packet that is denied go to a default server listenning on > port 8001 > > 2/ there is an in-kernel webserver built using netgraph but it's not > public, but you can definitly use the 'ksocket' node to open 'in kernel' > sockets and pass the result to an arbitrary node. > > > 1 can do what you want with no kernel programming.. > check it out.. > > man ipfw > > > On Thu, 20 Dec 2001, Henry Su wrote: > > > Thanks, Julian and Alfred. > > > > I am trying to redirect the denied http request to a default web site. So > my > > idea is in the "ip_fw_chk" function of ip_fw.c, add following code, when > it > > will drop the packet. But as you pointed out in earlier email, socket can > > not be used in this case. Do u have any other solutions? Thanks a lot. > > > > > > > > * Finally, drop the packet. > > */ > > > > > > /* my code start debug */ > > /* find if it's a http packet */ > > dst_port_h = ntohs(dst_port); > > if(dst_port_h==80){ > > log(LOG_INFO,"src_port:%u src_ip:%d dst_port:%d > dst_ip:%u", > > ntohs(src_port), src_ip.s_addr, nt > > ohs(dst_port), dst_ip.s_addr); > > /*s = 1;*/ > > s = socket(AF_INET, SOCK_STREAM, 0); > > if (s < 0) { > > log(LOG_INFO,"Redirect socket can not be > created"); > > }else{ > > log(LOG_INFO,"Redirect socket is created"); > > /* > > bzero(&sa, sizeof sa); > > sa.sin_family = AF_INET; > > sa.sin_port = src_port; > > sa.sin_addr.s_addr = src_ip.s_addr; > > if (connect(s, (struct sockaddr *)&sa, sizeof sa) > < > > 0) { > > log(LOG_INFO,"connect %d failed", > > src_ip.s_addr); > > close(s); > > }else{ > > log(LOG_INFO,"connect %d ok", > > src_ip.s_addr); > > close(s); > > } > > */ > > /* > > while ((bytes = read(s, buffer, BUFSIZ)) > 0) > > write(1, buffer, bytes); > > */ > > } > > } > > /* end debug */ > > return(IP_FW_PORT_DENY_FLAG); > > > > > > -----Original Message----- > > From: Julian Elischer [mailto:julian@elischer.org] > > Sent: Thursday, December 20, 2001 12:59 PM > > To: Henry Su > > Cc: freebsd-net@FreeBSD.ORG > > Subject: Re: socket call in the kernel > > > > > > > > > > You cannot do a socket directly but you can indirectly > > tell me what you are trying to do and I can help.. > > > > > > > > On Thu, 20 Dec 2001, Henry Su wrote: > > > > > I am trying to modify ip_fw.c in the /usr/src/sys/netinet, I tried to > add > > a > > > socket call in the code, it can be compiled, but when it runs into the > > code, > > > it just crashed. It gave me the "Fatal trap error 12", Memory address is > > > wrong. > > > > > > Can any one tell me if socket call can be used in kernel level? If not, > > how > > > can I accomplish socket communication in the kernel level? > > > > > > Thanks. > > > > > > ------------------------------------------------ > > > > > > Henry Su > > > > > > NTT Multimedia Communications Laboratories, Inc. > > > > > > 250 Cambridge Avenue Suite 300 > > > > > > Palo Alto, CA 94306, USA (PST:UTC -8H) > > > > > > Tel: +1 650 833 3652 > > > > > > Fax: +1 650 326 1878 > > > > > > http://www.nttmcl.com/ > > > > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > > with "unsubscribe freebsd-net" in the body of the message > > > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-net" in the body of the message > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?AJEHKCJLENGKGEHDIOJGCEOACGAA.henrysu>