Attachment 180505 Details for Bug 213452 – add support for ngtee/netgraph ipfw actions for layer-2 frames

[patch] add support for ngtee/netgraph ipfw actions for layer-2 frames

ipfwng.diff (text/plain), 1.39 KB, created by Eugene Grosbein on 2017-03-04 17:26:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Grosbein

Created: 2017-03-04 17:26:47 UTC

Size: 1.39 KB

patch

obsolete

>--- sys/netpfil/ipfw/ip_fw_pfil.c.orig	2017-03-04 15:59:15.682860000 +0700
>+++ sys/netpfil/ipfw/ip_fw_pfil.c	2017-03-04 23:26:55.162587000 +0700
>@@ -315,11 +315,12 @@ ipfw_check_frame(void *arg, struct mbuf 
> 	struct ip_fw_args args;
> 	struct m_tag *mtag;
> 
>+	bzero(&args, sizeof(args));
>+
>+again:
> 	/* fetch start point from rule, if any.  remove the tag if present. */
> 	mtag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL);
>-	if (mtag == NULL) {
>-		args.rule.slot = 0;
>-	} else {
>+	if (mtag != NULL) {
> 		args.rule = *((struct ipfw_rule_ref *)(mtag+1));
> 		m_tag_delete(*m0, mtag);
> 		if (args.rule.info & IPFW_ONEPASS)
>@@ -376,15 +377,28 @@ ipfw_check_frame(void *arg, struct mbuf 
> 
> 	case IP_FW_DUMMYNET:
> 		ret = EACCES;
>+		int dir2;
> 
> 		if (ip_dn_io_ptr == NULL)
> 			break; /* i.e. drop */
> 
> 		*m0 = NULL;
>-		dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
>-		ip_dn_io_ptr(&m, dir | PROTO_LAYER2, &args);
>+		dir2 = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
>+		ip_dn_io_ptr(&m, dir2 | PROTO_LAYER2, &args);
> 		return 0;
> 
>+	case IP_FW_NGTEE:
>+	case IP_FW_NETGRAPH:
>+		if (ng_ipfw_input_p == NULL) {
>+			ret = EACCES;
>+			break; /* i.e. drop */
>+		}
>+		ret = ng_ipfw_input_p(m0, (dir == PFIL_IN) ? DIR_IN : DIR_OUT,
>+			&args, (i == IP_FW_NGTEE) ? 1 : 0);
>+		if (i == IP_FW_NGTEE) /* ignore errors for NGTEE */
>+			goto again;	/* continue with packet */
>+		break;
>+
> 	default:
> 		KASSERT(0, ("%s: unknown retval", __func__));
> 	}

Actions: View | Diff

Attachments on bug 213452: 175712 | 180505