Date: Wed, 3 Mar 2004 07:37:06 +0000 From: Matt <mgoward@eviloverlord.org> To: freebsd-hackers@freebsd.org Subject: Adding an IPFW rule from C program Message-ID: <20040303073706.GB29286@IneedAname.eviloverlord.org>
next in thread | raw e-mail | index | archive | help
Tried this on the ipfw list but didnt get any response.
Part of an app I am playing with needs to be able to add an ipfw
rule. I had though i got all of what i need from ipfw2.c and ip_fw.h
but I am painfully new to C and must be missing something. Not
even sure how i can get myself a more usefull error message. Any
point in the right direction would be great. Thank you.
5.2.1R. Kernel is all set. firewall works fine with the real ipfw
client.
When this is built and run: mgoward@IneedAname 1298> gcc -Wall
test.c -o test test.c: In function `main': test.c:134: warning:
implicit declaration of function `err' mgoward@IneedAname 1299>
sudo ./test Password: test: getsockopt(IP_FW_ADD): Invalid argument
mgoward@IneedAname 1300>
Here is test.c. Dont mind all the extra includes. They are all
used in the bulk of the program and I was to lazy to pick and choose
when i pulled this bit out to work on it alone.
#include <stdio.h>
#include <errno.h>
#include <limits.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <netdb.h>
#include <sysexits.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <sys/time.h>
#include <signal.h>
#include <pcap.h>
#include <net/if.h>
#include <netinet/ip_fw.h>
static ipfw_insn *
next_cmd(ipfw_insn *cmd)
{
cmd += F_LEN(cmd);
bzero(cmd, sizeof(*cmd));
return cmd;
}
/*
* conditionally runs the command.
*/
static int
do_cmd(int optname, void *optval, uintptr_t optlen)
{
static int s = -1; /* the socket */
int i;
if (s == -1)
s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET ||
optname == IP_FW_ADD)
i = getsockopt(s, IPPROTO_IP, optname, optval,
(socklen_t *)optlen);
else
i = setsockopt(s, IPPROTO_IP, optname, optval, optlen);
return i;
}
int main ()
{
static uint32_t cmdbuf[255], rulebuf[255];
ipfw_insn *src, *dst, *cmd;
int i;
struct ip_fw *rule;
bzero(cmdbuf, sizeof(cmdbuf));
bzero(rulebuf, sizeof(rulebuf));
rule = (struct ip_fw *)rulebuf;
cmd = (ipfw_insn *)cmdbuf;
rule->rulenum = 250;
rule->set = 2;
cmd->opcode = O_ACCEPT;
cmd->len = 1;
cmd= next_cmd(cmd);
/* this will hold our object and mask */
ipfw_insn_ip *d = (ipfw_insn_ip *)cmd;
/* ip and mask combo object */
d->o.opcode = O_IP_SRC_MASK;
/* get the in_addr in network order */
ascii2addr(AF_INET, "192.168.12.12" , &(d->addr));
ascii2addr(AF_INET, "255.255.255.255" , &(d->mask));
d->o.len = F_INSN_SIZE(ipfw_insn_ip);
/* move our command pointer up one step */
cmd = next_cmd(cmd);
d = (ipfw_insn_ip *)cmd;
d->o.opcode = O_IP_DST_MASK;
ascii2addr(AF_INET, "192.168.12.22" , &(d->addr));
ascii2addr(AF_INET, "255.255.255.255" , &(d->mask));
d->o.len = F_INSN_SIZE(ipfw_insn_ip);
cmd = next_cmd(cmd);
cmd->opcode = O_PROTO;
cmd->len = 1;
cmd->arg1 = IPPROTO_IPV4;
cmd = next_cmd(cmd);
dst = (ipfw_insn *)rule->cmd;
for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) {
i = F_LEN(src);
switch (src->opcode) {
case O_LOG:
case O_KEEP_STATE:
case O_LIMIT:
break;
default:
bcopy(src, dst, i * sizeof(uint32_t));
dst += i;
}
}
rule->act_ofs = dst - rule->cmd;
rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd);
i = (char *)dst - (char *)rule;
if (do_cmd(IP_FW_ADD, rule, (uintptr_t)&i) == -1)
err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD");
return(1);
}
Thank you again,
Matthew Goward
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040303073706.GB29286>