Date: Thu, 25 Sep 2008 15:49:18 +0200 From: "raffaele\.delorenzo\@libero\.it" <raffaele.delorenzo@libero.it> To: "freebsd-ipfw" <freebsd-ipfw@freebsd.org>, "freebsd-net" <freebsd-net@freebsd.org> Cc: "raffaele.delorenzo" <raffaele.delorenzo@libero.it> Subject: [IPFW add ARP support] - Request for testing Message-ID: <K7R7Q6$C3E9A114EEC13185E344FBD19103383A@libero.it>
index | next in thread | raw e-mail
[-- Attachment #1 --]
Hi all,
In the last 2 weeks i implemented a new filter method inside the ipfw firewall for ARP protocols.
My idea for the new method was to create a new "proto" microinstruction exclusively for ARP protocol named "arp". This method permits filter tering from/to particular MAC address to be restricted to ARP protocol.
Example:
ipfw add deny arp from 52:54:00:12:34:56 to 00:11:43:cd:87:6t // Deny all ARP packets generated by "from" and destinated to "to".
The wildcard "any" and "me" are supported; the semantic is the same for all old protocol rules:
ipfw add deny arp from 00:11:43:cd:87:6t to any
Moreover, I implemented some filter methods that restrict the filtering to some ARP header fields:
1) Source MAC address (srcmac-arp)
2) Source IP address (srcip-arp)
3) Destination MAC address (dstmac-arp)
4) Destination IP address (dstip-arp)
Example:
./ipfw add deny arp from 00:11:43:cd:87:6e to 52:54:00:12:34:56 srcmac-arp 52:54:00:12:34:56 dstip-arp 192.9.217.29
To work properly, the ARP implementation requires that ipfw receives packets from Layer 2, In other words, you must set the sysctl variable "net.link.ether.ipfw=1".
I attached the new sources and all diffs with reference to FreeBSD 7.0 Release source Tree. Please let me know what you think about this work and if possible eventually test it.
Ciao Ciao
Raffaele
[-- Attachment #2 --]
BZh91AY&SY L3ݗ墈:=V3X[{5fvgf6j$<WP>}-Pl[ 5}Oc@{c(ͶRu֧^>O@ VNA IҕJQk낀aے7f 6 {}8i+.N Kk@ 2]m˶;
()TJJۮ E*@5i
HJx=|kN: q$ t}ٽP%Dp>{yt}y|z8,7aw|"@ .!v
*'L+x05}}hyݽmyV8,aiixO{}o}]muﯟGڶ>[_=Έ&D=M[f3Ymf5JF)G݂}`מ HoB>NOlG\ϝ :NV`/\p}n{W
fR
-eF=ϻŞ6b9&M{o{
}wpv]u #;vM*mRmvUAM}ԽR/tjm("xmMHhx(
MΫtv_FZ>_=}yzxkqu llwЧ hhzx۠zNUJ`Q V@ @ y D Q@vwlP + 6[MhZ{5T ց@ (BPJ7|́}jW*]@ L F 12&FFC#M44
44b
` h H F d
dMd4hiLAFѩ @ # ̆ƉjDG=M3T=OiGSčFbdh0iQi4C&P$Dh L&4hd?&OzhO?CleO4
Oz'dOSɲM6hS<jdMLyOQzi$2d110M014iF i46FMb
4Ddz
~О2 $ ړɐ##HSM'5#e<z(ɼfM462QOQ1<l4ڏS'螙@zFdM 4?@
Eϟ+h yAIH
쬤O51ܑIv)a4' D
m" ζ{V~&\L96{L.Rq&q[ʚ\uĶL LJ[<|L$PsˀF
>UŚ@3s2sZغ
6GiY<cMe;ѕ{)ޫk1^bקx:fkb^m`,]2fa_d.l2I"sc lt{pݕ?>TYFcbIti~rI2J^{s`mNz}: L#jꊝST.Ν?e)@jDiDj_,t]
8u2iS3٣W!|kߝ}G42FDor #+ B^ZXƱX7z6
i( UTI$ffگ=}~_{wy}v_Լ
\[Ⱦ؈{{4)1PkB'6
nsCm]]%bo>O-ٱ@ Y @
@yd ! n.Mjo%\JwyO`1FTۢhWh7|j_/w% F>y5\
zic?N,@1E83@X
;q}BeyYW^nRPh|lKElYԆο7pw{vIֳL.eYƙbeQdپ'"5k^f)~۲lǓ+( oVNkVuSfݵ&