Date: Mon, 11 Dec 2006 14:58:21 -0800 From: Julian Elischer <julian@elischer.org> To: Andre Oppermann <andre@freebsd.org> Cc: FreeBSD Net <freebsd-net@freebsd.org> Subject: Re: addition to ipfw.. Message-ID: <457DE28D.1010106@elischer.org> In-Reply-To: <457DD658.7010707@freebsd.org> References: <457DCD47.5090004@elischer.org> <457DD658.7010707@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Andre Oppermann wrote: > Julian Elischer wrote: >> >> in ipfw layer 2 processing, the packet is passed to the firewall >> as if it was a layer 3 IP packet but the ether header is also made >> available. >> >> I would like to add something similar in the case where a vlan tag >> is also on the packet.. >> >> basically I have a change where: >> >> If we are processing layer 2 packets (in ether or bridge code) >> AND a sysctl says to do it, >> and it is a vlan packet, >> >> Then the vlan header is also held back so that the packet can be >> processed and examined as an IP packet. It is >> (in the same way the ether header is) reattached when the packet is >> accepted. >> >> This allows me to filter packets that are traversing my bridge, >> even though they are encapsulated in a vlan. >> >> I have patches to allow this. I need this function. does anyone else? > > Please have the ipfw code examine the vlan tag in the mbuf instead of > fiddling with the mbuf contents. The ipfw will be ignoring the vlan contents.. the patch is to move the 'start of ip header' pointer past the vlan header.. (if asked) so that it can identifu the IP packet. part of the patch is to make sure all the code uses this pointer instead of the case now where some code uses it and some uses mtod(). This could be used in conjunction with vlan keyword that would look at the vlan header, but that is a different feature..
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?457DE28D.1010106>