Date: Tue, 08 Feb 2011 22:40:15 +0300 From: Sergey Matveychuk <sem@FreeBSD.org> To: Rozhuk.IM@gmail.com Cc: freebsd-net@freebsd.org Subject: Re: divert rewrite Message-ID: <4D519C1F.9020205@FreeBSD.org> In-Reply-To: <4d518fba.26ead80a.02ff.1058@mx.google.com> References: <4D4DCD1E.1050906@freebsd.org> <AANLkTimtDegcGjzXatEOHjQR9GM_hD29ZiKnkT-zG1_S@mail.gmail.com> <4D4DFC95.9010804@freebsd.org> <4D501198.6090901@FreeBSD.org> <4d516a6a.8937e30a.0996.2f26@mx.google.com> <4D51750A.3070303@FreeBSD.org> <4d518fba.26ead80a.02ff.1058@mx.google.com>
next in thread | previous in thread | raw e-mail | index | archive | help
08.02.2011 21:47, rozhuk.im@gmail.com пишет: >> -----Original Message----- >> From: Sergey Matveychuk [mailto:sem@FreeBSD.org] >> Sent: Wednesday, February 09, 2011 12:53 AM >> To: Rozhuk.IM@gmail.com >> Cc: freebsd-net@freebsd.org >> Subject: Re: divert rewrite >> >> 08.02.2011 19:08, rozhuk.im@gmail.com wrote: >>> Did you try ng_ether + ng_ksocket? >>> It can translate Ethernet frames incapsulated to udp to user space >> receiver. >> >> The idea is catch packets from firewall (ng_ipfw, ng_nat was mentioned >> by mistake) and pass them to user space module that do some processing >> and puts back the packets into firewall (for rules with `diverted' >> keyword). >> >> It works now for IPv4 with `divert' and doesn't with IPv6. > > I know how divert works, google: uTPControl ;) > Its simple for developmet, stable, but uses many CPU. > > With ng_ether + ng_ksocket you can send custom Ethernet frames. > There is some node that can filter traffic, for IPv6 you need allow 1 or 2 ethernet types to pass. I know. But I've written a module for conjunction with ipfw. It makes a decision by some criteria to pass a traffic or to block it. Administrators in our nets decide what kind traffic to pass to my module (mostly TCP SYN and few UDP) in their firewalls. So a conjection with ipfw is the goal.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4D519C1F.9020205>