From owner-freebsd-current@FreeBSD.ORG Sat Jun 10 21:05:50 2006 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3B15316A597 for ; Sat, 10 Jun 2006 21:05:50 +0000 (UTC) (envelope-from vadim_nuclight@mail.ru) Received: from mx6.mail.ru (mx6.mail.ru [194.67.23.26]) by mx1.FreeBSD.org (Postfix) with ESMTP id 57B56445F9 for ; Sat, 10 Jun 2006 20:51:00 +0000 (GMT) (envelope-from vadim_nuclight@mail.ru) Received: from [82.211.136.13] (port=24231 helo=nuclight.avtf.net) by mx6.mail.ru with esmtp id 1FpAPw-000AbI-00 for freebsd-current@freebsd.org; Sun, 11 Jun 2006 00:50:53 +0400 Organization: AVTF TPU Hostel To: "freebsd-current@freebsd.org" Message-ID: Date: Sun, 11 Jun 2006 03:50:28 +0700 From: "Vadim Goncharov" Content-Type: text/plain; format=flowed; delsp=yes; charset=koi8-r MIME-Version: 1.0 Content-Transfer-Encoding: 8bit User-Agent: Opera M2/7.54 (Win32, build 3865) Subject: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Jun 2006 21:05:50 -0000 Hello All! I wrote new netgraph(4) node, called ng_tag, able to match packets by their mbuf_tags(9) and assign new tags to mbufs. This can be used for many things in the kernel network subsystem, but particularly useful with recently added ipfw(8) tag/tagged functionality (will be MFCed to RELENG_6 after Jun 24). With this node, in conjunction with ng_bpf(4), I was able to match and block (perhaps shaping is also possible, but this relies solely on ipfw) DirectConnect P2P data connections traffic - you know, they're using random ports, so you can't match them with usual firewall rules and must check data payload contents of the packets. See man page for example of how to do this. Download files from here: http://antigreen.org/vadim/freebsd/ng_tag/ Then do: make kldload ./ng_tag.ko Man page can be viewed as: cat ng_tag.4 | /usr/bin/tbl | /usr/bin/groff -S -Wall -mtty-char -man \ -Tascii | /usr/bin/col | more -s Please especially test tags with non-zero tag_len, if you can (though it's not needed for ipfw). P.S. BTW, what is correct subject prefix for new contributions? I think [PATCH] is not correct as these are new files, not patch :) -- WBR, Vadim Goncharov