From owner-freebsd-pf@FreeBSD.ORG Tue Jul 18 17:30:59 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A746D16A4DA for ; Tue, 18 Jul 2006 17:30:59 +0000 (UTC) (envelope-from rajkumars@gmail.com) Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.172]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6488643D64 for ; Tue, 18 Jul 2006 17:30:52 +0000 (GMT) (envelope-from rajkumars@gmail.com) Received: by ug-out-1314.google.com with SMTP id m2so28673uge for ; Tue, 18 Jul 2006 10:30:51 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=t0S/WlY6TStx9YyE7lNAst0Jsgjm07tjNZtTxQPxZ+NOjibK28GKmBBtZqPWTdZnlSqoTwEIBL15gRX9HHSOYvXq2efZpjJ578XRW//osG6IHfGkUHx85N9poZu8P668iTPJG5/I/UQTeHBuj0BvVWD5EPUi8DJuZdY7wpqdcxo= Received: by 10.78.178.5 with SMTP id a5mr1668084huf; Tue, 18 Jul 2006 10:30:51 -0700 (PDT) Received: by 10.78.120.13 with HTTP; Tue, 18 Jul 2006 10:30:51 -0700 (PDT) Message-ID: <64de5c8b0607181030h64d7d539r788ba7bbc6841e4d@mail.gmail.com> Date: Tue, 18 Jul 2006 23:00:51 +0530 From: "Rajkumar S" To: freebsd-pf@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: Program to add/delete a rule from pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2006 17:30:59 -0000 Hi, I am trying to do a pf module for snortsam, that requires a function to add and delete rules, much like iptables -A and -D As pfctl does not support deletion of rules, and as reloading all rules every time a new rule has to be added or deleted is a pita, I am trying to write a program to do it, which will be used to write snortsam plugin. After going through sources of pfctl and some other programs, I wrote a skeltel program to add a rule via ioctl, but that is not working. My feeling is that I need to do some more init of pfioc_rule and pf_rule structures to get it working, but the code of pfctl is bit dense to get a clear understanding. It will be great if some one here can lend a helping hand! with warm regards, raj #include #include #include #include #include #include #include #define IP_PROTO_TCP 6 int main (){ struct pfioc_trans trans; struct pfioc_trans_e trans_e; struct pf_rule pr; struct pfioc_rule pr_ioctl; struct pfioc_pooladdr pp; struct hostent *h; char *pf_device = "/dev/pf"; char anchor[100]; int dev; int mode = O_RDWR; dev = open(pf_device, mode); bzero(&trans, sizeof(trans)); bzero(&trans_e, sizeof(trans_e)); bzero(&pr, sizeof(pr)); bzero(&pp, sizeof(pp)); bzero(&h, sizeof(h)); strlcpy(trans_e.anchor, "snortsam", sizeof(trans_e.anchor)); trans_e.rs_num = PF_RULESET_FILTER; trans.size = 1; trans.esize = sizeof(struct pfioc_trans_e); trans.array = &trans_e; if (ioctl(dev, DIOCXBEGIN, &trans)) printf ("Error\n"); memcpy(pp.anchor, anchor, sizeof(pp.anchor)); pp.r_action = PF_DROP; pp.r_num = 0; if (ioctl(dev, DIOCGETADDRS, &pp)) printf ("DIOCGETADDRS\n"); pr.action = PF_DROP; pr.direction = PF_IN; pr.af = AF_INET; pr.proto = IP_PROTO_TCP; pr_ioctl.ticket = trans_e.ticket; pr_ioctl.pool_ticket = pp.ticket; memcpy(&pr_ioctl.rule, &pr, sizeof(pr_ioctl.rule)); strlcpy(pr_ioctl.anchor_call, anchor, sizeof(pr_ioctl.anchor_call)); if (ioctl(dev, DIOCADDRULE, &pr_ioctl)) printf ("DIOCADDRULE\n"); close (dev); }