From owner-freebsd-pf@FreeBSD.ORG Tue Jul 18 17:50:14 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 472CE16A4E0 for ; Tue, 18 Jul 2006 17:50:14 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.183]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9616443D46 for ; Tue, 18 Jul 2006 17:50:13 +0000 (GMT) (envelope-from max@love2party.net) Received: from [88.64.182.53] (helo=amd64.laiers.local) by mrelayeu.kundenserver.de (node=mrelayeu6) with ESMTP (Nemesis), id 0ML29c-1G2thz2VAu-0005bw; Tue, 18 Jul 2006 19:50:11 +0200 From: Max Laier Organization: FreeBSD To: freebsd-pf@freebsd.org Date: Tue, 18 Jul 2006 19:50:04 +0200 User-Agent: KMail/1.9.3 References: <64de5c8b0607181030h64d7d539r788ba7bbc6841e4d@mail.gmail.com> In-Reply-To: <64de5c8b0607181030h64d7d539r788ba7bbc6841e4d@mail.gmail.com> X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGdu+2]; R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1429672.VqGyfOLyfm"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200607181950.10304.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de login:61c499deaeeba3ba5be80f48ecc83056 Cc: Subject: Re: Program to add/delete a rule from pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2006 17:50:14 -0000 --nextPart1429672.VqGyfOLyfm Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Tuesday 18 July 2006 19:30, Rajkumar S wrote: > Hi, > > I am trying to do a pf module for snortsam, that requires a function > to add and delete > rules, much like iptables -A and -D As pfctl does not support deletion > of rules, and as > reloading all rules every time a new rule has to be added or deleted > is a pita, I am > trying to write a program to do it, which will be used to write snortsam > plugin. > > After going through sources of pfctl and some other programs, I wrote > a skeltel program > to add a rule via ioctl, but that is not working. Just a short hint rather than debugging your code: Did you look into using= =20 anchors like spamd and authpf do? That way it will be a simple matter of=20 flushing an anchor ruleset and the users of your plugin can have some say=20 where your rules end up by placing the anchor(s) accordingly. > My feeling is that I need to do some more init of pfioc_rule and > pf_rule structures to > get it working, but the code of pfctl is bit dense to get a clear > understanding. It will > be great if some one here can lend a helping hand! > > with warm regards, > > raj > > > #include > #include > #include > #include > #include > #include > #include > > #define IP_PROTO_TCP 6 > > int main (){ > struct pfioc_trans trans; > struct pfioc_trans_e trans_e; > struct pf_rule pr; > struct pfioc_rule pr_ioctl; > struct pfioc_pooladdr pp; > > struct hostent *h; > > char *pf_device =3D "/dev/pf"; > char anchor[100]; > int dev; > int mode =3D O_RDWR; > > dev =3D open(pf_device, mode); > > bzero(&trans, sizeof(trans)); > bzero(&trans_e, sizeof(trans_e)); > bzero(&pr, sizeof(pr)); > bzero(&pp, sizeof(pp)); > bzero(&h, sizeof(h)); > > strlcpy(trans_e.anchor, "snortsam", sizeof(trans_e.anchor)); > trans_e.rs_num =3D PF_RULESET_FILTER; > > trans.size =3D 1; > trans.esize =3D sizeof(struct pfioc_trans_e); > trans.array =3D &trans_e; > if (ioctl(dev, DIOCXBEGIN, &trans)) printf ("Error\n"); > > memcpy(pp.anchor, anchor, sizeof(pp.anchor)); > pp.r_action =3D PF_DROP; > pp.r_num =3D 0; > if (ioctl(dev, DIOCGETADDRS, &pp)) printf ("DIOCGETADDRS\n"); > > pr.action =3D PF_DROP; > pr.direction =3D PF_IN; > pr.af =3D AF_INET; > pr.proto =3D IP_PROTO_TCP; > pr_ioctl.ticket =3D trans_e.ticket; > pr_ioctl.pool_ticket =3D pp.ticket; > memcpy(&pr_ioctl.rule, &pr, sizeof(pr_ioctl.rule)); > strlcpy(pr_ioctl.anchor_call, anchor, > sizeof(pr_ioctl.anchor_call)); > > if (ioctl(dev, DIOCADDRULE, &pr_ioctl)) printf ("DIOCADDRULE\n"); > close (dev); > } > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart1429672.VqGyfOLyfm Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (FreeBSD) iD8DBQBEvR9SXyyEoT62BG0RAnuNAJ97Z+bjUJCfQdxr2cU0rlL4QwA9owCfb9cK vajzEpiWARfbCj2zk1bYKvI= =KHGZ -----END PGP SIGNATURE----- --nextPart1429672.VqGyfOLyfm--