Add ipfw support to MAC address tables.

The l2 filter implementation on ipfw works with MAC address pairs as it happens on wire (first destination and then source).

The table entries works in the same way, but the MAC address pair has to be passed in a single argument:

$ ipfw table create l2 type mac
$ ipfw table add "00:01:02:03:04:05 0a:0b:0c:0d:0e:0f"
added:  00:01:02:03:04:05 0a:0b:0c:0d:0e:0f 0
$ ipfw table add "00:01:02:03:04:05 any"
added:  00:01:02:03:04:05 any 0
$ ipfw table l2 add "any 0a:0b:0c:0d:0e:0f"
added:  any 0a:0b:0c:0d:0e:0f 0

The MAC tables can also hold an optinal value used to implement additional features (skipto, fib, pipe, tag, nat, ...).
$ ipfw table l2 add "00:01:02:03:04:05 0a:0b:0c:0d:0e:ff" 1234
added:  00:01:02:03:04:05 0a:0b:0c:0d:0e:ff 1234
$ ipfw table l2 list
--- table(l2), set(0) ---
 00:01:02:03:04:05 0a:0b:0c:0d:0e:0f 0
 any 0a:0b:0c:0d:0e:0f 0
 00:01:02:03:04:05 any 0
 00:01:02:03:04:05 0a:0b:0c:0d:0e:ff 1234

Rule example:
$ ipfw add pass MAC 1:2:3:4:5:6 2:3:4:5:6:7 via igb0
00100 allow ip from any to any MAC 01:02:03:04:05:06 02:03:04:05:06:07 via igb0
$ ipfw add pass MAC table\(l2\) via igb0
00000 allow ip from any to any MAC table(l2) via igb0
$ ipfw list
00100 allow ip from any to any MAC 01:02:03:04:05:06 02:03:04:05:06:07 via igb0
00200 allow ip from any to any MAC table(l2) via igb0
00300 allow ip from any to any
65535 deny ip from any to any

1 files changed, 2 insertions, 0 deletions

diff --git a/sbin/ipfw/ipfw2.h b/sbin/ipfw/ipfw2.h
index b7f8c0b..a093505 100644
--- a/sbin/ipfw/ipfw2.h
+++ b/sbin/ipfw/ipfw2.h
@@ -306,6 +306,8 @@ struct in6_addr;
 void n2mask(struct in6_addr *mask, int n);
 int contigmask(uint8_t *p, int len);
 
+void get_mac_addr_mask(const char *p, uint8_t *addr, uint8_t *mask);
+
 /*
  * Forward declarations to avoid include way too many headers.
  * C does not allow duplicated typedefs, so we use the base struct