Add a ng_ipfw node, implementing a quick and simple interface between

ipfw(4) and netgraph(4) facilities.

Reviewed by:	andre, brooks, julian

1 files changed, 22 insertions, 0 deletions

diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c
index 12f1432..c495c3a 100644
--- a/sbin/ipfw/ipfw2.c
+++ b/sbin/ipfw/ipfw2.c
@@ -198,6 +198,8 @@ enum tokens {
 	TOK_QUEUE,
 	TOK_DIVERT,
 	TOK_TEE,
+	TOK_NETGRAPH,
+	TOK_NGTEE,
 	TOK_FORWARD,
 	TOK_SKIPTO,
 	TOK_DENY,
@@ -300,6 +302,8 @@ struct _s_x rule_actions[] = {
 	{ "queue",		TOK_QUEUE },
 	{ "divert",		TOK_DIVERT },
 	{ "tee",		TOK_TEE },
+	{ "netgraph",		TOK_NETGRAPH },
+	{ "ngtee",		TOK_NGTEE },
 	{ "fwd",		TOK_FORWARD },
 	{ "forward",		TOK_FORWARD },
 	{ "skipto",		TOK_SKIPTO },
@@ -1193,6 +1197,14 @@ show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth)
 			printf("tee %u", cmd->arg1);
 			break;
 
+		case O_NETGRAPH:
+			printf("netgraph %u", cmd->arg1);
+			break;
+
+		case O_NGTEE:
+			printf("ngtee %u", cmd->arg1);
+			break;
+
 		case O_FORWARD_IP:
 		    {
 			ipfw_insn_sa *s = (ipfw_insn_sa *)cmd;
@@ -3123,6 +3135,16 @@ add(int ac, char *av[])
 		ac--; av++;
 		break;
 
+	case TOK_NETGRAPH:
+	case TOK_NGTEE:
+		action->opcode = (i == TOK_NETGRAPH ) ? O_NETGRAPH : O_NGTEE;
+		NEED1("missing netgraph cookie");
+		action->arg1 = strtoul(*av, NULL, 0);
+		if (action->arg1 == 0)
+			errx(EX_DATAERR, "illegal netgraph cookie");
+		ac--; av++;
+		break;
+
 	case TOK_FORWARD: {
 		ipfw_insn_sa *p = (ipfw_insn_sa *)action;
 		char *s, *end;