diff options
| author | phk <phk@FreeBSD.org> | 2001-02-13 14:12:37 +0000 |
|---|---|---|
| committer | phk <phk@FreeBSD.org> | 2001-02-13 14:12:37 +0000 |
| commit | be4fee4a9b95feb53ff3469bab486e71c7ef750e (patch) | |
| tree | 7a462819b17f833cc6f3bb95b5c92c8df675db8e /sys/netinet/ip_fw.c | |
| parent | 56b912587564e3c12be17e5965e983c50b5c368a (diff) | |
| download | FreeBSD-src-be4fee4a9b95feb53ff3469bab486e71c7ef750e.zip FreeBSD-src-be4fee4a9b95feb53ff3469bab486e71c7ef750e.tar.gz | |
Introduce a new feature in IPFW: Check of the source or destination
address is configured on a interface. This is useful for routers with
dynamic interfaces. It is now possible to say:
0100 allow tcp from any to any established
0200 skipto 1000 tcp from any to any
0300 allow ip from any to any
1000 allow tcp from 1.2.3.4 to me 22
1010 deny tcp from any to me 22
1020 allow tcp from any to any
and not have to worry about the behaviour if dynamic interfaces configure
new IP numbers later on.
The check is semi expensive (traverses the interface address list)
so it should be protected as in the above example if high performance
is a requirement.
Diffstat (limited to 'sys/netinet/ip_fw.c')
| -rw-r--r-- | sys/netinet/ip_fw.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/netinet/ip_fw.c b/sys/netinet/ip_fw.c index 66dc6f1..8a53b1f 100644 --- a/sys/netinet/ip_fw.c +++ b/sys/netinet/ip_fw.c @@ -47,6 +47,7 @@ #include <net/route.h> #include <netinet/in.h> #include <netinet/in_systm.h> +#include <netinet/in_var.h> #include <netinet/in_pcb.h> #include <netinet/ip.h> #include <netinet/ip_var.h> @@ -947,6 +948,7 @@ ip_fw_chk(struct ip **pip, int hlen, struct ip_fw *f = NULL, *rule = NULL; struct ip *ip = *pip; struct ifnet *const rif = (*m)->m_pkthdr.rcvif; + struct ifnet *tif; u_short offset = 0 ; u_short src_port = 0, dst_port = 0; struct in_addr src_ip, dst_ip; /* XXX */ @@ -1111,6 +1113,16 @@ again: if ((f->fw_flg & IP_FW_F_FRAG) && offset == 0 ) continue; + if (f->fw_flg & IP_FW_F_SME) { + INADDR_TO_IFP(src_ip, tif); + if (tif == NULL) + continue; + } + if (f->fw_flg & IP_FW_F_DME) { + INADDR_TO_IFP(dst_ip, tif); + if (tif == NULL) + continue; + } /* If src-addr doesn't match, not this rule. */ if (((f->fw_flg & IP_FW_F_INVSRC) != 0) ^ ((src_ip.s_addr & f->fw_smsk.s_addr) != f->fw_src.s_addr)) |
