RE: FW: Curiosity in IPFW/Freebsd bridge. [more] 802.1q VLAN at fault?

From: Andrew Seguin (asegu_at_borgtech.ca)
Date: 12/17/04

  • Next message: Robert Blacquiere: "Ralink RT2500 wireless" 
    To: "'Nickolay A. Kritsky'" <nkritsky@star-sw.com>
Date: Fri, 17 Dec 2004 15:28:06 +0100

    Would changing over to RELENG_4 remove these headaches for me?

    Maybe if I patch the code you pointed out to be ETHERTYPE_VLAN instead of
    _IP, then ipfw will filter only VLAN traffic instead of IP traffic. This I
    would be willing to do until a patch became mainstream.

    So if the above works, I could just remove remote-console access and leave
    the box without an IP address, and IPFW would happily work with filters such
    as "deny ip from any to any $PORT"...

    Thank you for your help to date, I shall stay tuned to any other ideas!

    Andrew

    -----Original Message-----
    From: Nickolay A. Kritsky [mailto:nkritsky@star-sw.com]
    Sent: Friday, December 17, 2004 1:42 PM
    To: Andrew Seguin
    Cc: freebsd-net@freebsd.org
    Subject: Re: FW: Curiosity in IPFW/Freebsd bridge. [more] 802.1q VLAN at
    fault?

    Hello Andrew,

    Friday, December 17, 2004, 12:47:46 PM, Andrew Seguin wrote:

    ...

    I cannot say for sure, because I do not have any 5.x filtering bridge
    right now. But after reading some sources I think I understand what is
    happening:

    bdg_forward in bridge.c is calling ipfw or another packet filter:
            /*
             * NetBSD-style generic packet filter, pfil(9), hooks.
             * Enables ipf(8) in bridging.
             */
            if (!IPFW_LOADED) { /* XXX: Prevent ipfw from being run twice. */
            if (inet_pfil_hook.ph_busy_count >= 0 &&
                m0->m_pkthdr.len >= sizeof(struct ip) &&
                ntohs(save_eh.ether_type) == ETHERTYPE_IP) {

    Note the last line: for VLAN tagged packet the field
    save_eh.ether_type would be ETHERTYPE_VLAN instead of ETHERTYPE_IP and
    no filtering will take place. That is what I think is going on. Who is
    the current maintainer of bridge code in FreeBSD? 

    -- 
Best regards,
;  Nickolay A. Kritsky
; SysAdmin STAR Software LLC
; mailto:nkritsky@star-sw.com
-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.296 / Virus Database: 265.5.4 - Release Date: 12/15/2004
 
-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.296 / Virus Database: 265.5.4 - Release Date: 12/15/2004
 
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Robert Blacquiere: "Ralink RT2500 wireless"

    Relevant Pages

    • Re: XPe SP2 with Domain Participation losing after 30 days
      ... Debbie, ... I knew about the new Filter but I didn't know it was officially released. ... I didn't know the EWF Registry filter patch was officially released. ... I do know that EWF version in SP2 does not have the functionality of the Registry filter. ...
      (microsoft.public.windowsxp.embedded)
    • Re: [PATCH] allow root to modify raw scsi command permissions list
      ... > My patch leaves the defaults as what are currently in the kernel. ... Yes but what I wanted to say the filter currently in the kernel is not ... purpose of giving read/write permissions in this case. ... The starting point must be safe and it can be relaxed. ...
      (Linux-Kernel)
    • Re: IPFW and IPv6 TCP timeout problem
      ... TCP connections after a short timeout. ... Luigi Rizzo about it but he cannot help with the IPv6 part of the ipfw. ... The PR includes a patch, it just needs somebody to commit it. ...
      (freebsd-net)
    • Re: kern/113548: [dummynet] [patch] system hangs with dummynet queues
      ... Subject: kern/113548: [dummynet] system hangs with dummynet queues ... ipfw tags are stored as mbuf_tags. ... Thanks for a fast reply and for the patch. ...
      (freebsd-net)
    • Re: floating check boxes on web pages
      ... Might re-read my post, the patch IS sp1. ... for Publisher help: ... The form control check boxes looked fine ... > the whole filter web ...
      (microsoft.public.publisher.webdesign)
    • Quantcast