Hi ppl!

I need to use direct access ti ipfw rules via raw sockets instead of some scripts using ipfw utility.

I looked into ipfw sources and made a simple program to test if I could add a simple rule this way.
Just rewrote pieces of original code intomy program w/out any serious change.

But setsockopt() always return EINVAL and string msg "Invalid argument".
And no details. Hence I'm in a fix. Icannot get what's wrong indeed.

Here I place my code (short anough).
Any advice would be appritiated.
Maybe some links to some docs - I failed to find anything but a very short info in manpages.

#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>
#include <netinet/in.h>
#include <netinet/ip_fw.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <errno.h>

int test(void)

int sock,res,sz;
struct ip_fw rule;

if (sock==-1) {printf("\n\nsoket() failed with \"%s\"\n\n",strerror(errno)); return -1;};

printf("\nsock = %i\n",sock);

memset(&rule,0,sizeof(struct ip_fw));

rule.fw_number = 700;
rule.fw_flg = IP_FW_F_DENY;
rule.fw_src.s_addr = inet_addr("");
rule.fw_smsk.s_addr = inet_addr("");
rule.fw_dst.s_addr = inet_addr("");
rule.fw_dmsk.s_addr = inet_addr("");

rule.fw_prot = IPPROTO_IP;

sz = sizeof(struct ip_fw);
res = setsockopt(sock,IPPROTO_IP,IP_FW_ADD,&rule,&sz);
if (res==-1) {printf("\n\nsetsockopt() failed with \"%s\"\n\n",strerror(errno)); return -1;};

return 0;

int main(void)

return 0;

Alexander Komratov

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message

Reply via email to