Larry,
As you're using OpenSolaris then the attached patches might
be of use to you. They supply "local" variations of the "physical"
hooks. As this is just a rough hack on the source code, i can
only say it compiles but you're more than welcome to try it out
and report back.
Although <sys/neti.h> is changed by this patch, you only need
to recompile and install a new "ip" module.
Good luck and have fun with the patch.
Cheers,
Darren
------- usr/src/uts/common/inet/ip.h -------
Index: usr/src/uts/common/inet/ip.h
*** /biscuit/onnv/usr/src/uts/common/inet/ip.h Thu Sep 27 10:18:19 2007
--- /biscuit/onnv_local/usr/src/uts/common/inet/ip.h Wed Oct 17 20:24:26 2007
***************
*** 28,34 ****
#ifndef _INET_IP_H
#define _INET_IP_H
! #pragma ident "@(#)ip.h 1.236 07/09/20 SMI"
#ifdef __cplusplus
extern "C" {
--- 28,34 ----
#ifndef _INET_IP_H
#define _INET_IP_H
! #pragma ident "%Z%%M% %I% %E% SMI"
#ifdef __cplusplus
extern "C" {
***************
*** 2896,2901 ****
--- 2896,2909 ----
extern struct module_info ip_mod_info;
+ #define HOOKS4_INTERESTED_LOCAL_IN(ipst) \
+ ((ipst)->ips_ip4_local_in_event.he_interested)
+ #define HOOKS6_INTERESTED_LOCAL_IN(ipst) \
+ ((ipst)->ips_ip6_local_in_event.he_interested)
+ #define HOOKS4_INTERESTED_LOCAL_OUT(ipst) \
+ ((ipst)->ips_ip4_local_out_event.he_interested)
+ #define HOOKS6_INTERESTED_LOCAL_OUT(ipst) \
+ ((ipst)->ips_ip6_local_out_event.he_interested)
#define HOOKS4_INTERESTED_PHYSICAL_IN(ipst) \
((ipst)->ips_ip4_physical_in_event.he_interested)
#define HOOKS6_INTERESTED_PHYSICAL_IN(ipst) \
------- usr/src/uts/common/inet/ip/ip.c -------
Index: usr/src/uts/common/inet/ip/ip.c
*** /biscuit/onnv/usr/src/uts/common/inet/ip/ip.c Thu Sep 27 10:18:20 2007
--- /biscuit/onnv_local/usr/src/uts/common/inet/ip/ip.c Wed Oct 17 22:14:25 2007
***************
*** 25,31 ****
*/
/* Copyright (c) 1990 Mentat Inc. */
! #pragma ident "@(#)ip.c 1.523 07/09/20 SMI"
#include <sys/types.h>
#include <sys/stream.h>
--- 25,31 ----
*/
/* Copyright (c) 1990 Mentat Inc. */
! #pragma ident "%Z%%M% %I% %E% SMI"
#include <sys/types.h>
#include <sys/stream.h>
***************
*** 14269,14274 ****
--- 14269,14284 ----
uint16_t hcksumflags;
ip_stack_t *ipst = ill->ill_ipst;
+ DTRACE_PROBE4(ip4__local__in__start, ill_t *, ill, ill_t *, NULL,
+ ipha_t *, ipha, mblk_t *, mp);
+
+ FW_HOOKS(ipst->ips_ip4_local_in_event,
+ ipst->ips_ipv4firewall_local_in, ill, NULL, ipha, mp, mp, ipst);
+
+ DTRACE_PROBE1(ip4__local__in__end, mblk_t *, mp);
+ if (mp == NULL)
+ return (NULL);
+
q = *qp;
BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts);
***************
*** 14462,14467 ****
--- 14472,14487 ----
{
ip_stack_t *ipst = ill->ill_ipst;
+ DTRACE_PROBE4(ip4__local__in__start, ill_t *, ill, ill_t *, NULL,
+ ipha_t *, ipha, mblk_t *, mp);
+
+ FW_HOOKS(ipst->ips_ip4_local_in_event,
+ ipst->ips_ipv4firewall_local_in, ill, NULL, ipha, mp, mp, ipst);
+
+ DTRACE_PROBE1(ip4__local__in__end, mblk_t *, mp);
+ if (mp == NULL)
+ return (B_TRUE);
+
BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets,
ntohs(ipha->ipha_length));
***************
*** 15240,15245 ****
--- 15260,15276 ----
q = ire->ire_rfq;
}
+ DTRACE_PROBE4(ip4__local__in__start, ill_t *, ill, ill_t *,
+ NULL, ipha_t *, ipha, mblk_t *, first_mp);
+
+ FW_HOOKS(ipst->ips_ip4_local_in_event,
+ ipst->ips_ipv4firewall_local_in,
+ ill, NULL, ipha, first_mp, mp, ipst);
+
+ DTRACE_PROBE1(ip4__local__in__end, mblk_t *, first_mp);
+ if (first_mp == NULL)
+ continue;
+
switch (ipha->ipha_protocol) {
case IPPROTO_TCP:
ASSERT(first_mp == mp);
***************
*** 22578,22584 ****
DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL,
ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha,
mblk_t *, mp);
! FW_HOOKS(ipst->ips_ip4_physical_out_event,
ipst->ips_ipv4firewall_physical_out,
NULL, ire->ire_ipif->ipif_ill, ipha, mp, mp, ipst);
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp);
--- 22609,22620 ----
DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL,
ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha,
mblk_t *, mp);
! FW_HOOKS(ipst->ips_ip4_local_out_event,
! ipst->ips_ipv4firewall_local_out,
! NULL, ire->ire_ipif->ipif_ill, ipha, mp, mp, ipst);
! if (mp == NULL)
! goto release_ire_and_ill;
! FW_HOOKS(ipst->ips_ip4_local_out_event,
ipst->ips_ipv4firewall_physical_out,
NULL, ire->ire_ipif->ipif_ill, ipha, mp, mp, ipst);
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp);
***************
*** 23179,23184 ****
--- 23215,23226 ----
ill_t *, NULL,
ill_t *, out_ill,
ipha_t *, ipha, mblk_t *, mp);
+ FW_HOOKS(ipst->ips_ip4_local_out_event,
+ ipst->ips_ipv4firewall_local_out,
+ NULL, ire->ire_ipif->ipif_ill, ipha,
+ mp, mp, ipst);
+ if (mp == NULL)
+ goto release_ire_and_ill_2;
FW_HOOKS(ipst->ips_ip4_physical_out_event,
ipst->ips_ipv4firewall_physical_out,
NULL, out_ill, ipha, mp, mp, ipst);
***************
*** 24470,24479 ****
ill_t *, NULL, ill_t *, out_ill,
ipha_t *, ipha, mblk_t *, xmit_mp);
! FW_HOOKS(ipst->ips_ip4_physical_out_event,
! ipst->ips_ipv4firewall_physical_out,
NULL, out_ill, ipha, xmit_mp, mp, ipst);
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, xmit_mp);
if (xmit_mp != NULL) {
--- 24512,24527 ----
ill_t *, NULL, ill_t *, out_ill,
ipha_t *, ipha, mblk_t *, xmit_mp);
! FW_HOOKS(ipst->ips_ip4_local_out_event,
! ipst->ips_ipv4firewall_local_out,
NULL, out_ill, ipha, xmit_mp, mp, ipst);
+ if (xmit_mp != NULL) {
+ FW_HOOKS(ipst->ips_ip4_physical_out_event,
+ ipst->ips_ipv4firewall_physical_out,
+ NULL, out_ill, ipha, xmit_mp, mp, ipst);
+ }
+
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, xmit_mp);
if (xmit_mp != NULL) {
***************
*** 24769,24778 ****
ill_t *, NULL, ill_t *, out_ill,
ipha_t *, ipha, mblk_t *, xmit_mp);
! FW_HOOKS(ipst->ips_ip4_physical_out_event,
! ipst->ips_ipv4firewall_physical_out,
NULL, out_ill, ipha, xmit_mp, mp, ipst);
DTRACE_PROBE1(ip4__physical__out__end,
mblk_t *, xmit_mp);
--- 24817,24832 ----
ill_t *, NULL, ill_t *, out_ill,
ipha_t *, ipha, mblk_t *, xmit_mp);
! FW_HOOKS(ipst->ips_ip4_local_out_event,
! ipst->ips_ipv4firewall_local_out,
NULL, out_ill, ipha, xmit_mp, mp, ipst);
+ if (xmit_mp != NULL) {
+ FW_HOOKS(ipst->ips_ip4_physical_out_event,
+ ipst->ips_ipv4firewall_physical_out,
+ NULL, out_ill, ipha, xmit_mp, mp, ipst);
+ }
+
DTRACE_PROBE1(ip4__physical__out__end,
mblk_t *, xmit_mp);
***************
*** 26271,26279 ****
DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL,
ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha1,
mblk_t *, ipsec_mp);
! FW_HOOKS(ipst->ips_ip4_physical_out_event,
! ipst->ips_ipv4firewall_physical_out,
NULL, ire->ire_ipif->ipif_ill, ipha1, ipsec_mp, mp, ipst);
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, ipsec_mp);
if (ipsec_mp == NULL)
goto drop_pkt;
--- 26325,26339 ----
DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL,
ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha1,
mblk_t *, ipsec_mp);
! FW_HOOKS(ipst->ips_ip4_local_out_event,
! ipst->ips_ipv4firewall_local_out,
NULL, ire->ire_ipif->ipif_ill, ipha1, ipsec_mp, mp, ipst);
+ if (ipsec_mp != NULL) {
+ FW_HOOKS(ipst->ips_ip4_physical_out_event,
+ ipst->ips_ipv4firewall_physical_out,
+ NULL, ire->ire_ipif->ipif_ill, ipha1,
+ ipsec_mp, mp, ipst);
+ }
DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, ipsec_mp);
if (ipsec_mp == NULL)
goto drop_pkt;
------- usr/src/uts/common/inet/ip/ip6.c -------
Index: usr/src/uts/common/inet/ip/ip6.c
*** /biscuit/onnv/usr/src/uts/common/inet/ip/ip6.c Wed Sep 19 13:07:02 2007
--- /biscuit/onnv_local/usr/src/uts/common/inet/ip/ip6.c Wed Oct 17 22:01:18 2007
***************
*** 26,32 ****
* Copyright (c) 1990 Mentat Inc.
*/
! #pragma ident "@(#)ip6.c 1.188 07/08/30 SMI"
#include <sys/types.h>
#include <sys/stream.h>
--- 26,32 ----
* Copyright (c) 1990 Mentat Inc.
*/
! #pragma ident "%Z%%M% %I% %E% SMI"
#include <sys/types.h>
#include <sys/stream.h>
***************
*** 11408,11414 ****
UPDATE_OB_PKT_COUNT(ire);
ire->ire_last_used_time = lbolt;
ASSERT(mp == first_mp);
! ip_xmit_v6(mp, ire, reachable, connp, caller, NULL);
} else {
DTRACE_PROBE4(ip6__loopback__out__start,
ill_t *, NULL, ill_t *, ill,
--- 11408,11426 ----
UPDATE_OB_PKT_COUNT(ire);
ire->ire_last_used_time = lbolt;
ASSERT(mp == first_mp);
!
! DTRACE_PROBE4(ip6__local__out__start,
! ill_t *, NULL, ill_t *, ill,
! ip6_t *, ip6h, mblk_t *, mp);
!
! FW_HOOKS6(ipst->ips_ip6_local_out_event,
! ipst->ips_ipv6firewall_local_out,
! NULL, ill, ip6h, mp, mp, ipst);
!
! DTRACE_PROBE1(ip6__local__out__end, mblk_t *, mp);
!
! if (mp != NULL)
! ip_xmit_v6(mp, ire, reachable, connp, caller, NULL);
} else {
DTRACE_PROBE4(ip6__loopback__out__start,
ill_t *, NULL, ill_t *, ill,
***************
*** 11852,11859 ****
hmp0->b_band = dmp->b_band;
UPDATE_OB_PKT_COUNT(ire);
ire->ire_last_used_time = lbolt;
! ip_xmit_v6(hmp0, ire, reachable | IP6_NO_IPPOLICY, connp,
! caller, NULL);
reachable = 0; /* No need to redo state machine in loop */
BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
offset += mlen;
--- 11864,11884 ----
hmp0->b_band = dmp->b_band;
UPDATE_OB_PKT_COUNT(ire);
ire->ire_last_used_time = lbolt;
!
! DTRACE_PROBE4(ip6__local__out__start,
! ill_t *, NULL, ill_t *, ill,
! ip6_t *, ip6h, mblk_t *, hmp0);
!
! FW_HOOKS6(ipst->ips_ip6_local_out_event,
! ipst->ips_ipv6firewall_local_out,
! NULL, ill, ip6h, hmp0, hmp0, ipst);
!
! DTRACE_PROBE1(ip6__local__out__end, mblk_t *, mp);
!
! if (hmp0 != NULL) {
! ip_xmit_v6(hmp0, ire, reachable | IP6_NO_IPPOLICY,
! connp, caller, NULL);
! }
reachable = 0; /* No need to redo state machine in loop */
BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
offset += mlen;
------- usr/src/uts/common/inet/ip/ip_netinfo.c -------
Index: usr/src/uts/common/inet/ip/ip_netinfo.c
*** /biscuit/onnv/usr/src/uts/common/inet/ip/ip_netinfo.c Tue Jun 5 14:21:13 2007
--- /biscuit/onnv_local/usr/src/uts/common/inet/ip/ip_netinfo.c Wed Oct 17 20:26:38 2007
***************
*** 23,29 ****
* Use is subject to license terms.
*/
! #pragma ident "@(#)ip_netinfo.c 1.5 07/05/18 SMI"
#include <sys/param.h>
#include <sys/types.h>
--- 23,29 ----
* Use is subject to license terms.
*/
! #pragma ident "%Z%%M% %I% %E% SMI"
#include <sys/param.h>
#include <sys/types.h>
***************
*** 244,249 ****
--- 244,265 ----
"net_register_family failed for ipv4");
}
+ HOOK_EVENT_INIT(&ipst->ips_ip4_local_in_event, NH_LOCAL_IN);
+ ipst->ips_ipv4firewall_local_in = net_register_event(
+ ipst->ips_ipv4_net_data, &ipst->ips_ip4_local_in_event);
+ if (ipst->ips_ipv4firewall_local_in == NULL) {
+ cmn_err(CE_NOTE, "ipv4_hook_init: "
+ "net_register_event failed for ipv4/local_in");
+ }
+
+ HOOK_EVENT_INIT(&ipst->ips_ip4_local_out_event, NH_LOCAL_OUT);
+ ipst->ips_ipv4firewall_local_out = net_register_event(
+ ipst->ips_ipv4_net_data, &ipst->ips_ip4_local_out_event);
+ if (ipst->ips_ipv4firewall_local_out == NULL) {
+ cmn_err(CE_NOTE, "ipv4_hook_init: "
+ "net_register_event failed for ipv4/local_out");
+ }
+
HOOK_EVENT_INIT(&ipst->ips_ip4_physical_in_event, NH_PHYSICAL_IN);
ipst->ips_ipv4firewall_physical_in = net_register_event(
ipst->ips_ipv4_net_data, &ipst->ips_ip4_physical_in_event);
***************
*** 303,308 ****
--- 319,336 ----
ipst->ips_ipv4firewall_forwarding = NULL;
}
+ if (ipst->ips_ipv4firewall_local_in != NULL) {
+ if (net_unregister_event(ipst->ips_ipv4_net_data,
+ &ipst->ips_ip4_local_in_event) == 0)
+ ipst->ips_ipv4firewall_local_in = NULL;
+ }
+
+ if (ipst->ips_ipv4firewall_local_out != NULL) {
+ if (net_unregister_event(ipst->ips_ipv4_net_data,
+ &ipst->ips_ip4_local_out_event) == 0)
+ ipst->ips_ipv4firewall_local_out = NULL;
+ }
+
if (ipst->ips_ipv4firewall_physical_in != NULL) {
if (net_unregister_event(ipst->ips_ipv4_net_data,
&ipst->ips_ip4_physical_in_event) == 0)
***************
*** 351,356 ****
--- 379,400 ----
"net_register_family failed for ipv6");
}
+ HOOK_EVENT_INIT(&ipst->ips_ip6_local_in_event, NH_LOCAL_IN);
+ ipst->ips_ipv6firewall_local_in = net_register_event(
+ ipst->ips_ipv6_net_data, &ipst->ips_ip6_local_in_event);
+ if (ipst->ips_ipv6firewall_local_in == NULL) {
+ cmn_err(CE_NOTE, "ipv6_hook_init: "
+ "net_register_event failed for ipv6/local_in");
+ }
+
+ HOOK_EVENT_INIT(&ipst->ips_ip6_local_out_event, NH_LOCAL_OUT);
+ ipst->ips_ipv6firewall_local_out = net_register_event(
+ ipst->ips_ipv6_net_data, &ipst->ips_ip6_local_out_event);
+ if (ipst->ips_ipv6firewall_local_out == NULL) {
+ cmn_err(CE_NOTE, "ipv6_hook_init: "
+ "net_register_event failed for ipv6/local_out");
+ }
+
HOOK_EVENT_INIT(&ipst->ips_ip6_physical_in_event, NH_PHYSICAL_IN);
ipst->ips_ipv6firewall_physical_in = net_register_event(
ipst->ips_ipv6_net_data, &ipst->ips_ip6_physical_in_event);
***************
*** 410,415 ****
--- 454,471 ----
ipst->ips_ipv6firewall_forwarding = NULL;
}
+ if (ipst->ips_ipv6firewall_local_in != NULL) {
+ if (net_unregister_event(ipst->ips_ipv6_net_data,
+ &ipst->ips_ip6_local_in_event) == 0)
+ ipst->ips_ipv6firewall_local_in = NULL;
+ }
+
+ if (ipst->ips_ipv6firewall_local_out != NULL) {
+ if (net_unregister_event(ipst->ips_ipv6_net_data,
+ &ipst->ips_ip6_local_out_event) == 0)
+ ipst->ips_ipv6firewall_local_out = NULL;
+ }
+
if (ipst->ips_ipv6firewall_physical_in != NULL) {
if (net_unregister_event(ipst->ips_ipv6_net_data,
&ipst->ips_ip6_physical_in_event) == 0)
------- usr/src/uts/common/inet/ip_stack.h -------
Index: usr/src/uts/common/inet/ip_stack.h
*** /biscuit/onnv/usr/src/uts/common/inet/ip_stack.h Sat Sep 1 23:02:25 2007
--- /biscuit/onnv_local/usr/src/uts/common/inet/ip_stack.h Wed Oct 17 20:28:25 2007
***************
*** 27,33 ****
#ifndef _INET_IP_STACK_H
#define _INET_IP_STACK_H
! #pragma ident "@(#)ip_stack.h 1.6 07/08/23 SMI"
#ifdef __cplusplus
extern "C" {
--- 27,33 ----
#ifndef _INET_IP_STACK_H
#define _INET_IP_STACK_H
! #pragma ident "%Z%%M% %I% %E% SMI"
#ifdef __cplusplus
extern "C" {
***************
*** 405,410 ****
--- 405,412 ----
/*
* Hooks for firewalling
*/
+ hook_event_t ips_ip4_local_in_event;
+ hook_event_t ips_ip4_local_out_event;
hook_event_t ips_ip4_physical_in_event;
hook_event_t ips_ip4_physical_out_event;
hook_event_t ips_ip4_forwarding_event;
***************
*** 411,416 ****
--- 413,420 ----
hook_event_t ips_ip4_loopback_in_event;
hook_event_t ips_ip4_loopback_out_event;
hook_event_t ips_ip4_nic_events;
+ hook_event_t ips_ip6_local_in_event;
+ hook_event_t ips_ip6_local_out_event;
hook_event_t ips_ip6_physical_in_event;
hook_event_t ips_ip6_physical_out_event;
hook_event_t ips_ip6_forwarding_event;
***************
*** 418,423 ****
--- 422,429 ----
hook_event_t ips_ip6_loopback_out_event;
hook_event_t ips_ip6_nic_events;
+ hook_event_token_t ips_ipv4firewall_local_in;
+ hook_event_token_t ips_ipv4firewall_local_out;
hook_event_token_t ips_ipv4firewall_physical_in;
hook_event_token_t ips_ipv4firewall_physical_out;
hook_event_token_t ips_ipv4firewall_forwarding;
***************
*** 424,429 ****
--- 430,437 ----
hook_event_token_t ips_ipv4firewall_loopback_in;
hook_event_token_t ips_ipv4firewall_loopback_out;
hook_event_token_t ips_ipv4nicevents;
+ hook_event_token_t ips_ipv6firewall_local_in;
+ hook_event_token_t ips_ipv6firewall_local_out;
hook_event_token_t ips_ipv6firewall_physical_in;
hook_event_token_t ips_ipv6firewall_physical_out;
hook_event_token_t ips_ipv6firewall_forwarding;
------- usr/src/uts/common/sys/neti.h -------
Index: usr/src/uts/common/sys/neti.h
*** /biscuit/onnv/usr/src/uts/common/sys/neti.h Wed Mar 14 15:49:38 2007
--- /biscuit/onnv_local/usr/src/uts/common/sys/neti.h Wed Oct 17 20:27:20 2007
***************
*** 26,32 ****
#ifndef _SYS_NETI_H
#define _SYS_NETI_H
! #pragma ident "@(#)neti.h 1.2 07/01/19 SMI"
#include <netinet/in.h>
#include <sys/int_types.h>
--- 26,32 ----
#ifndef _SYS_NETI_H
#define _SYS_NETI_H
! #pragma ident "%Z%%M% %I% %E% SMI"
#include <netinet/in.h>
#include <sys/int_types.h>
***************
*** 50,55 ****
--- 50,57 ----
/*
* Event identification
*/
+ #define NH_LOCAL_IN "LOCAL_IN"
+ #define NH_LOCAL_OUT "LOCAL_OUT"
#define NH_PHYSICAL_IN "PHYSICAL_IN"
#define NH_PHYSICAL_OUT "PHYSICAL_OUT"
#define NH_FORWARDING "FORWARDING"
_______________________________________________
networking-discuss mailing list
[email protected]
