Page MenuHomeFreeBSD

pf: bridge-to
ClosedPublic

Authored by kp on Oct 28 2022, 10:05 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, May 30, 10:05 PM
Unknown Object (File)
Sun, May 26, 7:46 AM
Unknown Object (File)
Sun, May 26, 7:44 AM
Unknown Object (File)
Sun, May 26, 7:44 AM
Unknown Object (File)
Sun, May 26, 7:44 AM
Unknown Object (File)
Fri, May 24, 11:14 AM
Unknown Object (File)
Mar 23 2024, 8:56 AM
Unknown Object (File)
Mar 22 2024, 5:40 PM

Details

Reviewers
None
Group Reviewers
network
pfsense
Commits
rG8a8af9424008: pf: bridge-to
Summary

Allow pf (l2) to be used to redirect ethernet packets to a different
interface.

The intended use case is to send 802.1x challenges out to a side
interface, to enable AT&T links to function with pfSense as a gateway,
rather than the AT&T provided hardware.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Oct 28 2022, 10:05 AM
zlei added inline comments.
sys/netpfil/pf/pf.c
3844

Since bridge-to is a L2 action, the kif->pfik_ifp should be check whether it is capable to transmit l2 packets or not.

I think maybe we can flag it ( capable to transmit L2 packets ) within pfi_attach_ifnet() , something like this:

if (ifp->if_type == IFT_ETHER ... IFT_L2VLAN ... IFT_BRIDGE)
    kif->some_flag |= L2_CAPABLE;

See also if_setlladdr() in sys/net/if.c

Ensure that the output interface understands Ethernet

kp marked an inline comment as done.Nov 1 2022, 11:38 AM
kp added inline comments.
sys/netpfil/pf/pf.c
3844

Good point, although I think it's easier to do the check at output time, rather than adding an intermediate flag.

We'd still have to check here, so we may as well look directly at the ifp->if_type here.

lib/libpfctl/libpfctl.h
60

Is this introduced accidentally ?

kp marked 2 inline comments as done.Nov 1 2022, 3:59 PM
kp added inline comments.
lib/libpfctl/libpfctl.h
60

That was introduced in https://cgit.freebsd.org/src/commit/?id=444a77ca85c78 recently. It's not part of this change, but it shows up now because I've rebased on top of a more recent head when I updated this patch.

Looks good to me, although have not tested this new feature yet.

lib/libpfctl/libpfctl.h
60

Sorry about the noises. My local src repo is out of sync.

This revision was not accepted when it landed; it landed in state Needs Review.Nov 2 2022, 2:51 PM
Closed by commit rG8a8af9424008: pf: bridge-to (authored by kp). · Explain Why
This revision was automatically updated to reflect the committed changes.
kp marked an inline comment as done.