ipfw: create a bpf tap point for every log rule

[glebius]

Summary

Dynamically allocate bpf tap points for every rule that has "log".
The name is "ipfw%u", where %u is substituted to the rule number.
The default catch all "ipfw0" tap still exists for compatibility
and it will catch packets in case if there are no bpf listeners
on a per-rule tap.

[ae]

sys/netpfil/ipfw/ip_fw_bpf.c

61

Currently we support IPFW_DEFAULT_RULE larger than 64k.

92

D53872 says that it is consumer's responsibility to avoid duplicates. But you can create many rules with the same rulenum and it seems there isn't any checks related to duplicates prior to bpf_attach.

[glebius]

sys/netpfil/ipfw/ip_fw_bpf.c

61

Я же два раза спрашивал про 32-битные номера и не получил ответа! >:-|

So, how exactly can I create rule numbers larger than 64k? The constant is hardcoded, it is not a kernel option. If you explain me the mechanism I will look into expanding this string or maybe allocating it dynamically.

92

I totally missed that multiple rules can have one number. I will update the diff to cover that. Thanks!

[glebius]

• Address the fact that many rules can have the same number.
• Support 32-bit rule numbers.

[glebius]

• Documentation and ipfw(8) update.