HomeFreeBSD

MFC r339810: ipfw: implement ngtee/netgraph actions for layer-2 frames.

Description

MFC r339810: ipfw: implement ngtee/netgraph actions for layer-2 frames.

Kernel part of ipfw does not support and ignores rules other than
"pass", "deny" and dummynet-related for layer-2 (ethernet frames).
Others are processed as "pass".

Make it support ngtee/netgraph rules just like they are supported
for IP packets. For example, this allows us to mirror some frames
selectively to another interface for delivery to remote network analyzer
over RSPAN vlan. Assuming ng_ipfw(4) netgraph node has a hook named "900"
attached to "lower" hook of vlan900's ng_ether(4) node, that would be
as simple as:

ipfw add ngtee 900 ip from any to 8.8.8.8 layer2 out xmit igb0

PR: 213452
Tested-by: Fyodor Ustinov <ufm@ufm.su>

Details

Provenance
eugenAuthored on
Parents
rS340955: MFC r339810: ipfw: implement ngtee/netgraph actions for layer-2 frames.
Branches
Unknown
Tags
Unknown