1.\" Copyright (c) 2005 Gleb Smirnoff 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd June 10, 2009 28.Dt NG_IPFW 4 29.Os 30.Sh NAME 31.Nm ng_ipfw 32.Nd interface between netgraph and IP firewall 33.Sh SYNOPSIS 34.In netgraph/ng_ipfw.h 35.Sh DESCRIPTION 36The 37.Nm ipfw 38node implements interface between 39.Xr ipfw 4 40and 41.Xr netgraph 4 42subsystems. 43.Sh HOOKS 44The 45.Nm ipfw 46node supports an arbitrary number of hooks, 47which must be named using only numeric characters. 48.Sh OPERATION 49Once the 50.Nm 51module is loaded into the kernel, a single node named 52.Va ipfw 53is automatically created. 54No more 55.Nm ipfw 56nodes can be created. 57Once destroyed, the only way to recreate the node is to reload the 58.Nm 59module. 60.Pp 61Packets can be injected into 62.Xr netgraph 4 63using either the 64.Cm netgraph 65or 66.Cm ngtee 67commands of the 68.Xr ipfw 8 69utility. 70These commands require a numeric cookie to be supplied as an argument. 71Packets are sent out of the hook whose name equals the cookie value. 72If no hook matches, packets are discarded. 73Packets injected via the 74.Cm netgraph 75command are tagged with 76.Vt "struct ng_ipfw_tag" . 77This tag contains information that helps the packet to re-enter 78.Xr ipfw 4 79processing, should the packet come back from 80.Xr netgraph 4 81to 82.Xr ipfw 4 . 83.Bd -literal -offset 4n 84struct ng_ipfw_tag { 85 struct m_tag mt; /* tag header */ 86 struct ip_fw *rule; /* matching rule */ 87 uint32_t rule_id; /* matching rule id */ 88 uint32_t chain_id; /* ruleset id */ 89 struct ifnet *ifp; /* interface, for ip_output */ 90 int dir; /* packet direction */ 91#define NG_IPFW_OUT 0 92#define NG_IPFW_IN 1 93}; 94.Ed 95.Pp 96Packets received by a node from 97.Xr netgraph 4 98must be tagged with 99.Vt "struct ng_ipfw_tag" 100tag. 101Packets re-enter IP firewall processing at the next rule. 102If no tag is supplied, packets are discarded. 103.Sh CONTROL MESSAGES 104This node type supports only the generic control messages. 105.Sh SHUTDOWN 106This node shuts down upon receipt of a 107.Dv NGM_SHUTDOWN 108control message. 109Do not do this, since the new 110.Nm ipfw 111node can only be created by reloading the 112.Nm 113module. 114.Sh SEE ALSO 115.Xr ipfw 4 , 116.Xr netgraph 4 , 117.Xr ipfw 8 , 118.Xr mbuf_tags 9 119.Sh HISTORY 120The 121.Nm ipfw 122node type was implemented in 123.Fx 6.0 . 124.Sh AUTHORS 125The 126.Nm ipfw 127node was written by 128.An "Gleb Smirnoff" Aq glebius@FreeBSD.org . 129