pf: bridge-to

[kp]

Summary

Allow pf (l2) to be used to redirect ethernet packets to a different
interface.

The intended use case is to send 802.1x challenges out to a side
interface, to enable AT&T links to function with pfSense as a gateway,
rather than the AT&T provided hardware.

Sponsored by: Rubicon Communications, LLC ("Netgate")

[zlei]

sys/netpfil/pf/pf.c

3844

Since bridge-to is a L2 action, the kif->pfik_ifp should be check whether it is capable to transmit l2 packets or not.

I think maybe we can flag it ( capable to transmit L2 packets ) within pfi_attach_ifnet() , something like this:

if (ifp->if_type == IFT_ETHER ... IFT_L2VLAN ... IFT_BRIDGE)
    kif->some_flag |= L2_CAPABLE;

See also if_setlladdr() in sys/net/if.c

[kp]

Ensure that the output interface understands Ethernet

[kp]

sys/netpfil/pf/pf.c

3844

Good point, although I think it's easier to do the check at output time, rather than adding an intermediate flag.

We'd still have to check here, so we may as well look directly at the ifp->if_type here.

[zlei]

lib/libpfctl/libpfctl.h

59–60

Is this introduced accidentally ?

[kp]

lib/libpfctl/libpfctl.h

59–60

That was introduced in https://cgit.freebsd.org/src/commit/?id=444a77ca85c78 recently. It's not part of this change, but it shows up now because I've rebased on top of a more recent head when I updated this patch.

[zlei]

Looks good to me, although have not tested this new feature yet.

lib/libpfctl/libpfctl.h

59–60

Sorry about the noises. My local src repo is out of sync.