HomeFreeBSD

ipfw: add support radix tables and table lookup for MAC addresses

Description

ipfw: add support radix tables and table lookup for MAC addresses

By analogy with IP address matching, add a way to use ipfw radix
tables for MAC matching. This is implemented using new ipfw table
with mac:radix type. Also there are src-mac and dst-mac lookup
commands added.

Usage example:

ipfw table 1 create type mac
ipfw table 1 add 11:22:33:44:55:66/48
ipfw add skipto tablearg src-mac 'table(1)'
ipfw add deny src-mac 'table(1, 100)'
ipfw add deny lookup dst-mac 1

Note: sysctl net.link.ether.ipfw=1 should be set to enable ipfw
filtering on L2.

Reviewed by: melifaro
Obtained from: Yandex LLC
MFC after: 1 month
Relnotes: yes
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D35103

Details

Provenance
smalukav_gmail.comAuthored on Jun 4 2022, 4:12 PM
aeCommitted on Jun 4 2022, 4:12 PM
Reviewer
melifaro
Differential Revision
D35103: ipfw: Support radix tables and table lookup for MAC addresses
Parents
rG32a01b2b8691: rack: Fix a common typo in comments and a sysctl description
Branches
Unknown
Tags
Unknown