This section describes the IP filtering capabilities of NicheStack. IP filtering can be used with the TCP/IP stack to filter the incoming and outgoing traffic. The user specifies the filters. Based on those filters, action is taking for incoming and outgoing packets.
InterNiche IP filtering code is based on the specification in RFC2669. Particularly, section "3.3.3. IP Filtering - docsDevIpFilterTable". Though the RFC2669 is targeted for management of cable devices, the specification for IP filtering is quite generic and can be used with any TCP/IP. This section is intended to be a help on how to use InterNiche IP filtering and hence the IP filtering specifications from RFC2669 are not duplicated here.
InterNiche IP filtering is implemented in a separate directory. When bundled with InterNiche TCPIP, it is fully intergrated and all the user has to do is to set the filters. By itself the IP filtering code is quite generic and can be used with other TCP/IP stacks too.
The code for IP filtering is in under ipf
directory.
The file ipf.c
implements IP filtering. The file DOCS_CAB.C
is placeholder for the MIB for IP filtering. Ipf.h
an docs_cab.h
are the respective header files.
IP filtering is implemented in the file ipf.c
. It has three interface functions.
ipf_init() | called during initialization time to initialize and populate the IP filter table. |
ipf_filter() | called whenever filtering is to be applied to any packet. |
ipf_cleanup() | called when the application is shutting down. It cleans up (frees) all entries in IP filter table. |
Whenever the IP stack receives a packet or needs to send an IP packet, it calls ipf_filter(). ipf_filter() returns SUCCESS if the packet is to be accepted. Else returns a non-zero value. It is the duty of the calling routine to discard the packet (based on value returned by ipf_filter()).
The function ipf_filter()
does filtering based on the entries in the IP Filter table. There are a number of ways through which the user can manipulate the filters/entries in IP Filter table.
ipfilter.nv
IP filter table is implemented as a generic list. Generic list is implemented in misclib/genlist.c
. The interface functions are in file h/genlist.h
. Here is an explanation of how IP filter table is implemented.
struct NicheList ipfiltertable;
NICHELIST p_ipfiltertable = &ipfiltertable;
niche_list_construction
. The second argument defines the "size" of data for each entry in list.
niche_list_constructor(p_ipfiltertable,sizeof(struct docsDevFilterIpEntry_mib));
niche_add_sorted()
. niche_add_sorted()
adds entry sorted by the first field.
niche_add_sorted(p_ipfiltertable,(GEN_STRUCT)&ipfilterent[i]);
niche_del_id()
is called. In our current case, this gets called from nv_del_entry_byid()
.
nv_del_entry_byid(pio, num, docsis_sections);
niche_list_destructor()
is called so that the whole table gets cleaned up.
niche_list_destructor(p_ipfiltertable);
Traversing as a linked list.
struct docsDevFilterIpEntry_mib *ent; NICHE_ELE node=p_ipfiltertable->head; /* start of linked list */ for ( ; node ; node=node->next) { ent= (struct docsDevFilterIpEntry_mib *)node->p_data; << use ent >> }
Traversing as an array
int i,len; struct docsDevFilterIpEntry_mib *entry; len = niche_list_len(p_ipfiltertable); for (i=0 ; i<len ; i++ ) { entry = (struct docsDevFilterIpEntry_mib *)niche_list_getat(p_ipfiltertable,i); << use entry >> }
One thing worth mentioning is that the generic list is used to create and manipulate the list. To be able to use it in the above fashion, it is very important that the first field of struct docsDevFilterIpEntry_mib
is the "id" based on which entries are sorted.
Please refer to generic list documentation on how to use it for other kinds of lists.
USE_IPFILTER
in ipport.h_h
IPF.LIB
in makefileipfilter.nv
ipfadd
and ipfdel
.ipf.c
ipfshow
".ipftoggle
".ipfadd
".ipfdel
". It accepts one argument, <IpIndex>
, which is the first field of a filter entry.