Code snippit to add ipfw rule.

[Matt]

Part of an app I am playing with needs to be able to add an ipfw rule.
I had though i got all of what i need from ipfw2.c and ip_fw.h but I am
painfully new to C and must be missing something.  Not even sure how i can
get myself a more usefull error message.  Any point in the right direction
would be great.  Thank you.

5.2.1R.  Kernel is all set.  firewall works fine with the real ipfw client.


When this is built and run:
mgoward at IneedAname 1298> gcc -Wall test.c -o test
test.c: In function `main':
test.c:134: warning: implicit declaration of function `err'
mgoward at IneedAname 1299> sudo ./test
Password:
test: getsockopt(IP_FW_ADD): Invalid argument
mgoward at IneedAname 1300> 

Here is test.c.   Dont mind all the extra includes.  They are all used in the 
bulk of the program and I was to lazy to pick and choose when i pulled this 
bit out to work on it alone.


#include <stdio.h>
#include <errno.h>
#include <limits.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <netdb.h>
#include <sysexits.h>  

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>

#include <sys/time.h>
#include <signal.h>
#include <pcap.h>

#include    <net/if.h>
#include    <netinet/ip_fw.h>


static ipfw_insn *
next_cmd(ipfw_insn *cmd)
{
        cmd += F_LEN(cmd);
        bzero(cmd, sizeof(*cmd));
        return cmd;
}

/*
 * conditionally runs the command.
 */
static int
do_cmd(int optname, void *optval, uintptr_t optlen)
{
        static int s = -1;      /* the socket */
        int i;

        if (s == -1)
                s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);

        if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET ||
            optname == IP_FW_ADD)
                i = getsockopt(s, IPPROTO_IP, optname, optval,
                        (socklen_t *)optlen);
        else
                i = setsockopt(s, IPPROTO_IP, optname, optval, optlen);
        return i;
}


int main ()
{
        static uint32_t cmdbuf[255], rulebuf[255];

        ipfw_insn *src, *dst, *cmd;

        int i;

        struct ip_fw *rule;

        bzero(cmdbuf, sizeof(cmdbuf));
        bzero(rulebuf, sizeof(rulebuf));

        rule = (struct ip_fw *)rulebuf;
        cmd = (ipfw_insn *)cmdbuf;

        rule->rulenum = 250;
        rule->set = 2;

        cmd->opcode = O_ACCEPT;
        cmd->len = 1;
        cmd= next_cmd(cmd);

        /* this will hold our object and mask */
        ipfw_insn_ip *d = (ipfw_insn_ip *)cmd;

        /* ip and mask combo object */
        d->o.opcode = O_IP_SRC_MASK;

        /* get the in_addr in network order */
        ascii2addr(AF_INET, "192.168.12.12" , &(d->addr));
        ascii2addr(AF_INET, "255.255.255.255" , &(d->mask));

        d->o.len = F_INSN_SIZE(ipfw_insn_ip);

        /* move our command pointer up one step */
        cmd = next_cmd(cmd);

        d = (ipfw_insn_ip *)cmd;

        d->o.opcode = O_IP_DST_MASK;
        ascii2addr(AF_INET, "192.168.12.22" , &(d->addr));
        ascii2addr(AF_INET, "255.255.255.255" , &(d->mask));
        d->o.len = F_INSN_SIZE(ipfw_insn_ip);
        cmd = next_cmd(cmd);

        cmd->opcode = O_PROTO;
        cmd->len = 1;
        cmd->arg1 = IPPROTO_IPV4;
        cmd = next_cmd(cmd);

        dst = (ipfw_insn *)rule->cmd;
        for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) {
                i = F_LEN(src);

                switch (src->opcode) {
                case O_LOG:
                case O_KEEP_STATE:
                case O_LIMIT:
                        break;
                default:
                        bcopy(src, dst, i * sizeof(uint32_t));
                        dst += i;
                }
        }

        rule->act_ofs = dst - rule->cmd;
        rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd);
        i = (char *)dst - (char *)rule;
        if (do_cmd(IP_FW_ADD, rule, (uintptr_t)&i) == -1)
                err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD");


        return(1);

}


Thank you again,

Matthew Goward