nonprivileged access to ipfw

[Andrey V. Elsukov]

Hi All!

I want a nonprivileged access to ipfw (without sudo, suid and etc..).
But RAW sockets restrict this. I have an one idea - a pseudo device
/dev/ipfw. I think that realisation of this feature is not
difficult task. Now i have some questions.
1. I think correctly about following?
* adding cdevsw declaration with ipfw_ioctl implementation;
* adding make_dev into ipfw initialization function (on MOD_LOAD event);
* adding destroy_dev (on MOD_UNLOAD);
* adding needed functionaly into /sbin/ipfw.

2. About ipfw_ioctl implemetation:
I can pack an ioctl params into sockopt structure and directly call
ipfw_ctl function. It's ok?

3. About ioctl requests - What symbol I should place into definition of
ioctl request? On what it depends? For example:
#define DIOCCLRSTATES   _IOWR('D', 18, struct pfioc_state_kill)
 >>-----------------------------^

4. I can define only two ioctl requests, for example:
IPFWIOCSCMD	_IOW('x', 0, struct sockopt_like_struct)
IPFWIOCGCMD	_IOR('x', 1, struct sockopt_like_struct)

and pass IP_FW_XXX sockoption's into sockopt_like_struct member,
or I should define two definition (set/get) for each IP_FW_XXX option?


Thanks and sorry for my english :(
-- 
WBR, Andrey V. Elsukov