Diverting sockets and streams

[Julian Elischer]

jakub wrote:
> Hi list,
> 
> I have a newbie question about divert sockets but I can't find a direct
> answer.
> 
> I have a rule like this:
> 
> ipfw add divert 5555 tcp from me to any 80 keep-state
> 
> If I understand it correctly, in order to check the data stream properly
> I have to deal with:
> 
> 1. packet reordering
> 2. packet duplication

yes, divert treats each packet individually
with the exception of frags which it reassembles.

> 
> so basically I have to implement part of the TCP stack in my app.

yes,
though there may be other ways to do what you want..
what DO you want to do?


> 
> I don't have to bother with fragmentation (according to man pages).
> I won't be able to understand IPSec packets as I will get encrypted IP
> frames.

yes

> 
> Am I correct?  Or can you please tell me how it really works?

packets enter the system and are run through the IP stack where the 
first thing they hit is ipfw. in ipfw the divert rule forces them
to the divert code (which does reassembly but that's all) and
passes the result to a divert socket.

there is apossibilty that done correctly with ESP one migh tb eab;e to 
get to the unencrypted packet but you'd have to read the code starting 
at ip_input() in ip_input.c to check for sure.

> 
> Thanks a lot,
> 
> Jakub
> 
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"