From dr146992@sac.sfbay.sun.com Tue Sep 8 19:09:03 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n89293sf000103 for ; Tue, 8 Sep 2009 19:09:03 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n89292QC024670; Tue, 8 Sep 2009 19:09:02 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KPO00203LZ1VG00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 08 Sep 2009 19:09:01 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KPO00MZ7LZ18V00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 08 Sep 2009 19:09:01 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n89291fp054443; Tue, 08 Sep 2009 19:09:01 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n892909b000098; Tue, 08 Sep 2009 19:09:00 -0700 (PDT) Received: (from dr146992@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n89290jv000094; Tue, 08 Sep 2009 19:09:00 -0700 (PDT) Date: Tue, 08 Sep 2009 19:09:00 -0700 (PDT) From: Darren Reed Subject: Addition of NE_IFINDEX_CHANGE to [PSARC/2009/477 FastTrack timeout 09/15/2009] To: PSARC-ext@sun.com Message-id: <200909090209.n89290jv000094@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4293 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Addition of NE_IFINDEX_CHANGE to 1.2. Name of Document Author/Supplier: Author: Alexandr Nedvedicky 1.3 Date of This Document: 08 September, 2009 4. Technical Description 1. Introducation This case adds a new event, NE_IFINDEX_CHANGE, to PF-HOOK module as follows: #include NE_IFINDEX_CHANGE The commitment level of proposed interface is volatile. The release binding is "patch" (it will be back-ported to Solaris 10 as a part of bugfix) 2. Discussion Currently there is no way to notify firewall (the consumer of PF-HOOKS API) an interface index (a.k.a. ifindex) got changed. The ifindex can be changed from user space application by ioctl(2) SIOCSLIFINDEX request. The default ifindex value is assigned by system, when network interface (NIC) is being plumbed. Each network interface gets unique number (positive, non-zero) assigned starting with value 1. To find out the ifindex value assigned to particular interface user might use command ifconfig(1M) as follows: ifconfig e1000g0 The command above will print out interface settings for e1000g0 interface: ....UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 4 the 'index 4' is the interface index value assigned to e1000g0. System administrator might change the ifindex default value by using ifconifg(1M) command as follows: ifconfig e1000g0 index 5 The command above will assign number '5' to e1000g0 as interface index. Since that point the system will use '5' as an internal identificator of e1000g0 interface. The SIOCSLIFINDEX ioctl(2) command is handled by ip_sioctl_slifindex() function, which can be found in uts/common/inet/ip/ip_if.c file. The ip_sioctl_slifindex() function ensures the new ifindex value is valid (positive, non-zero) and unique to system. It also updates AVL tree (phyint_list_avl_by_index), which indexes interfaces by ifindex value. The ipfilter(2) also uses ifindex to identify a particular interface where packet comes from/bounds to. The ifindex value is used to match rules, which are explicitly defining interface as a part of policy. Example of such policy follows: block in on e1000g0 from any to any pass in on e1000g0 from 192.168.0.0/16 to any The rules above are typically used to enforce anti-spoofing protection. They are using an optional parameter 'on [ifname]' to include network into packet match parameters. Once these rules are loaded into ipfilter(2) kernel module, the interface names are resolved to ifindex numbers. Such resolution process in ipfilter(2) happens also when new interface is being plumbed up. The same process is used for NAT (network address translation) rules. The ipfilter(2) also needs to resolve rules on interface index changes. Since no event is generated by PF-HOOKS to trigger the resolution process, there is the only way to restart ipfilter(2) manually to force the interface name to ifindex resolution. This is very inconvenient option for ipfilter(2) users. More information can be found in CR 6772643. 3. Interface table NE_IFINDEX_CHANGE event will be volatile. 4. References 6772643 Packets dropped at ipfil_sendpkt if interface index is set at plumb time 5. Manual pages The diff is as follows: --- hook_nic_event.9s.orig Tue Aug 25 17:26:30 2009 +++ hook_nic_event.9s.new Tue Aug 25 17:26:04 2009 @@ -126,8 +126,15 @@ contains the new network address. .RE +\fB\fBNE_IFINDEX_CHANGE\fR\fR +.ad +.RS 21n +.rt +an interface index has changed. \fBhne_lif\fR refers to the logical +interface for which the change is occurring, \fBhne_data\fR is a new +ifindex value. +.RE +.RE + .SH ATTRIBUTES .sp .LP @@ -142,7 +149,7 @@ . ATTRIBUTE TYPEATTRIBUTE VALUE _ -Interface StabilityCommitted +Interface StabilityCommitted except NE_IFINDEX_CHANGE event, which is volatile .TE .SH SEE ALSO 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From garrett.damore@sun.com Wed Sep 16 09:13:08 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n8GGD7jR028575 for ; Wed, 16 Sep 2009 09:13:07 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id n8GGD76i014640 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Sep 2009 09:13:07 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KQ20030PNPVVH00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Sep 2009 09:13:07 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KQ200IBENPUP8C0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Sep 2009 09:13:06 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n8GGD6Ux021515 for ; Wed, 16 Sep 2009 09:13:06 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KQ200600NB4C400@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Sep 2009 09:13:06 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KQ200798NPTJ840@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Sep 2009 09:13:05 -0700 (PDT) Date: Wed, 16 Sep 2009 09:13:05 -0700 From: "Garrett D'Amore" Subject: PSARC 2009/477 Addition of NE_IFINDEX_CHANGE to Sender: garrett.damore@sun.com To: PSARC-ext Reply-to: garrett.damore@sun.com Message-id: <4AB10E91.7010004@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 32 +1 on this case. - Garrett From gdamore@sun.com Wed Sep 23 09:31:26 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n8NGVQjf004967 for ; Wed, 23 Sep 2009 09:31:26 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n8NGVPAT008070 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 23 Sep 2009 10:31:26 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KQF00F0JN8DU300@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Sep 2009 09:31:25 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KQF0085EN8CBVF0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Sep 2009 09:31:24 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n8NGVOba003162 for ; Wed, 23 Sep 2009 09:31:24 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KQF00F00LPLJK00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Sep 2009 09:31:24 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KQF00G2XN8BOQ10@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Sep 2009 09:31:24 -0700 (PDT) Date: Wed, 23 Sep 2009 09:31:23 -0700 From: "Garrett D'Amore" Subject: Re: PSARC 2009/477 Addition of NE_IFINDEX_CHANGE to In-reply-to: <4AB10E91.7010004@sun.com> Sender: Garrett.Damore@sun.com To: Garrett.Damore@sun.com Cc: PSARC-ext Message-id: <4ABA4D5B.8040309@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4AB10E91.7010004@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 117 Garrett D'Amore wrote: > +1 on this case. > > - Garrett This case was approved at PSARC last week. - Garrett