original files of m241

components/ip_net2-6.9/ipfirewall/src/ipfirewall_mac.c

@@ -0,0 +1,680 @@
+/*
+ ******************************************************************************
+ *                     INTERPEAK SOURCE FILE
+ *
+ *   Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall_mac.c,v $ $Revision: 1.35.16.2 $
+ *   $Source: /home/interpeak/CVSRoot/ipfirewall/src/ipfirewall_mac.c,v $
+ *   $Author: svc-cmnet $
+ *   $State: Exp $ $Locker:  $
+ *
+ *   INTERPEAK_COPYRIGHT_STRING
+ *     Design and implementation by Markus Carlstedt <markus@interpeak.se>
+ ******************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 1                    DESCRIPTION
+ ****************************************************************************
+ * MAC filter.
+ */
+
+/*
+ ****************************************************************************
+ * 2                    CONFIGURATION
+ ****************************************************************************
+ */
+
+#include "ipfirewall_config.h"
+
+
+/*
+ ****************************************************************************
+ * 3                    INCLUDE FILES
+ ****************************************************************************
+ */
+
+#ifdef IPFIREWALL_USE_MAC_FILTER
+
+#define IPCOM_USE_CLIB_PROTO
+#include <ipcom_type.h>
+#include <ipcom_cstyle.h>
+#include <ipcom_clib.h>
+#include <ipcom_sock.h>
+#include <ipcom_syslog.h>
+#include <ipcom_shell.h>
+#include <ipcom_err.h>
+#include <ipcom_sysvar.h>
+#include <ipcom_time.h>
+
+#define IPFIREWALL_C
+#include "ipfirewall.h"
+#include "ipfirewall_h.h"
+
+
+/*
+ ****************************************************************************
+ * 4                    DEFINES
+ ****************************************************************************
+ */
+
+/*
+ *===========================================================================
+ *                      IPFIREWALL_STATS
+ *===========================================================================
+ * MAC Filter statistics counters
+ */
+#ifdef IPFIREWALL_USE_MAC_STATISTICS
+#define IPFIREWALL_STATS(xentry)   ipfirewall->inner.stats.xentry
+#else
+#define IPFIREWALL_STATS(xentry)   IP_NOOP
+#endif
+
+
+/*
+ *===========================================================================
+ *                      IPFIREWALL_MAC_IS_ME
+ *===========================================================================
+ * Check if MAC frame address is local
+ */
+#define IPFIREWALL_MAC_IS_ME(pktaddr, netif) \
+    (netif->link_addr_size == IPFIREWALL_MAC_ADDRESS_LEN && \
+    ((Ip_u16 *)pktaddr)[0] == ((Ip_u16 *)netif->link_addr)[0] && \
+    ((Ip_u16 *)pktaddr)[1] == ((Ip_u16 *)netif->link_addr)[1] && \
+    ((Ip_u16 *)pktaddr)[2] == ((Ip_u16 *)netif->link_addr)[2])
+
+
+/*
+ *===========================================================================
+ *                      IPFIREWALL_MAC_COMPARE
+ *===========================================================================
+ * Compare MAC frame address with rule address
+ */
+#define IPFIREWALL_MAC_COMPARE(addr, mask, pktaddr) \
+    (((Ip_u16 *)addr)[0] == (((Ip_u16 *)pktaddr)[0] & ((Ip_u16 *)mask)[0]) && \
+     ((Ip_u16 *)addr)[1] == (((Ip_u16 *)pktaddr)[1] & ((Ip_u16 *)mask)[1]) && \
+     ((Ip_u16 *)addr)[2] == (((Ip_u16 *)pktaddr)[2] & ((Ip_u16 *)mask)[2]))
+
+/*
+ *===========================================================================
+ *                      IPFIREWALL_MAC_TEST_ADRESS
+ *===========================================================================
+ * Test MAC address against rule
+ */
+#define IPFIREWALL_MAC_TEST_ADRESS(any, me, not, addr, mask, pktaddr, netif) \
+    { \
+        if (any) \
+        { \
+            if (not) \
+                continue; \
+        } \
+        else if (me) \
+        { \
+            if (IPFIREWALL_MAC_IS_ME(pktaddr, netif)) \
+            { \
+                if (not) \
+                    continue; \
+            } \
+            else if (!not) \
+                continue; \
+        } \
+        else \
+        { \
+            if (IPFIREWALL_MAC_COMPARE(addr, mask, pktaddr)) \
+            { \
+                if (not) \
+                    continue; \
+            } \
+            else if (!not) \
+                continue; \
+        } \
+    }
+
+/*
+ ****************************************************************************
+ * 5                    TYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 6                    EXTERN PROTOTYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 7                    LOCAL PROTOTYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 8                    DATA
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 9                    LOCAL FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_log_pkt
+ *===========================================================================
+ * Description: Log a packet that matched a MAC filter rule.
+ * Parameters:  fw_rule    - pointer to the rule.
+ *              netif      - pointer to interface.
+ *              pkt        - pointer to packet.
+ * Returns:     nothing.
+ */
+IP_STATIC void
+ipfirewall_mac_log_pkt(Ipfirewall_rule *fw_rule, Ipcom_netif *netif, Ipcom_pkt *pkt)
+{
+    Ipfirewall_mac_log *fw_mac_log;
+    struct Ip_timeval logtime;
+
+    if(fw_rule->inner.log_first == 1 && fw_rule->inner.log_hit == 1)
+    {
+        IPCOM_LOG2(DEBUG, "ipfirewall_log_pkt() :: MAC rule @%d:%d has already caused a log entry",
+                           fw_rule->inner.group_no, fw_rule->inner.rule_no);
+        return;
+    }
+
+    if(ipfirewall->mac_head_log.size >= IPFIREWALL_MAX_MAC_LOG_ENTRIES)
+    {
+        IPCOM_LOG0(DEBUG, "ipfirewall_mac_log_pkt() :: Maximum number of log entries reached");
+        IPFIREWALL_STATS(mac_log_failures++);
+        return;
+    }
+
+    fw_mac_log = ipcom_malloc(sizeof(*fw_mac_log));
+    if(fw_mac_log == IP_NULL)
+    {
+        IPCOM_LOG0(ERR, "ipfirewall_mac_log_pkt() :: Could not allocate memory for log entry");
+        IPFIREWALL_STATS(mac_log_failures++);
+        return;
+    }
+    ipcom_memset(fw_mac_log, 0, sizeof(*fw_mac_log));
+
+    /* Populate the log entry */
+    ipcom_microtime(&logtime);
+    fw_mac_log->inner.tv_sec  = (Ip_s32)logtime.tv_sec;
+    fw_mac_log->inner.tv_usec = (Ip_s32)logtime.tv_usec;
+    ipcom_strcpy((char *)fw_mac_log->inner.ifname, (char *)netif->name);
+    fw_mac_log->inner.rule_no  = fw_rule->inner.rule_no;
+    fw_mac_log->inner.group_no = fw_rule->inner.group_no;
+    fw_mac_log->inner.block    = fw_rule->inner.block;
+    ipcom_memcpy(fw_mac_log->inner.dst, &pkt->data[pkt->start], IPFIREWALL_MAC_ADDRESS_LEN);
+    ipcom_memcpy(fw_mac_log->inner.src, &pkt->data[pkt->start+IPFIREWALL_MAC_ADDRESS_LEN], IPFIREWALL_MAC_ADDRESS_LEN);
+    ipcom_memcpy(&fw_mac_log->inner.type_n, &pkt->data[pkt->start+IPFIREWALL_MAC_ADDRESS_LEN*2], 2);
+    fw_mac_log->inner.length = pkt->end - pkt->start - IPFIREWALL_MAC_HEADER_LEN;
+    ipcom_memcpy(fw_mac_log->inner.frame,
+                 &pkt->data[pkt->start + IPFIREWALL_MAC_HEADER_LEN],
+                 IP_MIN((Ip_size_t)fw_mac_log->inner.length, sizeof(fw_mac_log->inner.frame)));
+    ipcom_list_insert_last(&ipfirewall->mac_head_log, &fw_mac_log->list_log);
+    IPCOM_LOG2(DEBUG, "ipfirewall_mac_log_pkt() :: Logged packet from MAC rule @%d:%d",
+                       fw_rule->inner.group_no, fw_rule->inner.rule_no);
+
+    if(fw_rule->inner.log_first == 1)
+        fw_rule->inner.log_hit = 1;
+
+    if(fw_rule->inner.block == 1)
+    {
+        if(fw_rule->inner.in == 1)
+            IPFIREWALL_STATS(mac_in_logged_block++);
+        else
+            IPFIREWALL_STATS(mac_out_logged_block++);
+    }
+    else
+    {
+        if(fw_rule->inner.in == 1)
+            IPFIREWALL_STATS(mac_in_logged_pass++);
+        else
+            IPFIREWALL_STATS(mac_out_logged_pass++);
+    }
+}   /*lint !e429 */
+
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_check_rules
+ *===========================================================================
+ * Description: Check packet against MAC filter rules.
+ * Parameters:  in    - IP_TRUE for incoming packet.
+ *              netif - pointer to interface.
+ *              pkt   - pointer to packet.
+ * Returns:     1 = Block packet.
+ *              0 = Pass packet.
+ */
+IP_STATIC Ip_s32
+ipfirewall_mac_check_rules(Ipcom_netif *netif, Ipcom_pkt *pkt, Ip_bool in)
+{
+    Ipfirewall_rule *fw_rule;
+    Ipfirewall_rule *lastmatch = IP_NULL;
+    int current_group = 0;
+    Ip_u8 quick_head = 0;
+    Ip_u16 mac_type_n;
+    Ip_u8 ssap_n = 0;
+    Ip_u8 dsap_n = 0;
+
+    ip_assert(pkt);
+    ip_assert(pkt->data);
+    ip_assert(pkt->end > pkt->start);
+
+    if (in == IP_TRUE)
+        fw_rule = IPCOM_LIST_FIRST(&ipfirewall->mac_head_rule_input);
+    else
+        fw_rule = IPCOM_LIST_FIRST(&ipfirewall->mac_head_rule_output);
+
+    /* Match packet against mac rules */
+    for (; fw_rule != IP_NULL; fw_rule = IPCOM_LIST_NEXT(&fw_rule->list_rule))
+    {
+        if (ipfirewall->inner.mac_num_head_rules)
+        {
+            if (quick_head && current_group != fw_rule->inner.group_no)
+                break;
+            if (fw_rule->inner.group_no == 0)
+            {
+                current_group = 0;
+                quick_head = 0;
+            }
+        }
+
+        if (current_group == fw_rule->inner.group_no || fw_rule->inner.group_head)
+        {
+            /* Check direction */
+            if (fw_rule->inner.in)
+            {
+                if (in == IP_FALSE)
+                    continue;           /* Direction does not match */
+            }
+            else if (in == IP_TRUE)
+            {
+                continue;               /* Direction does not match */
+            }
+
+            /* Check interface */
+            if(fw_rule->inner.on)
+            {
+#ifdef IPNET_USE_VLAN
+                if (fw_rule->inner.in
+                    && netif->type != IP_IFT_L2VLAN
+                    && ((Ipnet_netif *)netif)->eth != IP_NULL
+                    && (ip_ntohs(*(Ip_u16 *)&pkt->data[pkt->start + IPFIREWALL_MAC_ADDRESS_LEN*2]) == 0x8100
+#ifdef IPCOM_USE_HW_VLAN_TAGGING
+                    || IP_BIT_ISSET(pkt->flags, IPCOM_PKT_FLAG_VLAN_TAG)
+#endif
+                    )
+                    && ((Ipnet_netif *)netif)->eth->vlan.ifs != IP_NULL)
+                {
+                    /* Find the correct VLAN interface */
+                    Ipnet_netif *ipnet_netif;
+                    int vid;
+
+#ifdef IPCOM_USE_HW_VLAN_TAGGING
+                    if (IP_BIT_ISSET(pkt->flags, IPCOM_PKT_FLAG_VLAN_TAG))
+                        vid = IPNET_ETH_PKT_GET_VLAN_TAG(pkt) & 0x0fff;
+                    else
+#endif /* IPCOM_USE_HW_VLAN_TAGGING */
+                        vid = IPNET_ETH_VLAN_GET_VID(*(Ip_u16 *)&pkt->data[pkt->start + IPFIREWALL_MAC_HEADER_LEN]);
+
+                    ipnet_netif = ipcom_hash_get(((Ipnet_netif *)netif)->eth->vlan.ifs, &vid);
+                    if (ipnet_netif != IP_NULL)
+                        netif = &ipnet_netif->ipcom;
+                }
+#endif
+
+#ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT 
+                /* Check the physical interface before the logical interface */
+                if(fw_rule->inner.on_phys &&
+                        (pkt->physical_netif != IP_NULL) ) {
+                    if (fw_rule->inner.physical_ifindex)
+                    {
+                        /* Fast check */
+                        IPFIREWALL_TEST_INTERFACE(fw_rule->inner.on_not,
+                                fw_rule->inner.physical_ifindex,
+                                pkt->physical_netif->ifindex)
+                    }
+                    else
+                    {
+                        /* Slow check */
+                        if (ipfirewall_match_interface(fw_rule,
+                                    pkt->physical_netif) == 0)
+                            continue;           /* Interface does not match */
+                    }
+                }
+#endif
+                /* Check interface */
+                if (fw_rule->inner.on)
+                {
+                    if (fw_rule->inner.ifindex)
+                    {
+                        /* Fast check */
+                        IPFIREWALL_TEST_INTERFACE(fw_rule->inner.on_not, fw_rule->inner.ifindex, netif->ifindex)
+                    }
+                    else
+                    {
+                        /* Slow check */
+                        if (ipfirewall_match_interface(fw_rule, netif) == 0)
+                            continue;           /* Interface does not match */
+                    }
+                }
+            }
+
+            /* Check source and destination address */
+            if (fw_rule->inner.from)
+            {
+                IPFIREWALL_MAC_TEST_ADRESS(fw_rule->inner.src_any, fw_rule->inner.src_me, fw_rule->inner.src_not,
+                                            &fw_rule->inner.mac_src,
+                                            &fw_rule->inner.mac_src_mask,
+                                            &pkt->data[pkt->start + IPFIREWALL_MAC_ADDRESS_LEN],
+                                            netif)
+
+                IPFIREWALL_MAC_TEST_ADRESS(fw_rule->inner.dst_any, fw_rule->inner.dst_me, fw_rule->inner.dst_not,
+                                            &fw_rule->inner.mac_dst,
+                                            &fw_rule->inner.mac_dst_mask,
+                                            &pkt->data[pkt->start],
+                                            netif)
+            }
+
+            /* Check MAC type */
+            if (fw_rule->inner.mac_type)
+            {
+#ifdef IPCOM_USE_HW_VLAN_TAGGING
+                if (IP_BIT_ISSET(pkt->flags, IPCOM_PKT_FLAG_VLAN_TAG))
+                    mac_type_n = ip_htons(0x8100);
+                else
+#endif
+                    mac_type_n = *(Ip_u16 *)&pkt->data[pkt->start + IPFIREWALL_MAC_ADDRESS_LEN*2];
+                if (fw_rule->inner.the_mac_type_n != mac_type_n)
+
+                {
+                    continue;                               /* MAC type does not match */
+                }
+            }
+
+            mac_type_n = *(Ip_u16 *)&pkt->data[pkt->start + IPFIREWALL_MAC_ADDRESS_LEN*2];
+
+            /* Check for the 802.2 frame type */
+            if(fw_rule->inner.frame_802_2 == 1)
+            {
+                if(ip_ntohs(mac_type_n) > IPFIREWALL_MAC_802_3_MAX_LEN)
+                    continue;  /* Not an 802.2 frame */
+            }
+
+            if(fw_rule->inner.dsap == 1 ||
+               fw_rule->inner.ssap == 1 ||
+               fw_rule->inner.snap_vendor == 1 ||
+               fw_rule->inner.snap_type == 1)
+            {
+
+                if(ip_ntohs(mac_type_n) > IPFIREWALL_MAC_802_3_MAX_LEN)
+                    continue;  /* Not an 802.2 frame */
+            
+                dsap_n = *(Ip_u8 *)&pkt->data[pkt->start +
+                    IPFIREWALL_MAC_HEADER_LEN];
+                ssap_n = *(Ip_u8 *)&pkt->data[pkt->start +
+                    IPFIREWALL_MAC_HEADER_LEN + 1];
+
+            }
+
+            if(fw_rule->inner.dsap == 1)
+            {
+                IPFIREWALL_TEST_SAP(fw_rule->inner.dsap_not,
+                        fw_rule->inner.the_dsap_n , dsap_n)
+            }
+
+            if(fw_rule->inner.ssap == 1)
+            {
+                IPFIREWALL_TEST_SAP(fw_rule->inner.ssap_not,
+                        fw_rule->inner.the_ssap_n , ssap_n)
+            }
+
+            if(fw_rule->inner.snap_vendor == 1)
+            {
+
+                /* DSAP and SSAP must be 0xaa for a SNAP header
+                 * to be present */
+                if((ssap_n != 0xaa) || (dsap_n != 0xaa))
+                    continue;
+
+                 IPFIREWALL_TEST_SNAP_VENDOR(fw_rule->inner.snap_vendor_not,
+                         &fw_rule->inner.the_snap_vendor_n,&pkt->data[pkt->start +
+                         IPFIREWALL_MAC_HEADER_LEN + IPFIREWALL_LLC_HEADER_LEN])
+            }
+                    
+            if(fw_rule->inner.snap_type == 1)
+            {
+                Ip_u16 snap_type_n;
+
+                /* DSAP and SSAP must be 0xaa for a SNAP header
+                 * to be present */
+                if((ssap_n != 0xaa) || (dsap_n != 0xaa))
+                    continue;
+
+                snap_type_n = 
+                    *(Ip_u16 *)&pkt->data[pkt->start +
+                    IPFIREWALL_MAC_HEADER_LEN + IPFIREWALL_LLC_HEADER_LEN + 3];
+                
+                IPFIREWALL_TEST_SNAP(fw_rule->inner.snap_type_not,
+                        fw_rule->inner.the_snap_type_n , snap_type_n)
+            }
+
+            /* Packet matched rule - check rate limiting */
+            if(fw_rule->inner.limit)
+            {
+                if (ipfirewall_compare_limit(fw_rule) == 0)
+                    continue;
+            }
+
+#ifdef IPFIREWALL_USE_USERDEF
+            /* Call user defined function */
+            if(fw_rule->inner.userdef && fw_rule->user_match != IP_NULL)
+            {
+                IPCOM_LOG2(DEBUG2, "ipfirewall_mac_check_rules() :: Calling user defined match function id: %s with paramater string: %s",
+                            (char *)fw_rule->inner.userdef_id, fw_rule->inner.userdef_param);
+                if (fw_rule->user_match(pkt, fw_rule->userdef_cookie, fw_rule->userdef_info) == 0)
+                    continue;
+            }
+#endif
+
+            IPCOM_LOG2(DEBUG, "ipfirewall_mac_check_rules() :: Matched MAC rule @%d:%d", fw_rule->inner.group_no, fw_rule->inner.rule_no);
+            lastmatch = fw_rule;
+            if(!fw_rule->inner.group_head)
+            {
+                if (fw_rule->inner.quick)
+                    break;
+            }
+            else
+            {
+                current_group = fw_rule->inner.group_no;
+                quick_head = fw_rule->inner.quick;
+            }
+        }
+    }
+
+    if(lastmatch == IP_NULL)
+    {
+        if(in == IP_TRUE)
+            IPFIREWALL_STATS(mac_in_nomatch++);
+        else
+            IPFIREWALL_STATS(mac_out_nomatch++);
+#ifdef IPFIREWALL_BLOCK_IF_NO_MAC_MATCH
+        /* Return block code */
+        return 1;
+#else
+        /* Return pass code */
+        return 0;
+#endif
+    }
+    else
+    {
+        if(lastmatch->inner.log == 1)
+            ipfirewall_mac_log_pkt(lastmatch, netif, pkt);  /* Log the packet */
+
+        /* Update statistics */
+        if(lastmatch->inner.block)
+        {
+            if(in == IP_TRUE)
+                IPFIREWALL_STATS(mac_in_block++);
+            else
+                IPFIREWALL_STATS(mac_out_block++);
+            /* Return block code */
+            return 1;
+        }
+        else
+        {
+            if(in == IP_TRUE)
+                IPFIREWALL_STATS(mac_in_pass++);
+            else
+                IPFIREWALL_STATS(mac_out_pass++);
+            /* Return pass code */
+            return 0;
+        }
+    }
+}
+
+
+/*
+ ****************************************************************************
+ * 10                    GLOBAL FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_internal_get_rule
+ *===========================================================================
+ * Description: Get MAC filter rule entry.
+ * Parameters:  ctrl - pointer to control structure.
+ *              lenp - pointer to length of returned data.
+ *              in   - Rule direction
+ * Returns:     0 = success.
+ *             <0 = fail.
+ */
+IP_GLOBAL Ip_s32
+ipfirewall_mac_internal_get_rule(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp, Ip_bool in)
+{
+    Ipfirewall_rule *fw_rule;
+    Ip_u32 i;
+
+    /* Get the specified entry */
+    if (in == IP_TRUE)
+        fw_rule = IPCOM_LIST_FIRST(&ipfirewall->mac_head_rule_input);
+    else
+        fw_rule = IPCOM_LIST_FIRST(&ipfirewall->mac_head_rule_output);
+
+    for(i=0; i<ctrl->seqno && fw_rule != IP_NULL; i++)
+        fw_rule = IPCOM_LIST_NEXT(&fw_rule->list_rule);
+
+    /* Check if the entry existed */
+    if(fw_rule == IP_NULL)
+    {
+        *lenp = 0;
+        return 0;
+    }
+
+    ipcom_memcpy(&ctrl->type.rule_info, &fw_rule->inner, sizeof(fw_rule->inner));
+    *lenp = sizeof(*ctrl);
+    return 0;
+}
+
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_internal_get_log
+ *===========================================================================
+ * Description: Get MAC filter log entry.
+ * Parameters:  ctrl - pointer to control structure.
+ *              lenp - pointer to length of returned data.
+ * Returns:     0 = success.
+ *             <0 = fail.
+ */
+IP_GLOBAL Ip_s32
+ipfirewall_mac_internal_get_log(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp)
+{
+    Ipfirewall_mac_log *fw_mac_log;
+    Ip_u32 i;
+
+    /* Get the specified entry */
+    fw_mac_log = IPCOM_LIST_FIRST(&ipfirewall->mac_head_log);
+    for(i=0; i<ctrl->seqno && fw_mac_log != IP_NULL; i++)
+        fw_mac_log = IPCOM_LIST_NEXT(&fw_mac_log->list_log);
+
+    /* Check if the entry existed */
+    if(fw_mac_log == IP_NULL)
+    {
+        *lenp = 0;
+        return 0;
+    }
+
+    ipcom_memcpy(&ctrl->type.mac_log_info, &fw_mac_log->inner, sizeof(fw_mac_log->inner));
+    *lenp = sizeof(*ctrl);
+    return 0;
+
+}
+
+
+/*
+ ****************************************************************************
+ * 11                    PUBLIC FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_input_hook
+ *===========================================================================
+ * Description: MAC filter input hook.
+ * Parameters:  netif - pointer to interface.
+ *              pkt - pointer to packet.
+ * Returns:     1 = Block packet.
+ *              0 = Pass packet.
+ */
+IP_PUBLIC Ip_s32
+ipfirewall_mac_input_hook(Ipcom_netif *netif, Ipcom_pkt *pkt)
+{
+    Ip_s32 ret;
+
+    if (ipfirewall->inner.enabled == 0 || ipfirewall->inner.mac_num_in_rules == 0)
+        return 0;
+
+    ret = ipfirewall_mac_check_rules(netif, pkt, IP_TRUE);
+    return ret;
+}
+
+
+/*
+ *===========================================================================
+ *                    ipfirewall_mac_output_hook
+ *===========================================================================
+ * Description: MAC filter output hook.
+ * Parameters:  netif - pointer to interface.
+ *              pkt - pointer to packet.
+ * Returns:     1 = Block packet.
+ *              0 = Pass packet.
+ */
+IP_PUBLIC Ip_s32
+ipfirewall_mac_output_hook(Ipcom_netif *netif, Ipcom_pkt *pkt)
+{
+    Ip_s32 ret;
+
+    if (ipfirewall->inner.enabled == 0 || ipfirewall->inner.mac_num_out_rules == 0)
+        return 0;
+
+    ret = ipfirewall_mac_check_rules(netif, pkt, IP_FALSE);
+    return ret;
+}
+
+#else
+int ipfirewall_mac_empty_file;
+#endif  /* #ifdef IPFIREWALL_USE_MAC_FILTER */
+
+/*
+ ****************************************************************************
+ *                      END OF FILE
+ ****************************************************************************
+ */

components/ip_net2-6.9/ipfirewall/src/ipfirewall_userdef_example.c

@@ -0,0 +1,165 @@
+/*
+ ******************************************************************************
+ *                     INTERPEAK SOURCE FILE
+ *
+ *   Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall_userdef_example.c,v $ $Revision: 1.17 $
+ *   $Source: /home/interpeak/CVSRoot/ipfirewall/src/ipfirewall_userdef_example.c,v $
+ *   $Author: markus $
+ *   $State: Exp $ $Locker:  $
+ *
+ *   INTERPEAK_COPYRIGHT_STRING
+ *     Design and implementation by Markus Carlstedt <markus@interpeak.se>
+ ******************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 1                    DESCRIPTION
+ ****************************************************************************
+ * User defined function example.
+ */
+
+/*
+ ****************************************************************************
+ * 2                    CONFIGURATION
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 3                    INCLUDE FILES
+ ****************************************************************************
+ */
+
+#define IPCOM_USE_CLIB_PROTO
+#include <ipcom_type.h>
+#include <ipcom_cstyle.h>
+#include <ipcom_clib.h>
+
+#define IPFIREWALL_C
+#include "ipfirewall.h"
+
+/*
+ ****************************************************************************
+ * 4                    DEFINES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 5                    TYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 6                    EXTERN PROTOTYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 7                    LOCAL PROTOTYPES
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 8                    DATA
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 9                    LOCAL FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 10                   GLOBAL FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 11                    PUBLIC FUNCTIONS
+ ****************************************************************************
+ */
+
+/*
+ *===========================================================================
+ *                    ipfirewall_userdef_match
+ *===========================================================================
+ * Description: User defined match function example
+ * Parameters:  pkt    - pointer to the ipcom packet
+ *              cookie - a cookie set at registration.
+ *              info   - user defined info buffer
+ * Returns:     1 = rule matched.
+ *              0 = rule did not match.
+ *
+ */
+IP_PUBLIC int
+ipfirewall_userdef_match(Ipcom_pkt *pkt, void *cookie, void *info)
+{
+    (void)pkt;
+    (void)cookie;
+    (void)info;
+
+    /* User code here */
+
+    if (ipcom_strcmp(info, "match") == 0)
+        return 1;
+    else
+        return 0;
+}
+
+
+/*
+ *===========================================================================
+ *                    ipfirewall_userdef_check
+ *===========================================================================
+ * Description: User defined check function example
+ *              cookie  - a cookie set at registration.
+ *              info    - parameter string specified in the rule syntax
+ *              infolen - length of user defined info buffer
+ * Returns:     1 = rule parameters accepted
+ *              0 = rule parameters not accepted
+ */
+IP_PUBLIC int
+ipfirewall_userdef_check(void *cookie, void *info, unsigned int infolen)
+{
+    (void)cookie;
+    (void)info;
+    (void)infolen;
+
+    /* User code here */
+
+    return 1;
+}
+
+/*
+ *===========================================================================
+ *                    ipfirewall_userdef_destroy
+ *===========================================================================
+ * Description: User defined destroy function example
+ *              cookie  - a cookie set at registration.
+ *              info    - parameter string specified in the rule syntax
+ *              infolen - length of user defined info buffer
+ */
+IP_PUBLIC void
+ipfirewall_userdef_destroy(void *cookie, void *info, unsigned int infolen)
+{
+    (void)cookie;
+    (void)info;
+    (void)infolen;
+
+    /* User code here */
+}
+
+
+/*
+ ****************************************************************************
+ *                      END OF FILE
+ ****************************************************************************
+ */