Table of Contents

Table of Chapters

7. IP FILTERING (AS PER RFC2669)

7.1 Overview

This section describes the IP filtering capabilities of NicheStack. IP filtering can be used with the TCP/IP stack to filter the incoming and outgoing traffic. The user specifies the filters. Based on those filters, action is taking for incoming and outgoing packets.

InterNiche IP filtering code is based on the specification in RFC2669. Particularly, section "3.3.3. IP Filtering - docsDevIpFilterTable". Though the RFC2669 is targeted for management of cable devices, the specification for IP filtering is quite generic and can be used with any TCP/IP. This section is intended to be a help on how to use InterNiche IP filtering and hence the IP filtering specifications from RFC2669 are not duplicated here.

InterNiche IP filtering is implemented in a separate directory. When bundled with InterNiche TCPIP, it is fully intergrated and all the user has to do is to set the filters. By itself the IP filtering code is quite generic and can be used with other TCP/IP stacks too.

7.2 Files

The code for IP filtering is in under ipf directory.

The file ipf.c implements IP filtering. The file DOCS_CAB.C is placeholder for the MIB for IP filtering. Ipf.h an docs_cab.h are the respective header files.

7.3 How does IP filtering work ?

IP filtering is implemented in the file ipf.c. It has three interface functions.

ipf_init()called during initialization time to initialize and populate the IP filter table.
ipf_filter()called whenever filtering is to be applied to any packet.
ipf_cleanup()called when the application is shutting down. It cleans up (frees) all entries in IP filter table.

Whenever the IP stack receives a packet or needs to send an IP packet, it calls ipf_filter(). ipf_filter() returns SUCCESS if the packet is to be accepted. Else returns a non-zero value. It is the duty of the calling routine to discard the packet (based on value returned by ipf_filter()).

The function ipf_filter() does filtering based on the entries in the IP Filter table. There are a number of ways through which the user can manipulate the filters/entries in IP Filter table.

  1. Statically add filters in ipfilterentp[ ] (which implements the IP filter table)
  2. Add filters/entries in the configuration ipfilter.nv
  3. Add/delete/view entries in IP filter table using menu commands
  4. Add/delete/view entries in IP filter table using SNMP

7.4 IP Filter Table Implementation

IP filter table is implemented as a generic list. Generic list is implemented in misclib/genlist.c. The interface functions are in file h/genlist.h. Here is an explanation of how IP filter table is implemented.

  1. Define the list to hold the table.
    struct NicheList ipfiltertable;
  2. Define a pointer to list (for ease of use, because this pointer is passed to many functions).
    NICHELIST p_ipfiltertable = &ipfiltertable;
  3. Initialize the list/table by calling niche_list_construction. The second argument defines the "size" of data for each entry in list.
    niche_list_constructor(p_ipfiltertable,sizeof(struct docsDevFilterIpEntry_mib));
  4. Add entries to the table by calling niche_add_sorted(). niche_add_sorted() adds entry sorted by the first field.
    niche_add_sorted(p_ipfiltertable,(GEN_STRUCT)&ipfilterent[i]);
  5. Whenever any entry is to be deleted, then niche_del_id() is called. In our current case, this gets called from nv_del_entry_byid().
    nv_del_entry_byid(pio, num, docsis_sections);
  6. When we are done, niche_list_destructor() is called so that the whole table gets cleaned up.
    niche_list_destructor(p_ipfiltertable);
  7. For traversing the list there are two ways.

    Traversing as a linked list.

    struct docsDevFilterIpEntry_mib *ent;
    NICHE_ELE node=p_ipfiltertable->head; /* start of linked list */
    for ( ; node ; node=node->next)
    {
       ent= (struct docsDevFilterIpEntry_mib *)node->p_data;
       << use ent >>
    }
    

    Traversing as an array

    int   i,len;
    struct docsDevFilterIpEntry_mib *entry;
    len = niche_list_len(p_ipfiltertable);
    for (i=0 ; i<len ; i++ )
    {
       entry = (struct docsDevFilterIpEntry_mib *)niche_list_getat(p_ipfiltertable,i);
       << use entry >>
    }
    

One thing worth mentioning is that the generic list is used to create and manipulate the list. To be able to use it in the above fashion, it is very important that the first field of struct docsDevFilterIpEntry_mib is the "id" based on which entries are sorted.

Please refer to generic list documentation on how to use it for other kinds of lists.

7.5 How to use IP filtering ?

  1. Enable IP filtering in source code.
    • Enable USE_IPFILTER in ipport.h_h
    • Include IPF.LIB in makefile
  2. Set the filters.
    • Filters can be set dynamically in ipfilter.nv
    • Or dynamically via menu commands ipfadd and ipfdel.
    • Or statically in ipf.c
  3. Run the stack/application.
  4. For checking entries in IP Filter table, use the command "ipfshow".
  5. For enabling/disabling IP filtering, is the command "ipftoggle".
  6. For adding entries, use "ipfadd".
  7. For deleting entries, use "ipfdel". It accepts one argument, <IpIndex>, which is the first field of a filter entry.