Skip to content

Commit 2a1f081

Browse files
dgarskedgarske
committed
Updates to support NetX.
1 parent c686c2c commit 2a1f081

File tree

2 files changed

+27
-98
lines changed

2 files changed

+27
-98
lines changed

‎src/netxduo/packet_filter_glue.c‎

Lines changed: 22 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -563,14 +563,6 @@ int wolfsentry_inet_pton(int af, const char* src, void* dst)
563563
return result;
564564
}
565565

566-
/* Global wolfSentry context for NetX Duo integration */
567-
static struct wolfsentry_context *wolfsentry_netx_ctx = NULL;
568-
569-
/* Constants for protocol numbers */
570-
#define NETX_PROTOCOL_TCP 6
571-
#define NETX_PROTOCOL_UDP 17
572-
#define NETX_PROTOCOL_ICMP 1
573-
574566
/* IP header structure for parsing */
575567
#pragma pack(push, 1)
576568
struct netx_ip_header {
@@ -621,7 +613,7 @@ struct netx_udp_header {
621613
*
622614
* @return 0 on success, -1 on error
623615
*/
624-
static int parse_netx_packet(unsigned char *packet_data, unsigned long data_length,
616+
static int parse_ip_packet(unsigned char *packet_data, unsigned long data_length,
625617
unsigned char *local_addr, unsigned char *remote_addr,
626618
unsigned short *local_port, unsigned short *remote_port,
627619
unsigned char *protocol, int is_outbound)
@@ -684,14 +676,14 @@ static int parse_netx_packet(unsigned char *packet_data, unsigned long data_leng
684676
*remote_port = 0;
685677

686678
/* Extract port numbers for TCP and UDP */
687-
if (*protocol == NETX_PROTOCOL_TCP || *protocol == NETX_PROTOCOL_UDP) {
679+
if (*protocol == IPPROTO_TCP || *protocol == IPPROTO_UDP) {
688680
unsigned int ip_header_len = (ip_header->version_ihl & 0x0F) * 4;
689681

690682
if (data_length < ip_header_len + sizeof(struct netx_tcp_header)) {
691683
return -1;
692684
}
693685

694-
if (*protocol == NETX_PROTOCOL_TCP) {
686+
if (*protocol == IPPROTO_TCP) {
695687
tcp_header = (struct netx_tcp_header *)(packet_data + ip_header_len);
696688
if (is_outbound) {
697689
*local_port = ntohs(tcp_header->source_port);
@@ -700,7 +692,7 @@ static int parse_netx_packet(unsigned char *packet_data, unsigned long data_leng
700692
*local_port = ntohs(tcp_header->dest_port);
701693
*remote_port = ntohs(tcp_header->source_port);
702694
}
703-
} else if (*protocol == NETX_PROTOCOL_UDP) {
695+
} else if (*protocol == IPPROTO_UDP) {
704696
udp_header = (struct netx_udp_header *)(packet_data + ip_header_len);
705697
if (is_outbound) {
706698
*local_port = ntohs(udp_header->source_port);
@@ -727,7 +719,8 @@ static int parse_netx_packet(unsigned char *packet_data, unsigned long data_leng
727719
*/
728720
static int build_wolfsentry_sockaddr(struct wolfsentry_sockaddr *sockaddr,
729721
const unsigned char *addr_bytes,
730-
unsigned short port, unsigned char protocol)
722+
unsigned short port, unsigned char protocol,
723+
unsigned int interface_id)
731724
{
732725
if (!sockaddr || !addr_bytes) {
733726
return -1;
@@ -737,7 +730,7 @@ static int build_wolfsentry_sockaddr(struct wolfsentry_sockaddr *sockaddr,
737730
sockaddr->sa_proto = protocol;
738731
sockaddr->sa_port = (wolfsentry_port_t)port;
739732
sockaddr->addr_len = 32; /* IPv4 address length in bits */
740-
sockaddr->interface = 0; /* Default interface */
733+
sockaddr->interface = interface_id; /* Default interface */
741734

742735
/* Copy IPv4 address (4 bytes) */
743736
memcpy(sockaddr->addr, addr_bytes, 4);
@@ -748,16 +741,16 @@ static int build_wolfsentry_sockaddr(struct wolfsentry_sockaddr *sockaddr,
748741
/**
749742
* @brief NetX Duo raw packet filter callback using wolfSentry
750743
*
751-
* This function is called by NetX Duo for each raw IP packet to determine
744+
* This function is called with the IP packet to determine
752745
* whether the packet should be accepted or rejected based on wolfSentry rules.
753746
*
754747
* @param packet_data Pointer to the packet data buffer
755748
* @param data_length Length of the packet data in bytes
756749
*
757750
* @return NX_SUCCESS to accept packet, NX_NOT_SUCCESSFUL to reject packet
758751
*/
759-
int wolfsentry_netx_packet_filter(unsigned char *packet_data, unsigned long data_length);
760-
int wolfsentry_netx_packet_filter(unsigned char *packet_data, unsigned long data_length)
752+
int wolfsentry_netx_ip_packet_filter(struct wolfsentry_context* ctx, unsigned int interface_id,
753+
unsigned char *packet_data, unsigned long data_length)
761754
{
762755
unsigned char local_addr[4], remote_addr[4];
763756
unsigned short local_port, remote_port;
@@ -769,29 +762,28 @@ int wolfsentry_netx_packet_filter(unsigned char *packet_data, unsigned long data
769762
wolfsentry_ent_id_t rule_id;
770763
wolfsentry_route_flags_t inexact_matches;
771764

772-
/* sockaddr structures with space for IPv4 addresses */
773-
WOLFSENTRY_SOCKADDR(32) local_sockaddr_buf, remote_sockaddr_buf;
765+
/* Define sockaddr structures for local and remote endpoints */
766+
WOLFSENTRY_SOCKADDR(32) local_sockaddr_buf, remote_sockaddr_buf; /* 32 bits for IPv4 address */
767+
struct wolfsentry_sockaddr *local_sockaddr, *remote_sockaddr;
774768

775-
struct wolfsentry_sockaddr *local_sockaddr = (struct wolfsentry_sockaddr *)&local_sockaddr_buf;
776-
struct wolfsentry_sockaddr *remote_sockaddr = (struct wolfsentry_sockaddr *)&remote_sockaddr_buf;
769+
/* Initialize sockaddr structures */
770+
memset(&local_sockaddr_buf, 0, sizeof(local_sockaddr_buf));
771+
memset(&remote_sockaddr_buf, 0, sizeof(remote_sockaddr_buf));
777772

778-
/* Check if wolfSentry is initialized */
779-
if (!wolfsentry_netx_ctx) {
780-
/* If wolfSentry is not initialized, accept all packets */
781-
return NX_SUCCESS;
782-
}
773+
local_sockaddr = (struct wolfsentry_sockaddr*)&local_sockaddr_buf;
774+
remote_sockaddr = (struct wolfsentry_sockaddr*)&remote_sockaddr_buf;
783775

784776
/* Parse the packet to extract connection information */
785-
parse_result = parse_netx_packet(packet_data, data_length,
777+
parse_result = parse_ip_packet(packet_data, data_length,
786778
local_addr, remote_addr, &local_port, &remote_port, &protocol, 0);
787779
if (parse_result != 0) {
788780
/* If we can't parse the packet, accept it by default */
789781
return NX_NOT_SUCCESSFUL;
790782
}
791783

792784
/* Build wolfSentry sockaddr structures */
793-
if (build_wolfsentry_sockaddr(local_sockaddr, local_addr, local_port, protocol) != 0 ||
794-
build_wolfsentry_sockaddr(remote_sockaddr, remote_addr, remote_port, protocol) != 0) {
785+
if (build_wolfsentry_sockaddr(local_sockaddr, local_addr, local_port, protocol, interface_id) != 0 ||
786+
build_wolfsentry_sockaddr(remote_sockaddr, remote_addr, remote_port, protocol, interface_id) != 0) {
795787
/* If we can't build sockaddr structures, accept packet by default */
796788
return NX_NOT_SUCCESSFUL;
797789
}
@@ -804,7 +796,7 @@ int wolfsentry_netx_packet_filter(unsigned char *packet_data, unsigned long data
804796

805797
/* Call wolfSentry to evaluate the packet */
806798
ret = wolfsentry_route_event_dispatch(
807-
wolfsentry_netx_ctx,
799+
ctx,
808800
NULL, /* thread */
809801
remote_sockaddr,
810802
local_sockaddr,
@@ -834,68 +826,3 @@ int wolfsentry_netx_packet_filter(unsigned char *packet_data, unsigned long data
834826
/* If no explicit action, use default policy (reject) */
835827
return NX_NOT_SUCCESSFUL;
836828
}
837-
838-
/**
839-
* @brief Install WolfSentry packet filter callbacks for NetX Duo
840-
*
841-
* This function installs the WolfSentry packet filtering callbacks into
842-
* the NetX Duo TCP/IP stack to enable packet filtering and security
843-
* policy enforcement.
844-
*
845-
* @param ip_ptr Pointer to the NetX Duo IP instance
846-
*
847-
* @return 0 on success, negative error code on failure
848-
*/
849-
int wolfsentry_install_netx_filter_callbacks(NX_IP *ip_ptr)
850-
{
851-
UINT nx_status;
852-
853-
if (!ip_ptr) {
854-
return -1;
855-
}
856-
857-
/* Enable raw packet processing in NetX */
858-
nx_status = nx_ip_raw_packet_enable(ip_ptr);
859-
if (nx_status != NX_SUCCESS) {
860-
return -2;
861-
}
862-
863-
/* Install the packet filter callback */
864-
nx_status = nx_ip_raw_packet_filter_set(ip_ptr, wolfsentry_netx_packet_filter);
865-
if (nx_status != NX_SUCCESS) {
866-
return -3;
867-
}
868-
869-
return 0;
870-
}
871-
872-
/**
873-
* @brief Set the wolfSentry context for NetX Duo integration
874-
*
875-
* This function sets the wolfSentry context that will be used by the
876-
* packet filter callbacks. This must be called after wolfSentry is
877-
* initialized and before installing the filter callbacks.
878-
*
879-
* @param ctx Pointer to the wolfSentry context
880-
*
881-
* @return 0 on success, -1 on error
882-
*/
883-
int wolfsentry_set_netx_context(struct wolfsentry_context *ctx)
884-
{
885-
if (!ctx) {
886-
return -1;
887-
}
888-
889-
wolfsentry_netx_ctx = ctx;
890-
return 0;
891-
}
892-
893-
/**
894-
* @brief Get the current wolfSentry context for NetX Duo integration
895-
*
896-
* @return Pointer to the wolfSentry context, or NULL if not set
897-
*/
898-
struct wolfsentry_context *wolfsentry_get_netx_context(void)
899-
{
900-
return wolfsentry_netx_ctx;
901-
}

‎wolfsentry/wolfsentry_netxduo.h‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@
4141
#ifndef IPPROTO_UDP
4242
#define IPPROTO_UDP 17 /* TCP Socket */
4343
#endif
44+
#ifndef IPPROTO_ICMP
45+
#define IPPROTO_ICMP 1
46+
#endif
4447

4548
#ifndef in_addr
4649
struct nx_bsd_in_addr {
@@ -75,8 +78,7 @@ int wolfsentry_inet_pton(int af, const char* src, void* dst);
7578
#endif
7679

7780
struct wolfsentry_context;
78-
int wolfsentry_install_netx_filter_callbacks(NX_IP *ip_ptr);
79-
int wolfsentry_set_netx_context(struct wolfsentry_context *ctx);
80-
struct wolfsentry_context *wolfsentry_get_netx_context(void);
81+
int wolfsentry_netx_ip_packet_filter(struct wolfsentry_context* ctx, unsigned int interface_id,
82+
unsigned char *packet_data, unsigned long data_length);
8183

8284
#endif /* _WOLFSENTRY_NETXDUO_H */

0 commit comments

Comments
 (0)