===== Project Description =====

%%FreeBSD%% lacks sophisticated layer2 and mixed layer2-layer3 filtering.
ipfw performs mixed layer2-layer3 packet filtering using its own hooks in
ether_demux/ether_output_frame and if_bridge.
pf can't filter by layer2 addresses. I propose to improve both ipfw and pf to filter by layer2 addresses.

Recent patches can be found in [[http://github.com/glk/l2filter|github repository]]

Perforce repository: ''%%http://perforce.freebsd.org/changeList.cgi?CMD=changes&FSPC=//depot/projects/soc2008/gk%5fl2filter/...%%''

[[http://glebkurtsou.blogspot.com/|Blog]]

===== Milestones =====

=== general ===

  * <del>Implement pfil hooks for filtering ethernet packets</del>
  * <del>Add mtag containing source and destination layer2 addresses to every mbuf</del>
  * <del>Add per interface flags: l2filter, l2tag</del>

=== ipfw ===

  * <del>Update ipfw layer2 not to touch ip headers, but to use mentioned mtags to do MAC-IP filtering</del>
  * <del>Add src-ether and dst-ether ipfw options</del>
  * <del>Support mac addresses in ipfw lookup tables</del>
  * <del>Stateful filtering by mac addresses</del>
  * <del>Implement ARP filtering options</del>
  * <del>Update documentation</del>

=== pf ===

  * <del>Add stateful filtering against mac addresses. Make it part of present layer3 stateful filtering.</del>
  * <del>Extend pf's tables facility to contain layer2 address apart with layer3 address.</del>
  * <del>Support in userspace (pf.conf, pfctl).</del>
  * <del>Update documentation</del>