aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDarren Reed <darrenr@FreeBSD.org>2001-07-28 11:59:33 +0000
committerDarren Reed <darrenr@FreeBSD.org>2001-07-28 11:59:33 +0000
commitdba82da1c8912a1a3a6328593dc75b9f15f19fcf (patch)
tree503d2119100a8bd3735c0bda1607f3a64ed1ad33
parentdd298e2f037989712b8d15d3692045527edeee31 (diff)
downloadsrc-dba82da1c8912a1a3a6328593dc75b9f15f19fcf.tar.gz
src-dba82da1c8912a1a3a6328593dc75b9f15f19fcf.zip
Import IPFilter version 3.4.20
Notes
Notes: svn path=/vendor/ipfilter/dist/; revision=80486
-rw-r--r--contrib/ipfilter/BNF2
-rw-r--r--contrib/ipfilter/HISTORY115
-rw-r--r--contrib/ipfilter/IMPORTANT35
-rw-r--r--contrib/ipfilter/Makefile11
-rw-r--r--contrib/ipfilter/common.c6
-rw-r--r--contrib/ipfilter/etc/services1
-rw-r--r--contrib/ipfilter/facpri.c15
-rw-r--r--contrib/ipfilter/facpri.h8
-rw-r--r--contrib/ipfilter/fil.c144
-rw-r--r--contrib/ipfilter/fils.c197
-rw-r--r--contrib/ipfilter/inet_addr.c19
-rw-r--r--contrib/ipfilter/ip_auth.c217
-rw-r--r--contrib/ipfilter/ip_auth.h12
-rw-r--r--contrib/ipfilter/ip_compat.h97
-rw-r--r--contrib/ipfilter/ip_fil.c215
-rw-r--r--contrib/ipfilter/ip_fil.h29
-rw-r--r--contrib/ipfilter/ip_frag.c107
-rw-r--r--contrib/ipfilter/ip_frag.h17
-rw-r--r--contrib/ipfilter/ip_ftp_pxy.c110
-rw-r--r--contrib/ipfilter/ip_lfil.c14
-rw-r--r--contrib/ipfilter/ip_log.c67
-rw-r--r--contrib/ipfilter/ip_nat.c154
-rw-r--r--contrib/ipfilter/ip_nat.h33
-rw-r--r--contrib/ipfilter/ip_proxy.c34
-rw-r--r--contrib/ipfilter/ip_proxy.h11
-rw-r--r--contrib/ipfilter/ip_raudio_pxy.c22
-rw-r--r--contrib/ipfilter/ip_sfil.c20
-rw-r--r--contrib/ipfilter/ip_state.c77
-rw-r--r--contrib/ipfilter/ip_state.h16
-rw-r--r--contrib/ipfilter/ipf.c46
-rw-r--r--contrib/ipfilter/ipf.h8
-rw-r--r--contrib/ipfilter/ipfs.c19
-rw-r--r--contrib/ipfilter/ipft_ef.c8
-rw-r--r--contrib/ipfilter/ipft_hx.c8
-rw-r--r--contrib/ipfilter/ipft_pc.c17
-rw-r--r--contrib/ipfilter/ipft_sn.c31
-rw-r--r--contrib/ipfilter/ipft_td.c8
-rw-r--r--contrib/ipfilter/ipft_tx.c18
-rw-r--r--contrib/ipfilter/ipl.h10
-rw-r--r--contrib/ipfilter/iplang/iplang.h4
-rw-r--r--contrib/ipfilter/ipmon.c205
-rw-r--r--contrib/ipfilter/ipnat.c76
-rw-r--r--contrib/ipfilter/ipsd/ipsd.c6
-rw-r--r--contrib/ipfilter/ipsd/ipsd.h4
-rw-r--r--contrib/ipfilter/ipsd/ipsdr.c6
-rw-r--r--contrib/ipfilter/ipsd/linux.h4
-rw-r--r--contrib/ipfilter/ipsd/sbpf.c4
-rw-r--r--contrib/ipfilter/ipsd/sdlpi.c4
-rw-r--r--contrib/ipfilter/ipsd/slinux.c4
-rw-r--r--contrib/ipfilter/ipsd/snit.c4
-rw-r--r--contrib/ipfilter/ipsend/arp.c13
-rw-r--r--contrib/ipfilter/ipsend/hpux.c4
-rw-r--r--contrib/ipfilter/ipsend/ip.c12
-rw-r--r--contrib/ipfilter/ipsend/ipresend.12
-rw-r--r--contrib/ipfilter/ipsend/ipresend.c13
-rw-r--r--contrib/ipfilter/ipsend/ipsend.c13
-rw-r--r--contrib/ipfilter/ipsend/ipsend.h12
-rw-r--r--contrib/ipfilter/ipsend/ipsopt.c18
-rw-r--r--contrib/ipfilter/ipsend/iptest.c13
-rw-r--r--contrib/ipfilter/ipsend/iptests.c13
-rw-r--r--contrib/ipfilter/ipsend/larp.c6
-rw-r--r--contrib/ipfilter/ipsend/linux.h4
-rw-r--r--contrib/ipfilter/ipsend/lsock.c6
-rw-r--r--contrib/ipfilter/ipsend/resend.c14
-rw-r--r--contrib/ipfilter/ipsend/sbpf.c6
-rw-r--r--contrib/ipfilter/ipsend/sdlpi.c9
-rw-r--r--contrib/ipfilter/ipsend/sirix.c4
-rw-r--r--contrib/ipfilter/ipsend/slinux.c6
-rw-r--r--contrib/ipfilter/ipsend/snit.c6
-rw-r--r--contrib/ipfilter/ipsend/sock.c14
-rw-r--r--contrib/ipfilter/ipsend/ultrix.c4
-rw-r--r--contrib/ipfilter/ipt.c16
-rw-r--r--contrib/ipfilter/ipt.h8
-rw-r--r--contrib/ipfilter/kmem.c24
-rw-r--r--contrib/ipfilter/kmem.h10
-rw-r--r--contrib/ipfilter/man/ipf.52
-rw-r--r--contrib/ipfilter/man/ipl.42
-rw-r--r--contrib/ipfilter/misc.c8
-rw-r--r--contrib/ipfilter/ml_ipl.c6
-rw-r--r--contrib/ipfilter/mlf_ipl.c33
-rw-r--r--contrib/ipfilter/mli_ipl.c6
-rw-r--r--contrib/ipfilter/mln_ipl.c6
-rw-r--r--contrib/ipfilter/mls_ipl.c8
-rw-r--r--contrib/ipfilter/natparse.c25
-rw-r--r--contrib/ipfilter/opt.c8
-rw-r--r--contrib/ipfilter/parse.c26
-rw-r--r--contrib/ipfilter/pcap.h9
-rw-r--r--contrib/ipfilter/relay.c9
-rw-r--r--contrib/ipfilter/snoop.h8
-rw-r--r--contrib/ipfilter/solaris.c344
-rw-r--r--contrib/ipfilter/test/Makefile6
-rw-r--r--contrib/ipfilter/test/expected/i74
-rw-r--r--contrib/ipfilter/test/input/f134
93 files changed, 1972 insertions, 1091 deletions
diff --git a/contrib/ipfilter/BNF b/contrib/ipfilter/BNF
index 556171d1ff8c..ac2381b6d4de 100644
--- a/contrib/ipfilter/BNF
+++ b/contrib/ipfilter/BNF
@@ -17,7 +17,7 @@ log = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
call = "call" [ "now" ] function-name .
skip = "skip" decnumber .
dup = "dup-to" interface-name[":"ipaddr] .
-froute = "fastroute" | "to" interface-name .
+froute = "fastroute" | "to" interface-name [ ":" ipaddr ] .
protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
srcdst = "all" | fromto .
fromto = "from" object "to" object .
diff --git a/contrib/ipfilter/HISTORY b/contrib/ipfilter/HISTORY
index 02493671ca9b..584f4f20347d 100644
--- a/contrib/ipfilter/HISTORY
+++ b/contrib/ipfilter/HISTORY
@@ -22,6 +22,121 @@
# and especially those who have found the time to port IP Filter to new
# platforms.
#
+3.4.20 24/07/2001 - Released
+
+adjust NAT hashing to give a better spread across the table
+
+show icmp code/type names in output, where known
+
+fix bug in altering cached interface names in state when resync'ing
+
+fix bug in real audio proxy that caused crashs
+
+fix compiling using sunos4 cc
+
+patch from casper to address weird exit problem for ipstat in top mode
+
+patch from Greg Woods to produce names for icmp types/unreach codes,
+where they are known
+
+fix bug where ipfr_fastroute() would use a mblk and it would also get
+freed later.
+
+don't match fragments which would cause 64k length to be exceeded
+
+ftp proxy fix for port numbers being setup for pasv ftp with state/nat
+
+change hashing for NAT to include both IP#'s and ports.
+
+Solaris fixes for IPv6
+
+fix compiling iplang bits, under Solaris, for ipsend
+
+3.4.19 29/06/2001 - Released
+
+fix to support suspend/resume on solaris8 as well as ipv6
+
+include group/group-head in match of filter rules
+
+fix endian problem reading snoop files
+
+make all licence comments point to the one place
+
+fix ftp proxy to only advance state if a reply is received in response to
+a recognised command
+
+3.4.18 05/06/2001 - Released
+
+fix up parsing of "from ! host" where '!' is separate
+
+disable hardware checksums for NetBSD
+
+put ipftest temporary files in . rather than /tmp
+
+modify ftp proxy to be more intelligent about moving between states
+and recognise new authentication commands
+
+allow state/nat table sizes to be externally influenced
+
+print out host mapping table for NAT with ipnat -l
+
+fix handling of hardware checksum'ing on Solaris
+
+fixup makefiles for Solaris
+
+update regression tests
+
+fix surrender of SPL's for failure cases
+
+include patches for OpenBSD's new timeout mechanism
+
+default ipl_unreach to ICMP_UNREACH_FILTER_PROHIB if defined, else make it
+ICMP_UNREACH_FILTER
+
+fix up handling of packets matching auth rules and interaction with state
+
+add -q command line option to ipfstat on Solaris to list bound interfaces
+
+add command line option to ipfstat/ipnat to select different core image
+
+don't use ncurses on Solaris for STATETOP
+
+fix includes to get FreeBSD version
+
+do not byte swap ip_id
+
+fix handling success for packets matching the auth rule
+
+don't double-count short packets
+
+add ICMP router discovery message size recognition
+
+fix packet length calculation for IPv6
+
+set CPUDIR when for install-sunos5 make target
+
+SUNWspro -xF causes Solaris 2.5.1 kernel to crash
+
+3.4.17 06/04/2001 - Released
+
+fix fragment#0 handling bug where they could get in via cache information
+created by state table entries
+
+use ire_walk to look for ire cache entries with link layer headers cached
+
+deal with bad SPL assumptions for log reading on BSD
+
+fix ftp proxy to allow logins with passwords
+
+some auth rule patches, fixing byte endian problems and returning as an error
+
+support LOG_SECURITY, where available, in ipmon
+
+don't return an error for packets which match auth rules
+
+introduce fr_icmpacktimeout to timeout entries once an ICMP reply has
+been seen separately to when created
+
3.4.16 15/01/2001 - Released
fix race condition in flushing of state entries that are timing out
diff --git a/contrib/ipfilter/IMPORTANT b/contrib/ipfilter/IMPORTANT
index de2cc85b7c9c..0ef7a3d390f7 100644
--- a/contrib/ipfilter/IMPORTANT
+++ b/contrib/ipfilter/IMPORTANT
@@ -3,41 +3,6 @@
****************************************
1)
-If you're using this software and have a rule which ends like this:
-
-flags S
-
-(for TCP), then to make it totally effective, you need to change it to appear
-as follows:
-
-flags S/SA
-
-The problem is that the old code would compare all the TCP flags against the
-rule (which just has "S") to see if that matched exactly. It is very possible
-for this to not be the case and in these cases, the rule would fail to match
-a 'valid' TCP SYN packet.
-
-Why does it need to be "S/SA" and not "S/S" ?
-
-"S/S" will match the SYN-ACK as well the SYN.
-
-By defalt, "flags S" will now be converted to "flags S/AUPRFS".
-
-If you have any queries regarding this, see the examples and ipf(4).
-If you still have a query or suggestion, please email me.
-
-
-2)
-
-If a filter rule used, in combination port comparisons and the flags
-keywords, a "short" TCP packet, if not explicitly blocked high up in
-the list of packets, would actually get matched even though it would
-otherwise not have been (due to the ports not). This behaviour has
-subsequently been fixed.
-
-
-3)
-
If you have BOTH GNU make and the normal make shipped with your system,
DO NOT use the GNU make to build this package.
diff --git a/contrib/ipfilter/Makefile b/contrib/ipfilter/Makefile
index 5770d404907a..09b5db60b50a 100644
--- a/contrib/ipfilter/Makefile
+++ b/contrib/ipfilter/Makefile
@@ -1,11 +1,9 @@
#
-# Copyright (C) 1993-2000 by Darren Reed.
+# Copyright (C) 1993-2001 by Darren Reed.
#
-# Redistribution and use in source and binary forms are permitted
-# provided that this notice is preserved and due credit is given
-# to the original author and the contributors.
+# See the IPFILTER.LICENCE file for details on licencing.
#
-# $Id: Makefile,v 2.11.2.6 2000/12/17 12:43:15 darrenr Exp $
+# $Id: Makefile,v 2.11.2.8 2001/06/26 10:43:10 darrenr Exp $
#
BINDEST=/usr/local/bin
SBINDEST=/sbin
@@ -19,6 +17,7 @@ TOP=../..
CFLAGS=-I$$(TOP)
CPU=`uname -m`
CPUDIR=`uname -s|sed -e 's@/@@g'`-`uname -r`-`uname -m`
+IPFILKERN=`/bin/ls -1tr /usr/src/sys/compile | grep -v .bak | tail -1`
#
# To enable this to work as a Loadable Kernel Module...
#
@@ -262,7 +261,7 @@ install-sunos4: solaris
(cd SunOS4; $(MAKE) "CPU=$(CPU) TOP=.." install)
install-sunos5: solaris
- (cd SunOS5; $(MAKE) "CPU=$(CPU) TOP=.." install)
+ (cd SunOS5; $(MAKE) "CPUDIR=`uname -p`-`uname -r`" "CPU=$(CPU) TOP=.." install)
install-irix: irix
(cd IRIX; smake install "CPU=$(CPU) TOP=.." $(DEST) $(MFLAGS))
diff --git a/contrib/ipfilter/common.c b/contrib/ipfilter/common.c
index afcc95c58747..e46e63ec20d8 100644
--- a/contrib/ipfilter/common.c
+++ b/contrib/ipfilter/common.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <sys/types.h>
#if !defined(__SVR4) && !defined(__svr4__)
diff --git a/contrib/ipfilter/etc/services b/contrib/ipfilter/etc/services
index 7afcde874978..01c4b782e29e 100644
--- a/contrib/ipfilter/etc/services
+++ b/contrib/ipfilter/etc/services
@@ -2360,6 +2360,7 @@ dpserve 7020/udp # DP Serve
dpserveadmin 7021/tcp # DP Serve Admin
dpserveadmin 7021/udp # DP Serve Admin
arcp 7070/tcp # ARCP
+raudio 7070/tcp # Real Audio
arcp 7070/udp # ARCP
clutild 7174/tcp # Clutild
clutild 7174/udp # Clutild
diff --git a/contrib/ipfilter/facpri.c b/contrib/ipfilter/facpri.c
index f8519184ad1b..79afdd214729 100644
--- a/contrib/ipfilter/facpri.c
+++ b/contrib/ipfilter/facpri.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <string.h>
@@ -18,8 +16,12 @@
#include <syslog.h>
#include "facpri.h"
+#ifndef __STDC__
+# define const
+#endif
+
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3 2000/03/13 22:10:18 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3.2.4 2001/07/15 22:06:12 darrenr Exp $";
#endif
typedef struct table {
@@ -55,6 +57,9 @@ table_t facs[] = {
#else
{ "cron2", LOG_CRON2 },
#endif
+#ifdef LOG_SECURITY
+ { "security", LOG_SECURITY },
+#endif
{ "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 },
{ "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 },
{ "local4", LOG_LOCAL4 }, { "local5", LOG_LOCAL5 },
diff --git a/contrib/ipfilter/facpri.h b/contrib/ipfilter/facpri.h
index b80dbe8ab989..7b80377d112e 100644
--- a/contrib/ipfilter/facpri.h
+++ b/contrib/ipfilter/facpri.h
@@ -1,10 +1,8 @@
/*
- * Copyright (C) 1999-2000 by Darren Reed.
+ * Copyright (C) 1999-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
- * $Id: facpri.h,v 1.3 2000/03/13 22:10:18 darrenr Exp $
+ * See the IPFILTER.LICENCE file for details on licencing.
+ * $Id: facpri.h,v 1.3.2.1 2001/06/26 10:43:11 darrenr Exp $
*/
#ifndef __FACPRI_H__
diff --git a/contrib/ipfilter/fil.c b/contrib/ipfilter/fil.c
index 02f075b1c6c5..c4cd2e041168 100644
--- a/contrib/ipfilter/fil.c
+++ b/contrib/ipfilter/fil.c
@@ -1,15 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $";
-#endif
-
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
@@ -100,6 +93,11 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darr
#endif
#include "netinet/ipl.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $";
+#endif
+
#ifndef _KERNEL
# include "ipf.h"
# include "ipt.h"
@@ -115,12 +113,6 @@ extern int opts;
# if SOLARIS || defined(__sgi)
extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
extern kmutex_t ipf_rw;
-# endif
-# if SOLARIS
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \
- ip, qif)
-# else /* SOLARIS */
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
# endif /* SOLARIS || __sgi */
#endif /* _KERNEL */
@@ -226,7 +218,7 @@ fr_info_t *fin;
if (v == 4) {
fin->fin_id = ip->ip_id;
fi->fi_tos = ip->ip_tos;
- off = (ip->ip_off & IP_OFFMASK) << 3;
+ off = (ip->ip_off & IP_OFFMASK);
tcp = (tcphdr_t *)((char *)ip + hlen);
(*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
fi->fi_src.i6[1] = 0;
@@ -239,7 +231,7 @@ fr_info_t *fin;
fi->fi_daddr = ip->ip_dst.s_addr;
p = ip->ip_p;
fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
- if (ip->ip_off & 0x3fff)
+ if (ip->ip_off & (IP_MF|IP_OFFMASK))
fi->fi_fl |= FI_FRAG;
plen = ip->ip_len;
fin->fin_dlen = plen - hlen;
@@ -260,6 +252,7 @@ fr_info_t *fin;
fi->fi_fl = 0;
plen = ntohs(ip6->ip6_plen);
fin->fin_dlen = plen;
+ plen += sizeof(*ip6);
}
#endif
else
@@ -268,6 +261,7 @@ fr_info_t *fin;
fin->fin_off = off;
fin->fin_plen = plen;
fin->fin_dp = (void *)tcp;
+ off <<= 3;
switch (p)
{
@@ -315,25 +309,34 @@ fr_info_t *fin;
icmp = (icmphdr_t *)tcp;
- if (icmp->icmp_type == ICMP_ECHOREPLY ||
- icmp->icmp_type == ICMP_ECHO)
+ switch (icmp->icmp_type)
+ {
+ case ICMP_ECHOREPLY :
+ case ICMP_ECHO :
+ /* Router discovery messages - RFC 1256 */
+ case ICMP_ROUTERADVERT :
+ case ICMP_ROUTERSOLICIT :
minicmpsz = ICMP_MINLEN;
-
+ break;
/*
* type(1) + code(1) + cksum(2) + id(2) seq(2) +
* 3*timestamp(3*4)
*/
- else if (icmp->icmp_type == ICMP_TSTAMP ||
- icmp->icmp_type == ICMP_TSTAMPREPLY)
+ case ICMP_TSTAMP :
+ case ICMP_TSTAMPREPLY :
minicmpsz = 20;
-
+ break;
/*
* type(1) + code(1) + cksum(2) + id(2) seq(2) +
* mask(4)
*/
- else if (icmp->icmp_type == ICMP_MASKREQ ||
- icmp->icmp_type == ICMP_MASKREPLY)
+ case ICMP_MASKREQ :
+ case ICMP_MASKREPLY :
minicmpsz = 12;
+ break;
+ default :
+ break;
+ }
}
if ((!(plen >= hlen + minicmpsz) && !off) ||
@@ -522,7 +525,7 @@ fr_info_t *fin;
* satisfy the "short" class too).
*/
if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
- if (fin->fin_fi.fi_fl & FI_SHORT)
+ if (fin->fin_fl & FI_SHORT)
return !(ft->ftu_tcpf | ft->ftu_tcpfm);
/*
* Match the flags ? If not, abort this match.
@@ -557,10 +560,7 @@ void *m;
fin->fin_fr = NULL;
fin->fin_rule = 0;
fin->fin_group = 0;
- if (fin->fin_v == 4)
- off = ip->ip_off & IP_OFFMASK;
- else
- off = 0;
+ off = fin->fin_off;
pass |= (fi->fi_fl << 24);
if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
@@ -787,7 +787,7 @@ int out;
mb_t *mc = NULL;
# if !defined(__SVR4) && !defined(__svr4__)
# ifdef __sgi
- char hbuf[(0xf << 2) + sizeof(struct icmp) + sizeof(ip_t) + 8];
+ char hbuf[128];
# endif
int up;
@@ -812,6 +812,9 @@ int out;
# ifdef USE_INET6
if (v == 6) {
len = ntohs(((ip6_t*)ip)->ip6_plen);
+ if (!len)
+ return -1; /* potential jumbo gram */
+ len += sizeof(ip6_t);
p = ((ip6_t *)ip)->ip6_nxt;
} else
# endif
@@ -820,7 +823,8 @@ int out;
len = ip->ip_len;
}
- if ((p == IPPROTO_TCP || p == IPPROTO_UDP || p == IPPROTO_ICMP
+ if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
+ (v == 4 && p == IPPROTO_ICMP)
# ifdef USE_INET6
|| (v == 6 && p == IPPROTO_ICMPV6)
# endif
@@ -889,13 +893,6 @@ int out;
# endif
#endif /* _KERNEL */
- /*
- * Be careful here: ip_id is in network byte order when called
- * from ip_output()
- */
- if ((out) && (v == 4))
- ip->ip_id = ntohs(ip->ip_id);
-
changed = 0;
fin->fin_ifp = ifp;
fin->fin_v = v;
@@ -940,15 +937,12 @@ int out;
}
#endif
pass = fr_pass;
- if (fin->fin_fi.fi_fl & FI_SHORT) {
+ if (fin->fin_fl & FI_SHORT) {
ATOMIC_INCL(frstats[out].fr_short);
}
READ_ENTER(&ipf_mutex);
- if (fin->fin_fi.fi_fl & FI_SHORT)
- ATOMIC_INCL(frstats[out].fr_short);
-
/*
* Check auth now. This, combined with the check below to see if apass
* is 0 is to ensure that we don't count the packet twice, which can
@@ -972,8 +966,18 @@ int out;
}
}
- if (apass || (!(fr = ipfr_knownfrag(ip, fin)) &&
- !(fr = fr_checkstate(ip, fin)))) {
+ if (!apass) {
+ if ((fin->fin_fl & FI_FRAG) == FI_FRAG)
+ fr = ipfr_knownfrag(ip, fin);
+ if (!fr && !(fin->fin_fl & FI_SHORT))
+ fr = fr_checkstate(ip, fin);
+ if (fr != NULL)
+ pass = fr->fr_flags;
+ if (fr && (pass & FR_LOGFIRST))
+ pass &= ~(FR_LOGFIRST|FR_LOG);
+ }
+
+ if (apass || !fr) {
/*
* If a packet is found in the auth table, then skip checking
* the access lists for permission but we do need to consider
@@ -1008,22 +1012,26 @@ int out;
ATOMIC_INCL(frstats[out].fr_nom);
}
}
- fr = fin->fin_fr;
} else
pass = apass;
+ fr = fin->fin_fr;
/*
* If we fail to add a packet to the authorization queue,
* then we drop the packet later. However, if it was added
* then pretend we've dropped it already.
*/
- if ((pass & FR_AUTH))
- if (fr_newauth((mb_t *)m, fin, ip) != 0)
+ if ((pass & FR_AUTH)) {
+ if (fr_newauth((mb_t *)m, fin, ip) != 0) {
#ifdef _KERNEL
m = *mp = NULL;
#else
;
#endif
+ error = 0;
+ } else
+ error = ENOSPC;
+ }
if (pass & FR_PREAUTH) {
READ_ENTER(&ipf_auth);
@@ -1038,7 +1046,7 @@ int out;
fin->fin_fr = fr;
if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
- if (fin->fin_fi.fi_fl & FI_FRAG) {
+ if (fin->fin_fl & FI_FRAG) {
if (ipfr_newfrag(ip, fin, pass) == -1) {
ATOMIC_INCL(frstats[out].fr_bnfr);
} else {
@@ -1116,9 +1124,6 @@ logit:
}
#endif /* IPFILTER_LOG */
- if ((out) && (v == 4))
- ip->ip_id = htons(ip->ip_id);
-
#ifdef _KERNEL
/*
* Only allow FR_DUP to work if a rule matched - it makes no sense to
@@ -1160,7 +1165,7 @@ logit:
send_icmp_err(ip, ICMP_UNREACH, fin, dst);
ATOMIC_INCL(frstats[0].fr_ret);
} else if (((pass & FR_RETMASK) == FR_RETRST) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ !(fin->fin_fl & FI_SHORT)) {
if (send_reset(ip, fin) == 0) {
ATOMIC_INCL(frstats[1].fr_ret);
}
@@ -1173,7 +1178,7 @@ logit:
verbose("- forged ICMP unreachable sent\n");
ATOMIC_INCL(frstats[0].fr_ret);
} else if (((pass & FR_RETMASK) == FR_RETRST) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ !(fin->fin_fl & FI_SHORT)) {
verbose("- TCP RST sent\n");
ATOMIC_INCL(frstats[1].fr_ret);
}
@@ -1202,15 +1207,17 @@ logit:
frdest_t *fdp = &fr->fr_tif;
if (((pass & FR_FASTROUTE) && !out) ||
- (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
- if (ipfr_fastroute(m, fin, fdp) == 0)
- m = *mp = NULL;
- }
- if (mc)
- ipfr_fastroute(mc, fin, &fr->fr_dif);
+ (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
+ (void) ipfr_fastroute(m, mp, fin, fdp);
+
+ if (mc != NULL)
+ (void) ipfr_fastroute(mc, &mc, fin, &fr->fr_dif);
}
- if (!(pass & FR_PASS) && m)
+
+ if (!(pass & FR_PASS) && m) {
m_freem(m);
+ m = *mp = NULL;
+ }
# ifdef __sgi
else if (changed && up && m)
m_copyback(m, 0, up, hbuf);
@@ -1221,12 +1228,11 @@ logit:
frdest_t *fdp = &fr->fr_tif;
if (((pass & FR_FASTROUTE) && !out) ||
- (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
- if (ipfr_fastroute(ip, m, mp, fin, fdp) == 0)
- m = *mp = NULL;
- }
- if (mc)
- ipfr_fastroute(ip, mc, mp, fin, &fr->fr_dif);
+ (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
+ (void) ipfr_fastroute(ip, m, mp, fin, fdp);
+
+ if (mc != NULL)
+ (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
}
# endif /* !SOLARIS */
return (pass & FR_PASS) ? 0 : error;
@@ -1458,7 +1464,7 @@ nodata:
* SUCH DAMAGE.
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $
+ * $Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $
*/
/*
* Copy data from an mbuf chain starting "off" bytes from the beginning,
@@ -1907,7 +1913,7 @@ void frsync()
ip_statesync(ifp);
}
ip_natsync((struct ifnet *)-1);
-# endif
+# endif /* !SOLARIS */
WRITE_ENTER(&ipf_mutex);
frsynclist(ipacct[0][fr_active]);
diff --git a/contrib/ipfilter/fils.c b/contrib/ipfilter/fils.c
index 3184e4c53dd5..3ed698abb34f 100644
--- a/contrib/ipfilter/fils.c
+++ b/contrib/ipfilter/fils.c
@@ -1,12 +1,16 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#ifdef __FreeBSD__
-# include <osreldate.h>
+#ifdef __FreeBSD__
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
#endif
#include <stdio.h>
#include <string.h>
@@ -25,10 +29,6 @@
#include <fcntl.h>
#include <stddef.h>
#include <nlist.h>
-#ifdef STATETOP
-#include <ctype.h>
-#include <ncurses.h>
-#endif
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
@@ -56,8 +56,17 @@
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
#ifdef STATETOP
-#include "netinet/ipl.h"
-#endif
+# include "netinet/ipl.h"
+# include <ctype.h>
+# if SOLARIS
+# ifdef ERR
+# undef ERR
+# endif
+# include <curses.h>
+# else /* SOLARIS */
+# include <ncurses.h>
+# endif /* SOLARIS */
+#endif /* STATETOP */
#include "kmem.h"
#if defined(__NetBSD__) || (__OpenBSD__)
# include <paths.h>
@@ -65,10 +74,11 @@
#if !defined(lint)
static const char sccsid[] = "@(#)fils.c 1.21 4/20/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.7 2000/12/02 00:13:56 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.17 2001/07/19 12:24:09 darrenr Exp $";
#endif
extern char *optarg;
+extern int optind;
#define PRINTF (void)printf
#define FPRINTF (void)fprintf
@@ -86,6 +96,7 @@ int use_inet6 = 0;
#ifdef STATETOP
#define STSTRSIZE 80
#define STGROWSIZE 16
+#define HOSTNMLEN 40
#define STSORT_PR 0
#define STSORT_PKTS 1
@@ -128,6 +139,9 @@ static int sort_pkts __P((const void *, const void *));
static int sort_bytes __P((const void *, const void *));
static int sort_ttl __P((const void *, const void *));
#endif
+#if SOLARIS
+void showqiflist __P((char *));
+#endif
static char *hostname(v, ip)
int v;
@@ -160,7 +174,11 @@ char *name;
#else
fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name);
#endif
- fprintf(stderr, " %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
+ fprintf(stderr, "\t\t[-M corefile]");
+#if SOLARIS
+ fprintf(stderr, " [-N symbol-list]");
+#endif
+ fprintf(stderr, "\n %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
exit(1);
}
@@ -177,8 +195,11 @@ char *argv[];
ips_stat_t *ipsstp = &ipsst;
ipfrstat_t ifrst;
ipfrstat_t *ifrstp = &ifrst;
- char *name = NULL, *device = IPL_NAME;
- int c, fd;
+ char *name = NULL, *device = IPL_NAME, *memf = NULL;
+#if SOLARIS
+ char *kern = NULL;
+#endif
+ int c, fd, myoptind;
struct protoent *proto;
int protocol = -1; /* -1 = wild card for any protocol */
@@ -190,13 +211,50 @@ char *argv[];
saddr.s_addr = INADDR_ANY; /* default any source addr */
daddr.s_addr = INADDR_ANY; /* default any dest addr */
- if (openkmem() == -1)
+ /*
+ * Parse these two arguments now lest there be any buffer overflows
+ * in the parsing of the rest.
+ */
+ myoptind = optind;
+#if SOLARIS
+ while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
+#else
+ while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:P:S:T:")) != -1)
+#endif
+ switch (c)
+ {
+ case 'M' :
+ memf = optarg;
+ break;
+#if SOLARIS
+ case 'N' :
+ kern = optarg;
+ break;
+#endif
+ }
+ optind = myoptind;
+
+#if SOLARIS
+ if (kern != NULL || memf != NULL)
+#else
+ if (memf != NULL)
+#endif
+ {
+ (void)setuid(getuid());
+ (void)setgid(getgid());
+ }
+
+ if (openkmem(memf) == -1)
exit(-1);
(void)setuid(getuid());
(void)setgid(getgid());
- while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:P:S:T:")) != -1)
+#if SOLARIS
+ while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
+#else
+ while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:M:P:S:T:")) != -1)
+#endif
{
switch (c)
{
@@ -207,8 +265,7 @@ char *argv[];
#endif
case 'a' :
opts |= OPT_ACCNT|OPT_SHOWLIST;
- break;
- case 'A' :
+ break; case 'A' :
device = IPAUTH_NAME;
opts |= OPT_AUTHSTATS;
break;
@@ -239,6 +296,10 @@ char *argv[];
case 'l' :
opts |= OPT_SHOWLIST;
break;
+ case 'M' :
+ break;
+ case 'N' :
+ break;
case 'n' :
opts |= OPT_SHOWLINENO;
break;
@@ -255,6 +316,12 @@ char *argv[];
exit(-2);
}
break;
+#if SOLARIS
+ case 'q' :
+ showqiflist(kern);
+ exit(0);
+ break;
+#endif
case 's' :
opts |= OPT_IPSTATES;
break;
@@ -653,13 +720,52 @@ ips_stat_t *ipsp;
PRINTF("\tpkt_security & %x = %x, pkt_auth & %x = %x\n",
ips.is_secmsk, ips.is_sec, ips.is_authmsk,
ips.is_auth);
- PRINTF("interfaces: in %s[%p] ",
+ PRINTF("\tinterfaces: in %s[%p] ",
get_ifname(ips.is_ifpin), ips.is_ifpin);
PRINTF("out %s[%p]\n",
get_ifname(ips.is_ifpout), ips.is_ifpout);
}
}
+
+#if SOLARIS
+void showqiflist(kern)
+char *kern;
+{
+ struct nlist qifnlist[2] = {
+ { "qif_head" },
+ { NULL }
+ };
+ qif_t qif, *qf;
+
+ if (kern == NULL)
+ kern = "/dev/ksyms";
+
+ if (nlist(kern, qifnlist) == -1) {
+ fprintf(stderr, "nlist error\n");
+ return;
+ }
+
+ printf("List of interfaces bound by IPFilter:\n");
+ if (kmemcpy((char *)&qf, (u_long)qifnlist[0].n_value, sizeof(qf)))
+ return;
+ while (qf) {
+ if (kmemcpy((char *)&qif, (u_long)qf, sizeof(qif)))
+ break;
+ printf("\tName: %-8s Header Length: %2d SAP: %s (%04x)\n",
+ qif.qf_name, qif.qf_hl,
+#ifdef IP6_DL_SAP
+ (qif.qf_sap == IP6_DL_SAP) ? "IPv6" : "IPv4"
+#else
+ "IPv4"
+#endif
+ , qif.qf_sap);
+ qf = qif.qf_next;
+ }
+}
+#endif
+
+
#ifdef STATETOP
static void topipstates(fd, saddr, daddr, sport, dport, protocol,
refreshtime, topclosed)
@@ -679,9 +785,10 @@ int topclosed;
ips_stat_t ipsst, *ipsstp = &ipsst;
statetop_t *tstable = NULL, *tp;
struct timeval selecttimeout;
+ char hostnm[HOSTNMLEN];
struct protoent *proto;
fd_set readfd;
- char c = '\0';
+ int c = 0;
time_t t;
/* open state device */
@@ -694,7 +801,10 @@ int topclosed;
initscr();
cbreak();
noecho();
- nodelay(stdscr, 1);
+
+ /* init hostname */
+ gethostname(hostnm, sizeof(hostnm) - 1);
+ hostnm[sizeof(hostnm) - 1] = '\0';
/* repeat until user aborts */
while ( 1 ) {
@@ -799,8 +909,8 @@ int topclosed;
attron(A_BOLD);
winx = 0;
move(winx,0);
- sprintf(str1, "%s - state top", IPL_VERSION);
- for(j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
+ sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION);
+ for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
printw(" ");
printw("%s", str1);
attroff(A_BOLD);
@@ -873,7 +983,9 @@ int topclosed;
if (reverse)
tp += tsentry;
- for(i = 0; i <= tsentry; i++) {
+ if (tsentry > maxy - 6)
+ tsentry = maxy - 6;
+ for (i = 0; i <= tsentry; i++) {
/* print src/dest and port */
if ((tp->st_p == IPPROTO_TCP) ||
(tp->st_p == IPPROTO_UDP)) {
@@ -938,22 +1050,25 @@ int topclosed;
select(1, &readfd, NULL, NULL, &selecttimeout);
/* if key pressed, read all waiting keys */
- if (FD_ISSET(0, &readfd))
- while ((c = wgetch(stdscr)) != ERR) {
- if (tolower(c) == 'l') {
- redraw = 1;
- } else if (tolower(c) == 'q') {
- nocbreak();
- endwin();
- exit(0);
- } else if (tolower(c) == 'r') {
- reverse = !reverse;
- } else if (tolower(c) == 's') {
- sorting++;
- if (sorting > STSORT_MAX)
- sorting = 0;
- }
+ if (FD_ISSET(0, &readfd)) {
+ c = wgetch(stdscr);
+ if (c == ERR)
+ continue;
+
+ if (tolower(c) == 'l') {
+ redraw = 1;
+ } else if (tolower(c) == 'q') {
+ nocbreak();
+ endwin();
+ exit(0);
+ } else if (tolower(c) == 'r') {
+ reverse = !reverse;
+ } else if (tolower(c) == 's') {
+ sorting++;
+ if (sorting > STSORT_MAX)
+ sorting = 0;
}
+ }
} /* while */
close(sfd);
diff --git a/contrib/ipfilter/inet_addr.c b/contrib/ipfilter/inet_addr.c
index 49278a8a00cc..03bcf2319698 100644
--- a/contrib/ipfilter/inet_addr.c
+++ b/contrib/ipfilter/inet_addr.c
@@ -52,10 +52,20 @@
* -
* --Copyright--
*/
+#ifdef __STDC__
+# ifndef __P
+# define __P(x) x
+# endif
+#else
+# undef __P
+# define __P(x) ()
+# undef const
+# define const
+#endif
#if !defined(lint)
static const char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93";
-static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1.4.1 2001/07/15 22:06:14 darrenr Exp $";
#endif /* LIBC_SCCS and not lint */
#include <sys/param.h>
@@ -63,13 +73,6 @@ static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darr
#include <arpa/inet.h>
#include <ctype.h>
-#ifndef __P
-# ifdef __STDC__
-# define __P(x) x
-# else
-# define __P(x) ()
-# endif
-#endif
int inet_aton __P((const char *, struct in_addr *));
/*
diff --git a/contrib/ipfilter/ip_auth.c b/contrib/ipfilter/ip_auth.c
index a4536105819c..b22d470b6095 100644
--- a/contrib/ipfilter/ip_auth.c
+++ b/contrib/ipfilter/ip_auth.c
@@ -1,14 +1,8 @@
/*
- * Copyright (C) 1998-2000 by Darren Reed & Guido van Rooij.
+ * Copyright (C) 1998-2001 by Darren Reed & Guido van Rooij.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 darrenr Exp $";
-#endif
-
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
@@ -77,7 +71,7 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 d
#endif
#include <netinet/tcp.h>
#if defined(__sgi) && !defined(IFF_DRVRLOCK) /* IRIX < 6 */
-extern struct ifqueue ipintrq; /* ip packet input queue */
+extern struct ifqueue ipintrq; /* ip packet input queue */
#else
# ifndef linux
# if __FreeBSD_version >= 300000
@@ -107,10 +101,13 @@ extern struct ifqueue ipintrq; /* ip packet input queue */
# endif
#endif
+#if !defined(lint)
+static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.12 2001/07/18 14:57:08 darrenr Exp $";
+#endif
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
-extern KRWLOCK_T ipf_auth;
+extern KRWLOCK_T ipf_auth, ipf_mutex;
extern kmutex_t ipf_authmx;
# if SOLARIS
extern kcondvar_t ipfauthwait;
@@ -129,7 +126,8 @@ static frauth_t fr_auth[FR_NUMAUTH];
mb_t *fr_authpkts[FR_NUMAUTH];
static int fr_authstart = 0, fr_authend = 0, fr_authnext = 0;
static frauthent_t *fae_list = NULL;
-frentry_t *ipauth = NULL;
+frentry_t *ipauth = NULL,
+ *fr_authlist = NULL;
/*
@@ -142,10 +140,12 @@ ip_t *ip;
fr_info_t *fin;
{
u_short id = ip->ip_id;
+ frentry_t *fr;
+ frauth_t *fra;
u_32_t pass;
int i;
- if (fr_auth_lock)
+ if (fr_auth_lock || !fr_authused)
return 0;
READ_ENTER(&ipf_auth);
@@ -155,24 +155,54 @@ fr_info_t *fin;
* case the same packet gets sent again and it hasn't yet been
* auth'd.
*/
- if ((fr_auth[i].fra_index == -2) &&
- (id == fr_auth[i].fra_info.fin_id) &&
- !bcmp((char *)fin,(char *)&fr_auth[i].fra_info,FI_CSIZE)) {
+ fra = fr_auth + i;
+ if ((fra->fra_index == -2) && (id == fra->fra_info.fin_id) &&
+ !bcmp((char *)fin, (char *)&fra->fra_info, FI_CSIZE)) {
/*
* Avoid feedback loop.
*/
- if (!(pass = fr_auth[i].fra_pass) || (pass & FR_AUTH))
+ if (!(pass = fra->fra_pass) || (pass & FR_AUTH))
pass = FR_BLOCK;
+ /*
+ * Create a dummy rule for the stateful checking to
+ * use and return. Zero out any values we don't
+ * trust from userland!
+ */
+ if ((pass & FR_KEEPSTATE) || ((pass & FR_KEEPFRAG) &&
+ (fin->fin_fi.fi_fl & FI_FRAG))) {
+ KMALLOC(fr, frentry_t *);
+ if (fr) {
+ bcopy((char *)fra->fra_info.fin_fr,
+ fr, sizeof(*fr));
+ fr->fr_grp = NULL;
+ fr->fr_ifa = fin->fin_ifp;
+ fr->fr_func = NULL;
+ fr->fr_ref = 1;
+ fr->fr_flags = pass;
+#if BSD >= 199306
+ fr->fr_oifa = NULL;
+#endif
+ }
+ } else
+ fr = fra->fra_info.fin_fr;
+ fin->fin_fr = fr;
RWLOCK_EXIT(&ipf_auth);
WRITE_ENTER(&ipf_auth);
+ if (fr && fr != fra->fra_info.fin_fr) {
+ fr->fr_next = fr_authlist;
+ fr_authlist = fr;
+ }
fr_authstats.fas_hits++;
- fr_auth[i].fra_index = -1;
+ fra->fra_index = -1;
fr_authused--;
if (i == fr_authstart) {
- while (fr_auth[i].fra_index == -1) {
+ while (fra->fra_index == -1) {
i++;
- if (i == FR_NUMAUTH)
+ fra++;
+ if (i == FR_NUMAUTH) {
i = 0;
+ fra = fr_auth;
+ }
fr_authstart = i;
if (i == fr_authend)
break;
@@ -208,6 +238,7 @@ ip_t *ip;
#if defined(_KERNEL) && SOLARIS
qif_t *qif = fin->fin_qif;
#endif
+ frauth_t *fra;
int i;
if (fr_auth_lock)
@@ -219,7 +250,7 @@ ip_t *ip;
RWLOCK_EXIT(&ipf_auth);
return 0;
} else {
- if ((fr_authstart == 0) && (fr_authend == FR_NUMAUTH - 1)) {
+ if (fr_authused == FR_NUMAUTH) {
fr_authstats.fas_nospace++;
RWLOCK_EXIT(&ipf_auth);
return 0;
@@ -232,51 +263,48 @@ ip_t *ip;
if (fr_authend == FR_NUMAUTH)
fr_authend = 0;
RWLOCK_EXIT(&ipf_auth);
- fr_auth[i].fra_index = i;
- fr_auth[i].fra_pass = 0;
- fr_auth[i].fra_age = fr_defaultauthage;
- bcopy((char *)fin, (char *)&fr_auth[i].fra_info, sizeof(*fin));
-#if !defined(sparc) && !defined(m68k)
+ fra = fr_auth + i;
+ fra->fra_index = i;
+ fra->fra_pass = 0;
+ fra->fra_age = fr_defaultauthage;
+ bcopy((char *)fin, (char *)&fra->fra_info, sizeof(*fin));
+#if SOLARIS && defined(_KERNEL)
+# if !defined(sparc)
/*
* No need to copyback here as we want to undo the changes, not keep
* them.
*/
-# if SOLARIS && defined(_KERNEL)
if ((ip == (ip_t *)m->b_rptr) && (ip->ip_v == 4))
-# endif
{
register u_short bo;
bo = ip->ip_len;
ip->ip_len = htons(bo);
-# if !SOLARIS && !defined(__NetBSD__)
- /* 4.4BSD converts this ip_input.c, but I don't in solaris.c */
- bo = ip->ip_id;
- ip->ip_id = htons(bo);
-# endif
bo = ip->ip_off;
ip->ip_off = htons(bo);
}
-#endif
-#if SOLARIS && defined(_KERNEL)
+# endif
m->b_rptr -= qif->qf_off;
fr_authpkts[i] = *(mblk_t **)fin->fin_mp;
- fr_auth[i].fra_q = qif->qf_q;
+ fra->fra_q = qif->qf_q;
cv_signal(&ipfauthwait);
#else
+# if defined(BSD) && !defined(sparc) && (BSD >= 199306)
+ if (!fin->fin_out) {
+ HTONS(ip->ip_len);
+ HTONS(ip->ip_off);
+ }
+# endif
fr_authpkts[i] = m;
-# if defined(linux) && defined(_KERNEL)
- wake_up_interruptible(&ipfauthwait);
-# else
WAKEUP(&fr_authnext);
-# endif
#endif
return 1;
}
-int fr_auth_ioctl(data, cmd, fr, frptr)
+int fr_auth_ioctl(data, mode, cmd, fr, frptr)
caddr_t data;
+int mode;
#if defined(__NetBSD__) || defined(__OpenBSD__) || (FreeBSD_version >= 300003)
u_long cmd;
#else
@@ -287,8 +315,9 @@ frentry_t *fr, **frptr;
mb_t *m;
#if defined(_KERNEL) && !SOLARIS
struct ifqueue *ifq;
+ int s;
#endif
- frauth_t auth, *au = &auth;
+ frauth_t auth, *au = &auth, *fra;
frauthent_t *fae, **faep;
int i, error = 0;
@@ -313,21 +342,26 @@ frentry_t *fr, **frptr;
else
faep = &fae->fae_next;
if (cmd == SIOCRMAFR) {
- if (!fae)
+ if (!fr || !frptr)
+ error = EINVAL;
+ else if (!fae)
error = ESRCH;
else {
WRITE_ENTER(&ipf_auth);
+ SPL_NET(s);
*faep = fae->fae_next;
*frptr = fr->fr_next;
+ SPL_X(s);
RWLOCK_EXIT(&ipf_auth);
KFREE(fae);
}
- } else {
+ } else if (fr && frptr) {
KMALLOC(fae, frauthent_t *);
if (fae != NULL) {
bcopy((char *)fr, (char *)&fae->fae_fr,
sizeof(*fr));
WRITE_ENTER(&ipf_auth);
+ SPL_NET(s);
fae->fae_age = fr_defaultauthage;
fae->fae_fr.fr_hits = 0;
fae->fae_fr.fr_next = *frptr;
@@ -335,10 +369,12 @@ frentry_t *fr, **frptr;
fae->fae_next = *faep;
*faep = fae;
ipauth = &fae_list->fae_fr;
+ SPL_X(s);
RWLOCK_EXIT(&ipf_auth);
} else
error = ENOMEM;
- }
+ } else
+ error = EINVAL;
break;
case SIOCATHST:
READ_ENTER(&ipf_auth);
@@ -348,6 +384,10 @@ frentry_t *fr, **frptr;
sizeof(fr_authstats));
break;
case SIOCAUTHW:
+ if (!(mode & FWRITE)) {
+ error = EPERM;
+ break;
+ }
fr_authioctlloop:
READ_ENTER(&ipf_auth);
if ((fr_authnext != fr_authend) && fr_authpkts[fr_authnext]) {
@@ -357,9 +397,11 @@ fr_authioctlloop:
if (error)
break;
WRITE_ENTER(&ipf_auth);
+ SPL_NET(s);
fr_authnext++;
if (fr_authnext == FR_NUMAUTH)
fr_authnext = 0;
+ SPL_X(s);
RWLOCK_EXIT(&ipf_auth);
return 0;
}
@@ -372,55 +414,62 @@ fr_authioctlloop:
}
mutex_exit(&ipf_authmx);
# else
-# ifdef linux
- interruptible_sleep_on(&ipfauthwait);
- if (current->signal & ~current->blocked)
- error = -EINTR;
-# else
error = SLEEP(&fr_authnext, "fr_authnext");
# endif
-# endif
#endif
RWLOCK_EXIT(&ipf_auth);
if (!error)
goto fr_authioctlloop;
break;
case SIOCAUTHR:
+ if (!(mode & FWRITE)) {
+ error = EPERM;
+ break;
+ }
error = IRCOPYPTR(data, (caddr_t)&auth, sizeof(auth));
if (error)
return error;
WRITE_ENTER(&ipf_auth);
+ SPL_NET(s);
i = au->fra_index;
+ fra = fr_auth + i;
if ((i < 0) || (i > FR_NUMAUTH) ||
- (fr_auth[i].fra_info.fin_id != au->fra_info.fin_id)) {
+ (fra->fra_info.fin_id != au->fra_info.fin_id)) {
+ SPL_X(s);
RWLOCK_EXIT(&ipf_auth);
return EINVAL;
}
m = fr_authpkts[i];
- fr_auth[i].fra_index = -2;
- fr_auth[i].fra_pass = au->fra_pass;
+ fra->fra_index = -2;
+ fra->fra_pass = au->fra_pass;
fr_authpkts[i] = NULL;
-#ifdef _KERNEL
RWLOCK_EXIT(&ipf_auth);
-# ifndef linux
+#ifdef _KERNEL
if (m && au->fra_info.fin_out) {
-# if SOLARIS
- error = fr_qout(fr_auth[i].fra_q, m);
-# else /* SOLARIS */
-# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__)
- error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
+# if SOLARIS
+ error = fr_qout(fra->fra_q, m);
+# else /* SOLARIS */
+ struct route ro;
+
+ bzero((char *)&ro, sizeof(ro));
+# if ((_BSDI_VERSION >= 199802) && (_BSDI_VERSION < 200005)) || \
+ defined(__OpenBSD__)
+ error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL,
NULL);
-# else
- error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL);
-# endif
-# endif /* SOLARIS */
+# else
+ error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL);
+# endif
+ if (ro.ro_rt) {
+ RTFREE(ro.ro_rt);
+ }
+# endif /* SOLARIS */
if (error)
fr_authstats.fas_sendfail++;
else
fr_authstats.fas_sendok++;
} else if (m) {
# if SOLARIS
- error = fr_qin(fr_auth[i].fra_q, m);
+ error = fr_qin(fra->fra_q, m);
# else /* SOLARIS */
ifq = &ipintrq;
if (IF_QFULL(ifq)) {
@@ -438,7 +487,6 @@ fr_authioctlloop:
fr_authstats.fas_queok++;
} else
error = EINVAL;
-# endif
# if SOLARIS
if (error)
error = EINVAL;
@@ -449,10 +497,10 @@ fr_authioctlloop:
*/
if (error == ENOBUFS) {
fr_authused--;
- fr_auth[i].fra_index = -1;
- fr_auth[i].fra_pass = 0;
+ fra->fra_index = -1;
+ fra->fra_pass = 0;
if (i == fr_authstart) {
- while (fr_auth[i].fra_index == -1) {
+ while (fra->fra_index == -1) {
i++;
if (i == FR_NUMAUTH)
i = 0;
@@ -468,6 +516,7 @@ fr_authioctlloop:
}
# endif
#endif /* _KERNEL */
+ SPL_X(s);
break;
default :
error = EINVAL;
@@ -485,6 +534,7 @@ void fr_authunload()
{
register int i;
register frauthent_t *fae, **faep;
+ frentry_t *fr, **frp;
mb_t *m;
WRITE_ENTER(&ipf_auth);
@@ -503,6 +553,26 @@ void fr_authunload()
}
ipauth = NULL;
RWLOCK_EXIT(&ipf_auth);
+
+ if (fr_authlist) {
+ /*
+ * We *MuST* reget ipf_auth because otherwise we won't get the
+ * locks in the right order and risk deadlock.
+ * We need ipf_mutex here to prevent a rule from using it
+ * inside fr_check().
+ */
+ WRITE_ENTER(&ipf_mutex);
+ WRITE_ENTER(&ipf_auth);
+ for (frp = &fr_authlist; (fr = *frp); ) {
+ if (fr->fr_ref == 1) {
+ *frp = fr->fr_next;
+ KFREE(fr);
+ } else
+ frp = &fr->fr_next;
+ }
+ RWLOCK_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_mutex);
+ }
}
@@ -515,6 +585,7 @@ void fr_authexpire()
register int i;
register frauth_t *fra;
register frauthent_t *fae, **faep;
+ register frentry_t *fr, **frp;
mb_t *m;
#if !SOLARIS
int s;
@@ -544,6 +615,14 @@ void fr_authexpire()
faep = &fae->fae_next;
}
ipauth = &fae_list->fae_fr;
+
+ for (frp = &fr_authlist; (fr = *frp); ) {
+ if (fr->fr_ref == 1) {
+ *frp = fr->fr_next;
+ KFREE(fr);
+ } else
+ frp = &fr->fr_next;
+ }
RWLOCK_EXIT(&ipf_auth);
SPL_X(s);
}
diff --git a/contrib/ipfilter/ip_auth.h b/contrib/ipfilter/ip_auth.h
index 681a6e53f4c3..7d3e46316d10 100644
--- a/contrib/ipfilter/ip_auth.h
+++ b/contrib/ipfilter/ip_auth.h
@@ -1,11 +1,9 @@
/*
- * Copyright (C) 1997-2000 by Darren Reed & Guido Van Rooij.
+ * Copyright (C) 1997-2001 by Darren Reed & Guido Van Rooij.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
- * $Id: ip_auth.h,v 2.3.2.2 2000/10/19 15:38:44 darrenr Exp $
+ * $Id: ip_auth.h,v 2.3.2.4 2001/07/18 14:57:08 darrenr Exp $
*
*/
#ifndef __IP_AUTH_H__
@@ -55,8 +53,8 @@ extern void fr_authunload __P((void));
extern mb_t *fr_authpkts[];
extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *));
#if defined(__NetBSD__) || defined(__OpenBSD__)
-extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **));
+extern int fr_auth_ioctl __P((caddr_t, int, u_long, frentry_t *, frentry_t **));
#else
-extern int fr_auth_ioctl __P((caddr_t, int, frentry_t *, frentry_t **));
+extern int fr_auth_ioctl __P((caddr_t, int, int, frentry_t *, frentry_t **));
#endif
#endif /* __IP_AUTH_H__ */
diff --git a/contrib/ipfilter/ip_compat.h b/contrib/ipfilter/ip_compat.h
index ed71f36cc021..a7d0db4f07a8 100644
--- a/contrib/ipfilter/ip_compat.h
+++ b/contrib/ipfilter/ip_compat.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_compat.h 1.8 1/14/96
- * $Id: ip_compat.h,v 2.26.2.9 2001/01/14 14:58:01 darrenr Exp $
+ * $Id: ip_compat.h,v 2.26.2.17 2001/07/23 04:22:48 darrenr Exp $
*/
#ifndef __IP_COMPAT_H__
@@ -27,6 +25,9 @@
#ifndef SOLARIS
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif
+#if SOLARIS && !defined(SOLARIS2)
+# define SOLARIS2 4 /* Pick an old version */
+#endif
#if SOLARIS2 >= 8
# ifndef USE_INET6
# define USE_INET6
@@ -119,10 +120,34 @@ struct ether_addr {
# define V4_PART_OF_V6(v6) v6.s6_addr32[3]
# endif
# endif
-#else
+
+typedef struct qif {
+ struct qif *qf_next;
+ ill_t *qf_ill;
+ kmutex_t qf_lock;
+ void *qf_iptr;
+ void *qf_optr;
+ queue_t *qf_in;
+ queue_t *qf_out;
+ struct qinit *qf_wqinfo;
+ struct qinit *qf_rqinfo;
+ struct qinit qf_wqinit;
+ struct qinit qf_rqinit;
+ mblk_t *qf_m; /* These three fields are for passing data up from */
+ queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */
+ size_t qf_off;
+ size_t qf_len; /* this field is used for in ipfr_fastroute */
+ char qf_name[8];
+ /*
+ * in case the ILL has disappeared...
+ */
+ size_t qf_hl; /* header length */
+ int qf_sap;
+} qif_t;
+#else /* SOLARIS */
# if !defined(__sgi)
typedef int minor_t;
-#endif
+# endif
#endif /* SOLARIS */
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
@@ -264,10 +289,26 @@ union i6addr {
#if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL))
# ifdef IPFILTER_LKM
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# else
+# include <sys/param.h>
+# endif
+# endif
# define ACTUALLY_LKM_NOT_KERNEL
# else
-# include <sys/osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <sys/osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <sys/osreldate.h>
+# else
+# include <sys/param.h>
+# endif
+# endif
# endif
# if __FreeBSD__ < 3
# include <machine/spl.h>
@@ -325,6 +366,7 @@ typedef struct {
# define ATOMIC_DEC32(x) atomic_add_32((uint32_t*)&(x), -1)
# define ATOMIC_DEC16(x) atomic_add_16((uint16_t*)&(x), -1)
# else
+# define IRE_CACHE IRE_ROUTE
# define ATOMIC_INC(x) { mutex_enter(&ipf_rw); (x)++; \
mutex_exit(&ipf_rw); }
# define ATOMIC_DEC(x) { mutex_enter(&ipf_rw); (x)--; \
@@ -374,29 +416,6 @@ typedef struct {
# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
# define GET_MINOR(x) getminor(x)
-typedef struct qif {
- struct qif *qf_next;
- ill_t *qf_ill;
- kmutex_t qf_lock;
- void *qf_iptr;
- void *qf_optr;
- queue_t *qf_in;
- queue_t *qf_out;
- struct qinit *qf_wqinfo;
- struct qinit *qf_rqinfo;
- struct qinit qf_wqinit;
- struct qinit qf_rqinit;
- mblk_t *qf_m; /* These three fields are for passing data up from */
- queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */
- size_t qf_off;
- size_t qf_len; /* this field is used for in ipfr_fastroute */
- char qf_name[8];
- /*
- * in case the ILL has disappeared...
- */
- size_t qf_hl; /* header length */
- int qf_sap;
-} qif_t;
extern ill_t *get_unit __P((char *, int));
# define GETUNIT(n, v) get_unit(n, v)
# define IFNAME(x) ((ill_t *)x)->ill_name
@@ -452,7 +471,9 @@ extern ill_t *get_unit __P((char *, int));
(defined(OpenBSD) && (OpenBSD >= 199603))
# define IFNAME(x) ((struct ifnet *)x)->if_xname
# else
-# define IFNAME(x) ((struct ifnet *)x)->if_name
+# define USE_GETIFNAME 1
+# define IFNAME(x) get_ifname((struct ifnet *)x)
+extern char *get_ifname __P((struct ifnet *));
# endif
# endif
# endif /* sun */
@@ -508,7 +529,8 @@ extern vm_map_t kmem_map;
# define SLEEP(id, n) tsleep((id), PPAUSE|PCATCH, n, 0)
# define WAKEUP(id) wakeup(id)
# endif /* BSD */
-# if defined(NetBSD) && NetBSD <= 1991011 && NetBSD >= 199407
+# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199407)) || \
+ (defined(OpenBSD) && (OpenBSD >= 200006))
# define SPL_NET(x) x = splsoftnet()
# define SPL_X(x) (void) splx(x)
# else
@@ -517,7 +539,7 @@ extern vm_map_t kmem_map;
# define SPL_NET(x) x = splnet()
# define SPL_X(x) (void) splx(x)
# endif
-# endif /* NetBSD && NetBSD <= 1991011 && NetBSD >= 199407 */
+# endif /* NetBSD && (NetBSD <= 1991011) && (NetBSD >= 199407) */
# define PANIC(x,y) if (x) panic y
#else /* KERNEL */
# define SLEEP(x,y) ;
@@ -576,7 +598,6 @@ typedef struct mbuf mb_t;
# endif
#endif /* SOLARIS */
-#if defined(linux) || defined(__sgi)
/*
* These #ifdef's are here mainly for linux, but who knows, they may
* not be in other places or maybe one day linux will grow up and some
@@ -615,6 +636,9 @@ typedef struct mbuf mb_t;
#ifndef ICMP_MASKREPLY
# define ICMP_MASKREPLY ICMP_ADDRESSREPLY
#endif
+#ifndef ICMP_PARAMPROB_OPTABSENT
+# define ICMP_PARAMPROB_OPTABSENT 1
+#endif
#ifndef IPVERSION
# define IPVERSION 4
#endif
@@ -702,7 +726,6 @@ typedef struct mbuf mb_t;
#ifndef IPOPT_OLEN
# define IPOPT_OLEN 1
#endif
-#endif /* linux || __sgi */
#ifdef linux
#include <linux/in_systm.h>
diff --git a/contrib/ipfilter/ip_fil.c b/contrib/ipfilter/ip_fil.c
index 92537750b79c..e15ff67b6534 100644
--- a/contrib/ipfilter/ip_fil.c
+++ b/contrib/ipfilter/ip_fil.c
@@ -1,15 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 darrenr Exp $";
-#endif
-
#ifndef SOLARIS
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif
@@ -118,6 +111,11 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 d
extern int ip_optcopy __P((struct ip *, struct ip *));
#endif
+#if !defined(lint)
+static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.34 2001/07/23 13:49:57 darrenr Exp $";
+#endif
+
extern struct protosw inetsw[];
@@ -131,7 +129,11 @@ extern int tcp_ttl;
# endif
#endif
+#ifdef ICMP_UNREACH_FILTER_PROHIB
+int ipl_unreach = ICMP_UNREACH_FILTER_PROHIB;
+#else
int ipl_unreach = ICMP_UNREACH_FILTER;
+#endif
u_long ipl_frouteok[2] = {0, 0};
static int frzerostats __P((caddr_t));
@@ -171,6 +173,10 @@ struct callout_handle ipfr_slowtimer_ch;
# include <sys/callout.h>
struct callout ipfr_slowtimer_ch;
#endif
+#if defined(__OpenBSD__)
+# include <sys/timeout.h>
+struct timeout ipfr_slowtimer_ch;
+#endif
#if defined(__sgi) && defined(_KERNEL)
toid_t ipfr_slowtimer_ch;
#endif
@@ -246,12 +252,18 @@ int iplattach()
# ifdef IPFILTER_LOG
ipflog_init();
# endif
- if (nat_init() == -1)
- return -1;
- if (fr_stateinit() == -1)
- return -1;
- if (appr_init() == -1)
- return -1;
+ if (nat_init() == -1) {
+ SPL_X(s);
+ return EIO;
+ }
+ if (fr_stateinit() == -1) {
+ SPL_X(s);
+ return EIO;
+ }
+ if (appr_init() == -1) {
+ SPL_X(s);
+ return EIO;
+ }
# ifdef NETBSD_PF
# if __NetBSD_Version__ >= 104200000
@@ -261,6 +273,7 @@ int iplattach()
# ifdef USE_INET6
goto pfil_error;
# else
+ SPL_X(s);
appr_unload();
ip_natunload();
fr_stateunload();
@@ -277,6 +290,7 @@ int iplattach()
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
&inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
pfil_error:
+ SPL_X(s);
appr_unload();
ip_natunload();
fr_stateunload();
@@ -321,10 +335,15 @@ pfil_error:
callout_init(&ipfr_slowtimer_ch);
callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
# else
-# if (__FreeBSD_version >= 300000) || defined(__sgi)
- ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
+# if defined(__OpenBSD__)
+ timeout_set(&ipfr_slowtimer_ch, ipfr_slowtimer, NULL);
+ timeout_add(&ipfr_slowtimer_ch, hz/2);
# else
+# if (__FreeBSD_version >= 300000) || defined(__sgi)
+ ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
+# else
timeout(ipfr_slowtimer, NULL, hz/2);
+# endif
# endif
# endif
#endif
@@ -353,8 +372,12 @@ int ipldetach()
# ifdef __sgi
untimeout(ipfr_slowtimer_ch);
# else
+# if defined(__OpenBSD__)
+ timeout_del(&ipfr_slowtimer_ch);
+# else
untimeout(ipfr_slowtimer, NULL);
-# endif
+# endif /* OpenBSD */
+# endif /* __sgi */
# endif /* FreeBSD */
# endif /* NetBSD */
#endif
@@ -376,16 +399,20 @@ int ipldetach()
# if __NetBSD_Version__ >= 104200000
error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
&inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
- if (error)
+ if (error) {
+ SPL_X(s);
return error;
+ }
# else
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
# endif
# ifdef USE_INET6
error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
&inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
- if (error)
+ if (error) {
+ SPL_X(s);
return error;
+ }
# endif
# endif
@@ -489,8 +516,9 @@ int mode;
}
if (unit == IPL_LOGAUTH) {
if (!fr_running)
- return EIO;
- error = fr_auth_ioctl(data, cmd, NULL, NULL);
+ error = EIO;
+ else
+ error = fr_auth_ioctl(data, mode, cmd, NULL, NULL);
SPL_X(s);
return error;
}
@@ -564,7 +592,7 @@ int mode;
fr_getstat(&fio);
error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
if (error)
- return EFAULT;
+ error = EFAULT;
break;
}
case SIOCFRZST :
@@ -607,7 +635,7 @@ int mode;
error = IWCOPYPTR((caddr_t)ipfr_fragstats(), data,
sizeof(ipfrstat_t));
if (error)
- return EFAULT;
+ error = EFAULT;
break;
case SIOCAUTHW :
case SIOCAUTHR :
@@ -820,8 +848,6 @@ caddr_t data;
return EBUSY;
if (fg && fg->fg_head)
fg->fg_head->fr_ref--;
- if (unit == IPL_LOGAUTH)
- return fr_auth_ioctl(data, req, f, ftail);
if (f->fr_grhead)
fr_delgroup((u_int)f->fr_grhead, fp->fr_flags,
unit, set);
@@ -835,8 +861,6 @@ caddr_t data;
if (f)
error = EEXIST;
else {
- if (unit == IPL_LOGAUTH)
- return fr_auth_ioctl(data, req, fp, ftail);
KMALLOC(f, frentry_t *);
if (f != NULL) {
if (fg && fg->fg_head)
@@ -1068,7 +1092,7 @@ struct mbuf *m;
# ifdef IPSEC
m->m_pkthdr.rcvif = NULL;
# endif
- return ipfr_fastroute(m, fin, NULL);
+ return ipfr_fastroute(m, fin->fin_mp, fin, NULL);
}
@@ -1079,6 +1103,7 @@ fr_info_t *fin;
int dst;
{
int err, hlen = 0, xtra = 0, iclen, ohlen = 0, avail, code;
+ u_short shlen, slen = 0, soff = 0;
struct in_addr dst4;
struct icmp *icmp;
struct mbuf *m;
@@ -1220,6 +1245,11 @@ int dst;
} else
#endif
{
+ slen = oip->ip_len;
+ oip->ip_len = htons(oip->ip_len);
+ soff = oip->ip_off;
+ oip->ip_off = htons(ip->ip_off);
+
ip->ip_src.s_addr = dst4.s_addr;
ip->ip_dst.s_addr = oip->ip_src.s_addr;
@@ -1233,7 +1263,18 @@ int dst;
ip->ip_len = iclen;
ip->ip_p = IPPROTO_ICMP;
}
+
+ shlen = fin->fin_hlen;
+ fin->fin_hlen = hlen;
err = send_ip(oip, fin, m);
+ fin->fin_hlen = shlen;
+#ifdef USE_INET6
+ if (fin->fin_v == 4)
+#endif
+ {
+ oip->ip_len = slen;
+ oip->ip_off = soff;
+ }
return err;
}
@@ -1268,8 +1309,8 @@ register struct mbuf *m0;
}
-int ipfr_fastroute(m0, fin, fdp)
-struct mbuf *m0;
+int ipfr_fastroute(m0, mpp, fin, fdp)
+struct mbuf *m0, **mpp;
fr_info_t *fin;
frdest_t *fdp;
{
@@ -1282,16 +1323,49 @@ frdest_t *fdp;
struct route iproute;
frentry_t *fr;
+#ifdef M_WRITABLE
+ /*
+ * HOT FIX/KLUDGE:
+ *
+ * If the mbuf we're about to send is not writable (because of
+ * a cluster reference, for example) we'll need to make a copy
+ * of it since this routine modifies the contents.
+ *
+ * If you have non-crappy network hardware that can transmit data
+ * from the mbuf, rather than making a copy, this is gonna be a
+ * problem.
+ */
+ if (M_WRITABLE(m) == 0) {
+ if ((m0 = m_dup(m, M_DONTWAIT)) != 0) {
+ m_freem(m);
+ m = m0;
+ } else {
+ error = ENOBUFS;
+ m_freem(m);
+ ipl_frouteok[1]++;
+ }
+ }
+#endif
+
hlen = fin->fin_hlen;
ip = mtod(m0, struct ip *);
+#if defined(__NetBSD__) && defined(M_CSUM_IPv4)
+ /*
+ * Clear any in-bound checksum flags for this packet.
+ */
+ m0->m_pkthdr.csuminfo = 0;
+#endif /* __NetBSD__ && M_CSUM_IPv4 */
+
#ifdef USE_INET6
if (ip->ip_v == 6) {
/*
* currently "to <if>" and "to <if>:ip#" are not supported
* for IPv6
*/
- return ip6_output(m0, NULL, NULL, 0, NULL, NULL);
+ error = ip6_output(m0, NULL, NULL, 0, NULL, NULL);
+ *mpp = NULL;
+ return error;
}
#endif
/*
@@ -1316,10 +1390,15 @@ frdest_t *fdp;
*/
if ((fr != NULL) && (fin->fin_rev != 0)) {
if ((ifp != NULL) && (fdp == &fr->fr_tif))
- return -1;
+ return 0;
dst->sin_addr = ip->ip_dst;
- } else if (fdp)
- dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
+ } else if (fdp) {
+ if (fdp->fd_ip.s_addr) {
+ dst->sin_addr = fdp->fd_ip;
+ ip->ip_dst = fdp->fd_ip;
+ } else
+ dst->sin_addr = ip->ip_dst;
+ }
# if BSD >= 199306
dst->sin_len = sizeof(*dst);
@@ -1374,36 +1453,44 @@ frdest_t *fdp;
* If small enough for interface, can just send directly.
*/
if (ip->ip_len <= ifp->if_mtu) {
-# if BSD >= 199306
+# if defined(MCLISREFERENCED) && !defined(sparc)
int i = 0;
-# ifdef MCLISREFERENCED
if ((m->m_flags & M_EXT) && MCLISREFERENCED(m))
-# else
- if (m->m_flags & M_EXT)
-# endif
i = 1;
# endif
# ifndef sparc
+# if !(_BSDI_VERSION >= 199510)
ip->ip_id = htons(ip->ip_id);
+# endif
ip->ip_len = htons(ip->ip_len);
ip->ip_off = htons(ip->ip_off);
# endif
+# if defined(__NetBSD__) && defined(M_CSUM_IPv4)
+ if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
+ m->m_pkthdr.csuminfo |= M_CSUM_IPv4;
+ else if (ip->ip_sum == 0)
+ ip->ip_sum = in_cksum(m, hlen);
+# else
if (!ip->ip_sum)
ip->ip_sum = in_cksum(m, hlen);
+# endif /* __NetBSD__ && M_CSUM_IPv4 */
# if BSD >= 199306
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
ro->ro_rt);
+# if defined(MCLISREFERENCED) && !defined(sparc)
if (i) {
ip->ip_id = ntohs(ip->ip_id);
ip->ip_len = ntohs(ip->ip_len);
ip->ip_off = ntohs(ip->ip_off);
}
+# endif
# else
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
# endif
goto done;
}
+
/*
* Too large for interface; fragment if possible.
* Must be able to put at least 8 bytes per fragment.
@@ -1506,9 +1593,11 @@ done:
else
ipl_frouteok[1]++;
- if (ro->ro_rt)
+ if (ro->ro_rt) {
RTFREE(ro->ro_rt);
- return 0;
+ }
+ *mpp = NULL;
+ return error;
bad:
if (error == EMSGSIZE) {
sifp = fin->fin_ifp;
@@ -1550,6 +1639,18 @@ void *ifp;
return (ifp == iproute.ro_rt->rt_ifp);
}
+
+# ifdef USE_GETIFNAME
+char *
+get_ifname(ifp)
+struct ifnet *ifp;
+{
+ static char workbuf[64];
+
+ sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit);
+ return workbuf;
+}
+# endif
#else /* #ifdef _KERNEL */
@@ -1586,9 +1687,9 @@ ip_t *ip;
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
(defined(OpenBSD) && (OpenBSD >= 199603))
- sprintf(fname, "/tmp/%s", ifp->if_xname);
+ sprintf(fname, "%s", ifp->if_xname);
# else
- sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
+ sprintf(fname, "%s%d", ifp->if_name, ifp->if_unit);
# endif
fd = open(fname, O_WRONLY|O_APPEND);
if (fd == -1) {
@@ -1605,7 +1706,7 @@ struct ifnet *get_unit(name, v)
char *name;
int v;
{
- struct ifnet *ifp, **ifa;
+ struct ifnet *ifp, **ifa, **old_ifneta;
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
(defined(OpenBSD) && (OpenBSD >= 199603))
for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
@@ -1634,10 +1735,12 @@ int v;
}
nifs = 1;
} else {
+ old_ifneta = ifneta;
nifs++;
ifneta = (struct ifnet **)realloc(ifneta,
(nifs + 1) * sizeof(*ifa));
if (!ifneta) {
+ free(old_ifneta);
nifs = 0;
return NULL;
}
@@ -1704,28 +1807,6 @@ void init_ifp()
}
-int ipfr_fastroute(ip, fin, fdp)
-ip_t *ip;
-fr_info_t *fin;
-frdest_t *fdp;
-{
- struct ifnet *ifp = fdp->fd_ifp;
-
- if (!ifp)
- return 0; /* no routing table out here */
-
- ip->ip_len = htons((u_short)ip->ip_len);
- ip->ip_off = htons((u_short)(ip->ip_off | IP_MF));
- ip->ip_sum = 0;
-#ifdef __sgi
- (*ifp->if_output)(ifp, (void *)ip, NULL);
-#else
- (*ifp->if_output)(ifp, (void *)ip, NULL, 0);
-#endif
- return 0;
-}
-
-
int ipllog __P((void))
{
verbose("l");
diff --git a/contrib/ipfilter/ip_fil.h b/contrib/ipfilter/ip_fil.h
index ed1cfc4408fb..6d51ced5e0ae 100644
--- a/contrib/ipfilter/ip_fil.h
+++ b/contrib/ipfilter/ip_fil.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_fil.h 1.35 6/5/96
- * $Id: ip_fil.h,v 2.29.2.4 2000/11/12 11:54:53 darrenr Exp $
+ * $Id: ip_fil.h,v 2.29.2.10 2001/07/15 13:51:42 darrenr Exp $
*/
#ifndef __IP_FIL_H__
@@ -59,7 +57,7 @@
# define SIOCSTLCK _IOWR('r', 79, u_int)
# define SIOCSTPUT _IOWR('r', 80, struct ipstate_save *)
# define SIOCSTGET _IOWR('r', 81, struct ipstate_save *)
-# define SIOCSTGSZ _IOWR('r', 82, struct natget *)
+# define SIOCSTGSZ _IOWR('r', 82, struct natget)
# define SIOCGFRST _IOWR('r', 83, struct ipfrstat *)
#else
# define SIOCADAFR _IOW(r, 60, struct frentry *)
@@ -84,7 +82,7 @@
# define SIOCSTLCK _IOWR(r, 79, u_int)
# define SIOCSTPUT _IOWR(r, 80, struct ipstate_save *)
# define SIOCSTGET _IOWR(r, 81, struct ipstate_save *)
-# define SIOCSTGSZ _IOWR(r, 82, struct natget *)
+# define SIOCSTGSZ _IOWR(r, 82, struct natget)
# define SIOCGFRST _IOWR(r, 83, struct ipfrstat *)
#endif
#define SIOCADDFR SIOCADAFR
@@ -152,7 +150,10 @@ typedef struct fr_info {
u_short fin_off;
} fr_info_t;
-#define fin_v fin_fi.fi_v
+#define fin_v fin_fi.fi_v
+#define fin_saddr fin_fi.fi_saddr
+#define fin_daddr fin_fi.fi_daddr
+#define fin_fl fin_fi.fi_fl
/*
* Size for compares on fr_info structures
@@ -168,6 +169,9 @@ typedef struct frdest {
void *fd_ifp;
struct in_addr fd_ip;
char fd_ifname[IFNAMSIZ];
+#if SOLARIS
+ mb_t *fd_mp; /* cache resolver for to/dup-to */
+#endif
} frdest_t;
typedef struct frpcmp {
@@ -192,8 +196,6 @@ typedef struct frtuc {
typedef struct frentry {
struct frentry *fr_next;
- u_32_t fr_group; /* group to which this rule belongs */
- u_32_t fr_grhead; /* group # which this rule starts */
struct frentry *fr_grp;
int fr_ref; /* reference count - for grouping */
void *fr_ifa;
@@ -217,6 +219,8 @@ typedef struct frentry {
u_short fr_icmp;
frtuc_t fr_tuc;
+ u_32_t fr_group; /* group to which this rule belongs */
+ u_32_t fr_grhead; /* group # which this rule starts */
u_32_t fr_flags; /* per-rule flags && options (see below) */
u_int fr_skip; /* # of rules to skip */
u_int fr_loglevel; /* syslog log facility + priority */
@@ -436,6 +440,8 @@ typedef struct ipflog {
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
#define IPLLOGSIZE 8192
+#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */
+
/*
* Device filenames for reading log information. Use ipf on Solaris2 because
* ipl is already a name used by something else.
@@ -484,7 +490,6 @@ extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
extern int send_reset __P((ip_t *, struct ifnet *));
extern int icmp_error __P((ip_t *, struct ifnet *));
extern int ipf_log __P((void));
-extern int ipfr_fastroute __P((ip_t *, fr_info_t *, frdest_t *));
extern struct ifnet *get_unit __P((char *, int));
# if defined(__NetBSD__) || defined(__OpenBSD__) || \
(_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
@@ -530,7 +535,7 @@ extern int iplread __P((dev_t, struct uio *, cred_t *));
# else /* SOLARIS */
extern int fr_check __P((ip_t *, int, void *, int, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *));
+extern int ipfr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *));
extern size_t mbufchainlen __P((mb_t *));
# ifdef __sgi
# include <sys/cred.h>
diff --git a/contrib/ipfilter/ip_frag.c b/contrib/ipfilter/ip_frag.c
index 556478d51d0b..b0e63a9f7551 100644
--- a/contrib/ipfilter/ip_frag.c
+++ b/contrib/ipfilter/ip_frag.c
@@ -1,15 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 darrenr Exp $";
-#endif
-
#if defined(KERNEL) && !defined(_KERNEL)
# define _KERNEL
#endif
@@ -81,7 +74,7 @@ static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 d
# ifndef IPFILTER_LKM
# include <sys/libkern.h>
# include <sys/systm.h>
-# endif
+# endif
extern struct callout_handle ipfr_slowtimer_ch;
# endif
#endif
@@ -89,6 +82,15 @@ extern struct callout_handle ipfr_slowtimer_ch;
# include <sys/callout.h>
extern struct callout ipfr_slowtimer_ch;
#endif
+#if defined(__OpenBSD__)
+# include <sys/timeout.h>
+extern struct timeout ipfr_slowtimer_ch;
+#endif
+
+#if !defined(lint)
+static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.14 2001/07/15 22:06:15 darrenr Exp $";
+#endif
static ipfr_t *ipfr_heads[IPFT_SIZE];
@@ -141,12 +143,15 @@ fr_info_t *fin;
u_int pass;
ipfr_t *table[];
{
- ipfr_t **fp, *fra, frag;
- u_int idx;
+ ipfr_t **fp, *fra, frag;
+ u_int idx, off;
if (ipfr_inuse >= IPFT_SIZE)
return NULL;
+ if (!(fin->fin_fl & FI_FRAG))
+ return NULL;
+
frag.ipfr_p = ip->ip_p;
idx = ip->ip_p;
frag.ipfr_id = ip->ip_id;
@@ -160,6 +165,10 @@ ipfr_t *table[];
idx *= 127;
idx %= IPFT_SIZE;
+ frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
+ frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
+ frag.ipfr_auth = fin->fin_fi.fi_auth;
+
/*
* first, make sure it isn't already there...
*/
@@ -200,7 +209,10 @@ ipfr_t *table[];
/*
* Compute the offset of the expected start of the next packet.
*/
- fra->ipfr_off = (ip->ip_off & IP_OFFMASK) + (fin->fin_dlen >> 3);
+ off = ip->ip_off & IP_OFFMASK;
+ if (!off)
+ fra->ipfr_seen0 = 1;
+ fra->ipfr_off = off + (fin->fin_dlen >> 3);
ATOMIC_INCL(ipfr_stats.ifs_new);
ATOMIC_INC32(ipfr_inuse);
return fra;
@@ -219,7 +231,12 @@ u_int pass;
WRITE_ENTER(&ipf_frag);
ipf = ipfr_new(ip, fin, pass, ipfr_heads);
RWLOCK_EXIT(&ipf_frag);
- return ipf ? 0 : -1;
+ if (ipf == NULL) {
+ ATOMIC_INCL(frstats[fin->fin_out].fr_bnfr);
+ return -1;
+ }
+ ATOMIC_INCL(frstats[fin->fin_out].fr_nfr);
+ return 0;
}
@@ -230,9 +247,16 @@ u_int pass;
nat_t *nat;
{
ipfr_t *ipf;
+ int off;
if ((ip->ip_v != 4) || (fr_frag_lock))
return -1;
+
+ off = fin->fin_off;
+ off <<= 3;
+ if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
+ return NULL;
+
WRITE_ENTER(&ipf_natfrag);
ipf = ipfr_new(ip, fin, pass, ipfr_nattab);
if (ipf != NULL) {
@@ -254,8 +278,8 @@ fr_info_t *fin;
ipfr_t *table[];
{
ipfr_t *f, frag;
- u_int idx;
-
+ u_int idx;
+
/*
* For fragments, we record protocol, packet id, TOS and both IP#'s
* (these should all be the same for all fragments of a packet).
@@ -275,6 +299,10 @@ ipfr_t *table[];
idx *= 127;
idx %= IPFT_SIZE;
+ frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
+ frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
+ frag.ipfr_auth = fin->fin_fi.fi_auth;
+
/*
* check the table, careful to only compare the right amount of data
*/
@@ -283,6 +311,20 @@ ipfr_t *table[];
IPFR_CMPSZ)) {
u_short atoff, off;
+ off = fin->fin_off;
+
+ /*
+ * XXX - We really need to be guarding against the
+ * retransmission of (src,dst,id,offset-range) here
+ * because a fragmented packet is never resent with
+ * the same IP ID#.
+ */
+ if (f->ipfr_seen0) {
+ if (!off || (fin->fin_fl & FI_SHORT))
+ continue;
+ } else if (!off)
+ f->ipfr_seen0 = 1;
+
if (f != table[idx]) {
/*
* move fragment info. to the top of the list
@@ -295,7 +337,6 @@ ipfr_t *table[];
f->ipfr_prev = NULL;
table[idx] = f;
}
- off = ip->ip_off & IP_OFFMASK;
atoff = off + (fin->fin_dlen >> 3);
/*
* If we've follwed the fragments, and this is the
@@ -321,11 +362,18 @@ nat_t *ipfr_nat_knownfrag(ip, fin)
ip_t *ip;
fr_info_t *fin;
{
- nat_t *nat;
- ipfr_t *ipf;
+ ipfr_t *ipf;
+ nat_t *nat;
+ int off;
- if ((ip->ip_v != 4) || (fr_frag_lock))
+ if ((fin->fin_v != 4) || (fr_frag_lock))
+ return NULL;
+
+ off = fin->fin_off;
+ off <<= 3;
+ if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
return NULL;
+
READ_ENTER(&ipf_natfrag);
ipf = ipfr_lookup(ip, fin, ipfr_nattab);
if (ipf != NULL) {
@@ -351,15 +399,24 @@ frentry_t *ipfr_knownfrag(ip, fin)
ip_t *ip;
fr_info_t *fin;
{
- frentry_t *fr = NULL;
- ipfr_t *fra;
+ frentry_t *fr;
+ ipfr_t *fra;
+ int off;
- if ((ip->ip_v != 4) || (fr_frag_lock))
+ if ((fin->fin_v != 4) || (fr_frag_lock))
+ return NULL;
+
+ off = fin->fin_off;
+ off <<= 3;
+ if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
return NULL;
+
READ_ENTER(&ipf_frag);
fra = ipfr_lookup(ip, fin, ipfr_heads);
if (fra != NULL)
fr = fra->ipfr_rule;
+ else
+ fr = NULL;
RWLOCK_EXIT(&ipf_frag);
return fr;
}
@@ -544,7 +601,11 @@ int ipfr_slowtimer()
# if (__FreeBSD_version >= 300000)
ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
# else
+# if defined(__OpenBSD_)
+ timeout_add(&ipfr_slowtimer_ch, hz/2, ipfr_slowtimer, NULL);
+# else
timeout(ipfr_slowtimer, NULL, hz/2);
+# endif
# endif
# if (BSD < 199306) && !defined(__sgi)
return 0;
diff --git a/contrib/ipfilter/ip_frag.h b/contrib/ipfilter/ip_frag.h
index 362bcdd120c9..446510f0e965 100644
--- a/contrib/ipfilter/ip_frag.h
+++ b/contrib/ipfilter/ip_frag.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_frag.h 1.5 3/24/96
- * $Id: ip_frag.h,v 2.4.2.2 2000/11/10 13:10:54 darrenr Exp $
+ * $Id: ip_frag.h,v 2.4.2.5 2001/06/26 10:43:13 darrenr Exp $
*/
#ifndef __IP_FRAG_H__
@@ -20,11 +18,15 @@ typedef struct ipfr {
struct in_addr ipfr_src;
struct in_addr ipfr_dst;
void *ipfr_ifp;
+ u_32_t ipfr_optmsk;
+ u_short ipfr_secmsk;
+ u_short ipfr_auth;
u_short ipfr_id;
u_char ipfr_p;
u_char ipfr_tos;
u_short ipfr_off;
- u_short ipfr_ttl;
+ u_char ipfr_ttl;
+ u_char ipfr_seen0;
frentry_t *ipfr_rule;
} ipfr_t;
@@ -40,7 +42,8 @@ typedef struct ipfrstat {
struct ipfr **ifs_nattab;
} ipfrstat_t;
-#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1)
+#define IPFR_CMPSZ (offsetof(ipfr_t, ipfr_off) - \
+ offsetof(ipfr_t, ipfr_src))
extern int fr_ipfrttl;
extern int fr_frag_lock;
diff --git a/contrib/ipfilter/ip_ftp_pxy.c b/contrib/ipfilter/ip_ftp_pxy.c
index ddca8890f0bf..830a4f66c9ec 100644
--- a/contrib/ipfilter/ip_ftp_pxy.c
+++ b/contrib/ipfilter/ip_ftp_pxy.c
@@ -2,7 +2,7 @@
* Simple FTP transparent proxy for in-kernel use. For use with the NAT
* code.
*
- * $Id: ip_ftp_pxy.c,v 2.7.2.20 2000/12/02 00:15:06 darrenr Exp $
+ * $Id: ip_ftp_pxy.c,v 2.7.2.26 2001/07/15 13:50:54 darrenr Exp $
*/
#if SOLARIS && defined(_KERNEL)
extern kmutex_t ipf_rw;
@@ -22,6 +22,22 @@ extern kmutex_t ipf_rw;
#define IPF_MAX227LEN 51
#define IPF_FTPBUFSZ 96 /* This *MUST* be >= 53! */
+#define FTPXY_GO 0
+#define FTPXY_INIT 1
+#define FTPXY_USER_1 2
+#define FTPXY_USOK_1 3
+#define FTPXY_PASS_1 4
+#define FTPXY_PAOK_1 5
+#define FTPXY_AUTH_1 6
+#define FTPXY_AUOK_1 7
+#define FTPXY_ADAT_1 8
+#define FTPXY_ADOK_1 9
+#define FTPXY_ACCT_1 10
+#define FTPXY_ACOK_1 11
+#define FTPXY_USER_2 12
+#define FTPXY_USOK_2 13
+#define FTPXY_PASS_2 14
+#define FTPXY_PAOK_2 15
int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
int ippr_ftp_complete __P((char *, size_t));
@@ -75,6 +91,7 @@ nat_t *nat;
f = &ftp->ftp_side[1];
f->ftps_rptr = f->ftps_buf;
f->ftps_wptr = f->ftps_buf;
+ ftp->ftp_passok = FTPXY_INIT;
return 0;
}
@@ -215,7 +232,7 @@ int dlen;
sum2 -= sum1;
sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- fix_outcksum(&ip->ip_sum, sum2);
+ fix_outcksum(fin, &ip->ip_sum, sum2);
#endif
ip->ip_len += inc;
}
@@ -255,6 +272,7 @@ int dlen;
fi.fin_dlen = sizeof(*tcp2);
fi.fin_dp = (char *)tcp2;
fi.fin_fr = &natfr;
+ fi.fin_out = 1;
swip = ip->ip_src;
fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
ip->ip_src = nat->nat_inip;
@@ -297,11 +315,36 @@ int dlen;
}
cmd[i] = '\0';
- if ((ftp->ftp_passok == 0) && !strncmp(cmd, "USER ", 5))
- ftp->ftp_passok = 1;
- else if ((ftp->ftp_passok == 2) && !strncmp(cmd, "PASS ", 5))
- ftp->ftp_passok = 3;
- else if ((ftp->ftp_passok == 4) && !ippr_ftp_pasvonly &&
+ ftp->ftp_incok = 0;
+ if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) {
+ if (ftp->ftp_passok == FTPXY_ADOK_1 ||
+ ftp->ftp_passok == FTPXY_AUOK_1) {
+ ftp->ftp_passok = FTPXY_USER_2;
+ ftp->ftp_incok = 1;
+ } else {
+ ftp->ftp_passok = FTPXY_USER_1;
+ ftp->ftp_incok = 1;
+ }
+ } else if (!strncmp(cmd, "AUTH ", 5)) {
+ ftp->ftp_passok = FTPXY_AUTH_1;
+ ftp->ftp_incok = 1;
+ } else if (!strncmp(cmd, "PASS ", 5)) {
+ if (ftp->ftp_passok == FTPXY_USOK_1) {
+ ftp->ftp_passok = FTPXY_PASS_1;
+ ftp->ftp_incok = 1;
+ } else if (ftp->ftp_passok == FTPXY_USOK_2) {
+ ftp->ftp_passok = FTPXY_PASS_2;
+ ftp->ftp_incok = 1;
+ }
+ } else if ((ftp->ftp_passok == FTPXY_AUOK_1) &&
+ !strncmp(cmd, "ADAT ", 5)) {
+ ftp->ftp_passok = FTPXY_ADAT_1;
+ ftp->ftp_incok = 1;
+ } else if ((ftp->ftp_passok == FTPXY_PAOK_2) &&
+ !strncmp(cmd, "ACCT ", 5)) {
+ ftp->ftp_passok = FTPXY_ACCT_1;
+ ftp->ftp_incok = 1;
+ } else if ((ftp->ftp_passok == FTPXY_GO) && !ippr_ftp_pasvonly &&
!strncmp(cmd, "PORT ", 5)) {
inc = ippr_ftp_port(fin, ip, nat, f, dlen);
} else if (ippr_ftp_insecure && !ippr_ftp_pasvonly &&
@@ -332,12 +375,13 @@ int dlen;
int inc;
char *s;
+#define PASV_REPLEN 24
/*
* Check for PASV reply message.
*/
if (dlen < IPF_MIN227LEN)
return 0;
- else if (strncmp(f->ftps_rptr, "227 Entering Passive Mode", 25))
+ else if (strncmp(f->ftps_rptr, "227 Entering Passive Mod", PASV_REPLEN))
return 0;
tcp = (tcphdr_t *)fin->fin_dp;
@@ -345,7 +389,7 @@ int dlen;
/*
* Skip the PORT command + space
*/
- s = f->ftps_rptr + 25;
+ s = f->ftps_rptr + PASV_REPLEN;
while (*s && !isdigit(*s))
s++;
/*
@@ -373,6 +417,8 @@ int dlen;
if (*s == ')')
s++;
+ if (*s == '.')
+ s++;
if (*s == '\n')
s--;
/*
@@ -445,7 +491,7 @@ int dlen;
sum2 -= sum1;
sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- fix_outcksum(&ip->ip_sum, sum2);
+ fix_outcksum(fin, &ip->ip_sum, sum2);
#endif /* SOLARIS || defined(__sgi) */
ip->ip_len += inc;
}
@@ -469,12 +515,13 @@ int dlen;
tcp2->th_win = htons(8192);
tcp2->th_sport = 0; /* XXX - fake it for nat_new */
tcp2->th_off = 5;
- fi.fin_data[1] = a5 << 8 | a6;
+ fi.fin_data[0] = a5 << 8 | a6;
fi.fin_dlen = sizeof(*tcp2);
- tcp2->th_dport = htons(fi.fin_data[1]);
- fi.fin_data[0] = 0;
+ tcp2->th_dport = htons(fi.fin_data[0]);
+ fi.fin_data[1] = 0;
fi.fin_dp = (char *)tcp2;
fi.fin_fr = &natfr;
+ fi.fin_out = 1;
swip = ip->ip_src;
swip2 = ip->ip_dst;
fi.fin_fi.fi_daddr = ip->ip_src.s_addr;
@@ -511,17 +558,38 @@ int dlen;
rptr = f->ftps_rptr;
wptr = f->ftps_wptr;
- if ((ftp->ftp_passok == 1) && !strncmp(rptr, "331", 3))
- ftp->ftp_passok = 2;
- else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "230", 3))
- ftp->ftp_passok = 4;
- else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "530", 3))
- ftp->ftp_passok = 0;
- else if ((ftp->ftp_passok == 4) && !strncmp(rptr, "227 ", 4)) {
- inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
+ if (!isdigit(*rptr) || !isdigit(*(rptr + 1)) || !isdigit(*(rptr + 2)))
+ return inc;
+ if (ftp->ftp_passok == FTPXY_GO) {
+ if (!strncmp(rptr, "227 ", 4))
+ inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
} else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) {
inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
+ } else if (*rptr == '5' || *rptr == '4')
+ ftp->ftp_passok = FTPXY_INIT;
+ else if (ftp->ftp_incok) {
+ if (*rptr == '3') {
+ if (ftp->ftp_passok == FTPXY_ACCT_1)
+ ftp->ftp_passok = FTPXY_GO;
+ else
+ ftp->ftp_passok++;
+ } else if (*rptr == '2') {
+ switch (ftp->ftp_passok)
+ {
+ case FTPXY_USER_1 :
+ case FTPXY_USER_2 :
+ case FTPXY_PASS_1 :
+ case FTPXY_PASS_2 :
+ case FTPXY_ACCT_1 :
+ ftp->ftp_passok = FTPXY_GO;
+ break;
+ default :
+ ftp->ftp_passok += 3;
+ break;
+ }
+ }
}
+ ftp->ftp_incok = 0;
while ((*rptr++ != '\n') && (rptr < wptr))
;
f->ftps_rptr = rptr;
diff --git a/contrib/ipfilter/ip_lfil.c b/contrib/ipfilter/ip_lfil.c
index 4763ad7380b1..14e6b42102b7 100644
--- a/contrib/ipfilter/ip_lfil.c
+++ b/contrib/ipfilter/ip_lfil.c
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6 2000/03/13 22:10:21 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6.2.2 2001/07/18 14:57:09 darrenr Exp $";
#endif
#if defined(KERNEL) && !defined(_KERNEL)
@@ -337,7 +335,7 @@ int iplioctl(dev_t dev, int cmd, caddr_t data, int mode)
break;
}
case SIOCATHST :
- error = fr_auth_ioctl(data, cmd, NULL, NULL);
+ error = fr_auth_ioctl(data, mode, cmd, NULL, NULL);
break;
case SIOCFRSYN :
if (!(mode & FWRITE))
@@ -484,7 +482,7 @@ caddr_t data;
if (fg && fg->fg_head)
fg->fg_head->fr_ref--;
if (unit == IPL_LOGAUTH)
- return fr_auth_ioctl(data, req, f, ftail);
+ return fr_auth_ioctl(data, mode, req, f, ftail);
if (f->fr_grhead)
fr_delgroup((u_int)f->fr_grhead, fp->fr_flags,
unit, set);
@@ -497,7 +495,7 @@ caddr_t data;
error = EEXIST;
else {
if (unit == IPL_LOGAUTH)
- return fr_auth_ioctl(data, req, f, ftail);
+ return fr_auth_ioctl(data, mode, req, f, ftail);
KMALLOC(f, frentry_t *);
if (f != NULL) {
if (fg && fg->fg_head)
diff --git a/contrib/ipfilter/ip_log.c b/contrib/ipfilter/ip_log.c
index 8adc410e80b7..5968f46ad4b0 100644
--- a/contrib/ipfilter/ip_log.c
+++ b/contrib/ipfilter/ip_log.c
@@ -1,11 +1,9 @@
/*
- * Copyright (C) 1997-2000 by Darren Reed.
+ * Copyright (C) 1997-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
- * $Id: ip_log.c,v 2.5.2.2 2000/08/13 03:50:41 darrenr Exp $
+ * $Id: ip_log.c,v 2.5.2.5 2001/06/26 10:43:14 darrenr Exp $
*/
#include <sys/param.h>
#if defined(KERNEL) && !defined(_KERNEL)
@@ -21,7 +19,13 @@
# endif
# else
# ifdef KLD_MODULE
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
# endif
# endif
#endif
@@ -45,7 +49,7 @@
# include <sys/ioctl.h>
# endif
# include <sys/time.h>
-# if defined(_KERNEL) && !defined(linux)
+# if defined(_KERNEL)
# include <sys/systm.h>
# endif
# include <sys/uio.h>
@@ -55,9 +59,7 @@
# else
# include <sys/dir.h>
# endif
-# ifndef linux
-# include <sys/mbuf.h>
-# endif
+# include <sys/mbuf.h>
# else
# include <sys/filio.h>
# include <sys/cred.h>
@@ -69,9 +71,7 @@
# include <sys/dditypes.h>
# include <sys/cmn_err.h>
# endif
-# ifndef linux
-# include <sys/protosw.h>
-# endif
+# include <sys/protosw.h>
# include <sys/socket.h>
# include <net/if.h>
@@ -89,7 +89,7 @@
# include <sys/hashing.h>
# endif
# endif
-# if !defined(linux) && !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/
+# if !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/
# include <netinet/in_var.h>
# endif
# include <netinet/in_systm.h>
@@ -97,9 +97,7 @@
# include <netinet/tcp.h>
# include <netinet/udp.h>
# include <netinet/ip_icmp.h>
-# ifndef linux
-# include <netinet/ip_var.h>
-# endif
+# include <netinet/ip_var.h>
# ifndef _KERNEL
# include <syslog.h>
# endif
@@ -130,9 +128,6 @@ extern kcondvar_t iplwait;
iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1], *ipll[IPL_LOGMAX+1];
size_t iplused[IPL_LOGMAX+1];
static fr_info_t iplcrc[IPL_LOGMAX+1];
-# ifdef linux
-static struct wait_queue *iplwait[IPL_LOGMAX+1];
-# endif
/*
@@ -229,9 +224,7 @@ mb_t *m;
(defined(OpenBSD) && (OpenBSD >= 199603))
strncpy(ipfl.fl_ifname, ifp->if_xname, IFNAMSIZ);
# else
-# ifndef linux
ipfl.fl_unit = (u_char)ifp->if_unit;
-# endif
if ((ipfl.fl_ifname[0] = ifp->if_name[0]))
if ((ipfl.fl_ifname[1] = ifp->if_name[1]))
if ((ipfl.fl_ifname[2] = ifp->if_name[2]))
@@ -337,7 +330,7 @@ int *types, cnt;
ipl->ipl_count = 1;
ipl->ipl_next = NULL;
ipl->ipl_dsize = len;
-# if SOLARIS || defined(sun) || defined(linux)
+# if SOLARIS || defined(sun)
uniqtime((struct timeval *)&ipl->ipl_sec);
# else
# if BSD >= 199306 || defined(__FreeBSD__) || defined(__sgi)
@@ -370,11 +363,7 @@ int *types, cnt;
mutex_exit(&ipl_mutex);
# else
MUTEX_EXIT(&ipl_mutex);
-# ifdef linux
- wake_up_interruptible(&iplwait[dev]);
-# else
wakeup(&iplh[dev]);
-# endif
# endif
return 1;
}
@@ -399,8 +388,7 @@ struct uio *uio;
return ENXIO;
if (!uio->uio_resid)
return 0;
- if ((uio->uio_resid < sizeof(iplog_t)) ||
- (uio->uio_resid > IPLLOGSIZE))
+ if (uio->uio_resid < sizeof(iplog_t))
return EINVAL;
/*
@@ -417,19 +405,13 @@ struct uio *uio;
return EINTR;
}
# else
-# ifdef linux
- interruptible_sleep_on(&iplwait[unit]);
- if (current->signal & ~current->blocked)
- return -EINTR;
-# else
MUTEX_EXIT(&ipl_mutex);
- SPL_X(s);
error = SLEEP(&iplh[unit], "ipl sleep");
- if (error)
+ if (error) {
+ SPL_X(s);
return error;
- SPL_NET(s);
+ }
MUTEX_ENTER(&ipl_mutex);
-# endif /* linux */
# endif /* SOLARIS */
}
@@ -447,10 +429,8 @@ struct uio *uio;
iplt[unit] = ipl->ipl_next;
iplused[unit] -= dlen;
MUTEX_EXIT(&ipl_mutex);
- SPL_X(s);
error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio);
if (error) {
- SPL_NET(s);
MUTEX_ENTER(&ipl_mutex);
ipl->ipl_next = iplt[unit];
iplt[unit] = ipl;
@@ -458,7 +438,6 @@ struct uio *uio;
break;
}
KFREES((caddr_t)ipl, dlen);
- SPL_NET(s);
MUTEX_ENTER(&ipl_mutex);
}
if (!iplt[unit]) {
@@ -469,13 +448,7 @@ struct uio *uio;
MUTEX_EXIT(&ipl_mutex);
SPL_X(s);
-# ifdef linux
- if (!error)
- return (int)copied;
- return -error;
-# else
return error;
-# endif
}
diff --git a/contrib/ipfilter/ip_nat.c b/contrib/ipfilter/ip_nat.c
index e7e121a0b723..eb6e133bfc0f 100644
--- a/contrib/ipfilter/ip_nat.c
+++ b/contrib/ipfilter/ip_nat.c
@@ -1,17 +1,10 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com)
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.32 2001/01/10 06:19:11 darrenr Exp $";
-#endif
-
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
#define _KERNEL
#endif
@@ -91,6 +84,7 @@ extern struct ifnet vpnif;
#ifndef linux
# include <netinet/ip_var.h>
+# include <netinet/tcp_fsm.h>
#endif
#include <netinet/tcp.h>
#include <netinet/udp.h>
@@ -111,6 +105,11 @@ extern struct ifnet vpnif;
#undef SOCKADDR_IN
#define SOCKADDR_IN struct sockaddr_in
+#if !defined(lint)
+static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.44 2001/07/21 07:17:22 darrenr Exp $";
+#endif
+
nat_t **nat_table[2] = { NULL, NULL },
*nat_instances = NULL;
ipnat_t *nat_list = NULL;
@@ -301,7 +300,8 @@ struct hostmap *hm;
}
-void fix_outcksum(sp, n)
+void fix_outcksum(fin, sp, n)
+fr_info_t *fin;
u_short *sp;
u_32_t n;
{
@@ -310,12 +310,13 @@ u_32_t n;
if (!n)
return;
-#if SOLARIS2 >= 6
else if (n & NAT_HW_CKSUM) {
+ n &= 0xffff;
+ n += fin->fin_dlen;
+ n = (n & 0xffff) + (n >> 16);
*sp = n & 0xffff;
return;
}
-#endif
sum1 = (~ntohs(*sp)) & 0xffff;
sum1 += (n);
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
@@ -326,7 +327,8 @@ u_32_t n;
}
-void fix_incksum(sp, n)
+void fix_incksum(fin, sp, n)
+fr_info_t *fin;
u_short *sp;
u_32_t n;
{
@@ -335,12 +337,13 @@ u_32_t n;
if (!n)
return;
-#if SOLARIS2 >= 6
else if (n & NAT_HW_CKSUM) {
+ n &= 0xffff;
+ n += fin->fin_dlen;
+ n = (n & 0xffff) + (n >> 16);
*sp = n & 0xffff;
return;
}
-#endif
#ifdef sparc
sum1 = (~(*sp)) & 0xffff;
#else
@@ -625,9 +628,11 @@ int mode;
nat_stats.ns_table[0] = nat_table[0];
nat_stats.ns_table[1] = nat_table[1];
nat_stats.ns_list = nat_list;
+ nat_stats.ns_maptable = maptable;
nat_stats.ns_nattab_sz = ipf_nattable_sz;
nat_stats.ns_rultab_sz = ipf_natrules_sz;
nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
+ nat_stats.ns_hostmap_sz = ipf_hostmap_sz;
nat_stats.ns_instances = nat_instances;
nat_stats.ns_apslist = ap_sess_list;
error = IWCOPYPTR((char *)&nat_stats, (char *)data,
@@ -1395,14 +1400,14 @@ int direction;
CALC_SUMD(sum1, sum2, sumd);
nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
- if ((flags == IPN_TCP) && dohwcksum &&
+ if ((flags & IPN_TCPUDP) && dohwcksum &&
(qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
if (direction == NAT_OUTBOUND)
sum1 = LONG_SUM(ntohl(in.s_addr));
else
sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr));
- sum1 += 30;
+ sum1 += IPPROTO_TCP;
sum1 = (sum1 & 0xffff) + (sum1 >> 16);
nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
} else
@@ -1463,8 +1468,8 @@ badnat:
void nat_insert(nat)
nat_t *nat;
{
+ u_int hv1, hv2;
nat_t **natp;
- u_int hv;
MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
@@ -1477,18 +1482,30 @@ nat_t *nat;
nat->nat_next = nat_instances;
nat_instances = nat;
- hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
- ipf_nattable_sz);
- natp = &nat_table[0][hv];
+ if (!(nat->nat_flags & (FI_W_SPORT|FI_W_DPORT))) {
+ hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
+ 0xffffffff);
+ hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
+ ipf_nattable_sz);
+ hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
+ 0xffffffff);
+ hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
+ ipf_nattable_sz);
+ } else {
+ hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
+ hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, ipf_nattable_sz);
+ hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
+ hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, ipf_nattable_sz);
+ }
+
+ natp = &nat_table[0][hv1];
if (*natp)
(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
nat->nat_phnext[0] = natp;
nat->nat_hnext[0] = *natp;
*natp = nat;
- hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
- ipf_nattable_sz);
- natp = &nat_table[1][hv];
+ natp = &nat_table[1][hv2];
if (*natp)
(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
nat->nat_phnext[1] = natp;
@@ -1604,7 +1621,7 @@ int dir;
ip_t *oip;
int flags = 0;
- if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK))
+ if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0))
return NULL;
/*
* nat_icmplookup() will return NULL for `defective' packets.
@@ -1878,13 +1895,14 @@ int dir;
sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
if (nat->nat_dir == NAT_OUTBOUND) {
- fix_outcksum(&icmp->icmp_cksum, sumd2);
+ fix_outcksum(fin, &icmp->icmp_cksum, sumd2);
} else {
- fix_incksum(&icmp->icmp_cksum, sumd2);
+ fix_incksum(fin, &icmp->icmp_cksum, sumd2);
}
}
}
- nat->nat_age = fr_defnaticmpage;
+ if (oip->ip_p == IPPROTO_ICMP)
+ nat->nat_age = fr_defnaticmpage;
return nat;
}
@@ -1917,7 +1935,8 @@ int rw;
sport = ports & 0xffff;
flags &= IPN_TCPUDP;
- hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz);
+ hv = NAT_HASH_FN(dst, dport, 0xffffffff);
+ hv = NAT_HASH_FN(src.s_addr, hv + sport, ipf_nattable_sz);
nat = nat_table[1][hv];
for (; nat; nat = nat->nat_hnext[1]) {
nflags = nat->nat_flags;
@@ -1935,7 +1954,8 @@ int rw;
if (!rw) {
RWLOCK_EXIT(&ipf_nat);
}
- hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz);
+ hv = NAT_HASH_FN(dst, 0, 0xffffffff);
+ hv = NAT_HASH_FN(src.s_addr, hv, ipf_nattable_sz);
if (!rw) {
WRITE_ENTER(&ipf_nat);
}
@@ -1999,7 +2019,8 @@ u_32_t ports;
/*
* Add into the NAT table in the new position
*/
- hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, ipf_nattable_sz);
+ hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, 0xffffffff);
+ hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
natp = &nat_table[0][hv];
if (*natp)
(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
@@ -2007,7 +2028,8 @@ u_32_t ports;
nat->nat_hnext[0] = *natp;
*natp = nat;
- hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, ipf_nattable_sz);
+ hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, 0xffffffff);
+ hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
natp = &nat_table[1][hv];
if (*natp)
(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
@@ -2041,7 +2063,8 @@ int rw;
flags &= IPN_TCPUDP;
srcip = src.s_addr;
- hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz);
+ hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
+ hv = NAT_HASH_FN(dst.s_addr, hv + dport, ipf_nattable_sz);
nat = nat_table[0][hv];
for (; nat; nat = nat->nat_hnext[0]) {
nflags = nat->nat_flags;
@@ -2061,6 +2084,7 @@ int rw;
RWLOCK_EXIT(&ipf_nat);
}
hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz);
+ hv = NAT_HASH_FN(dst.s_addr, hv, ipf_nattable_sz);
if (!rw) {
WRITE_ENTER(&ipf_nat);
}
@@ -2145,8 +2169,8 @@ ip_t *ip;
}
ft = &np->in_tuc;
- if (!(fin->fin_fi.fi_fl & FI_TCPUDP) ||
- (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) {
+ if (!(fin->fin_fl & FI_TCPUDP) ||
+ (fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) {
if (ft->ftu_scmp || ft->ftu_dcmp)
return 0;
return 1;
@@ -2168,13 +2192,12 @@ fr_info_t *fin;
register u_32_t ipa;
tcphdr_t *tcp = NULL;
u_short sport = 0, dport = 0, *csump = NULL;
+ int natadd = 1, i, icmpset = 1;
+ u_int nflags = 0, hv, msk;
struct ifnet *ifp;
- int natadd = 1;
frentry_t *fr;
- u_int nflags = 0, hv, msk;
u_32_t iph;
nat_t *nat;
- int i;
if (nat_list == NULL || (fr_nat_lock))
return 0;
@@ -2185,7 +2208,7 @@ fr_info_t *fin;
else
ifp = fin->fin_ifp;
- if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
if (ip->ip_p == IPPROTO_TCP)
nflags = IPN_TCP;
else if (ip->ip_p == IPPROTO_UDP)
@@ -2203,8 +2226,8 @@ fr_info_t *fin;
if ((ip->ip_p == IPPROTO_ICMP) &&
(nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
- ;
- else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
+ icmpset = 1;
+ else if ((fin->fin_fl & FI_FRAG) &&
(nat = ipfr_nat_knownfrag(ip, fin)))
natadd = 0;
else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p,
@@ -2238,8 +2261,7 @@ maskloop:
hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
for (np = nat_rules[hv]; np; np = np->in_mnext)
{
- if ((np->in_ifp && (np->in_ifp != ifp)) ||
- !np->in_space)
+ if (np->in_ifp && (np->in_ifp != ifp))
continue;
if ((np->in_flags & IPN_RF) &&
!(np->in_flags & nflags))
@@ -2283,7 +2305,7 @@ maskloop:
*/
if (nat) {
np = nat->nat_ptr;
- if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
+ if (natadd && (fin->fin_fl & FI_FRAG) && np)
ipfr_nat_newfrag(ip, fin, 0, nat);
MUTEX_ENTER(&nat->nat_lock);
nat->nat_age = fr_defnatage;
@@ -2303,22 +2325,21 @@ maskloop:
CALC_SUMD(s1, s2, sumd);
if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(&ip->ip_sum, sumd);
+ fix_incksum(fin, &ip->ip_sum, sumd);
else
- fix_outcksum(&ip->ip_sum, sumd);
+ fix_outcksum(fin, &ip->ip_sum, sumd);
}
#if SOLARIS || defined(__sgi)
else {
if (nat->nat_dir == NAT_OUTBOUND)
- fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
+ fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
else
- fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
+ fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
}
#endif
ip->ip_src = nat->nat_outip;
- if (!(ip->ip_off & IP_OFFMASK) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
tcp->th_sport = nat->nat_outport;
@@ -2351,14 +2372,15 @@ maskloop:
if (udp->uh_sum)
csump = &udp->uh_sum;
} else if (ip->ip_p == IPPROTO_ICMP) {
- nat->nat_age = fr_defnaticmpage;
+ if (!icmpset)
+ nat->nat_age = fr_defnaticmpage;
}
if (csump) {
if (nat->nat_dir == NAT_OUTBOUND)
- fix_outcksum(csump, nat->nat_sumd[1]);
+ fix_outcksum(fin, csump, nat->nat_sumd[1]);
else
- fix_incksum(csump, nat->nat_sumd[1]);
+ fix_incksum(fin, csump, nat->nat_sumd[1]);
}
}
@@ -2389,18 +2411,18 @@ fr_info_t *fin;
register struct in_addr src;
register struct in_addr in;
register ipnat_t *np;
+ u_short sport = 0, dport = 0, *csump = NULL;
u_int nflags = 0, natadd = 1, hv, msk;
struct ifnet *ifp = fin->fin_ifp;
tcphdr_t *tcp = NULL;
- u_short sport = 0, dport = 0, *csump = NULL;
+ int i, icmpset = 0;
nat_t *nat;
u_32_t iph;
- int i;
if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
return 0;
- if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
if (ip->ip_p == IPPROTO_TCP)
nflags = IPN_TCP;
else if (ip->ip_p == IPPROTO_UDP)
@@ -2420,8 +2442,8 @@ fr_info_t *fin;
if ((ip->ip_p == IPPROTO_ICMP) &&
(nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
- ;
- else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
+ icmpset = 1;
+ else if ((fin->fin_fl & FI_FRAG) &&
(nat = ipfr_nat_knownfrag(ip, fin)))
natadd = 0;
else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p,
@@ -2488,7 +2510,7 @@ maskloop:
if (nat) {
np = nat->nat_ptr;
fin->fin_fr = nat->nat_fr;
- if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
+ if (natadd && (fin->fin_fl & FI_FRAG) && np)
ipfr_nat_newfrag(ip, fin, 0, nat);
if ((np->in_apr != NULL) && (np->in_dport == 0 ||
(tcp != NULL && sport == np->in_dport))) {
@@ -2515,12 +2537,11 @@ maskloop:
*/
#if SOLARIS || defined(__sgi)
if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
+ fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
else
- fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
+ fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
#endif
- if (!(ip->ip_off & IP_OFFMASK) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
tcp->th_dport = nat->nat_inport;
@@ -2553,14 +2574,15 @@ maskloop:
if (udp->uh_sum)
csump = &udp->uh_sum;
} else if (ip->ip_p == IPPROTO_ICMP) {
- nat->nat_age = fr_defnaticmpage;
+ if (!icmpset)
+ nat->nat_age = fr_defnaticmpage;
}
if (csump) {
if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(csump, nat->nat_sumd[0]);
+ fix_incksum(fin, csump, nat->nat_sumd[0]);
else
- fix_outcksum(csump, nat->nat_sumd[0]);
+ fix_outcksum(fin, csump, nat->nat_sumd[0]);
}
}
ATOMIC_INCL(nat_stats.ns_mapped[0]);
diff --git a/contrib/ipfilter/ip_nat.h b/contrib/ipfilter/ip_nat.h
index 22f8503df113..f712dfcd9c5e 100644
--- a/contrib/ipfilter/ip_nat.h
+++ b/contrib/ipfilter/ip_nat.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_nat.h 1.5 2/4/96
- * $Id: ip_nat.h,v 2.17.2.14 2000/11/18 03:58:04 darrenr Exp $
+ * $Id: ip_nat.h,v 2.17.2.20 2001/06/26 10:43:15 darrenr Exp $
*/
#ifndef __IP_NAT_H__
@@ -35,10 +33,18 @@
* appropriate sizes. The figures below were used for
* a setup with 1000-2000 networks to NAT.
*/
-#define NAT_SIZE 127
-#define RDR_SIZE 127
-#define HOSTMAP_SIZE 127
-#define NAT_TABLE_SZ 127
+#ifndef NAT_SIZE
+# define NAT_SIZE 127
+#endif
+#ifndef RDR_SIZE
+# define RDR_SIZE 127
+#endif
+#ifndef HOSTMAP_SIZE
+# define HOSTMAP_SIZE 127
+#endif
+#ifndef NAT_TABLE_SZ
+# define NAT_TABLE_SZ 127
+#endif
#ifdef LARGE_NAT
#undef NAT_SIZE
#undef RDR_SIZE
@@ -201,11 +207,13 @@ typedef struct natstat {
u_long ns_memfail;
u_long ns_badnat;
nat_t **ns_table[2];
+ hostmap_t **ns_maptable;
ipnat_t *ns_list;
void *ns_apslist;
u_int ns_nattab_sz;
u_int ns_rultab_sz;
u_int ns_rdrtab_sz;
+ u_int ns_hostmap_sz;
nat_t *ns_instances;
u_int ns_wilds;
} natstat_t;
@@ -220,12 +228,13 @@ typedef struct natstat {
#define IPN_AUTOPORTMAP 0x010
#define IPN_IPRANGE 0x020
#define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
- IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST)
+ IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|IPN_FRAG)
#define IPN_FILTER 0x040
#define IPN_SPLIT 0x080
#define IPN_ROUNDR 0x100
#define IPN_NOTSRC 0x080000
#define IPN_NOTDST 0x100000
+#define IPN_FRAG 0x200000
typedef struct natlog {
@@ -300,8 +309,8 @@ extern int ip_natout __P((ip_t *, fr_info_t *));
extern int ip_natin __P((ip_t *, fr_info_t *));
extern void ip_natunload __P((void)), ip_natexpire __P((void));
extern void nat_log __P((struct nat *, u_int));
-extern void fix_incksum __P((u_short *, u_32_t));
-extern void fix_outcksum __P((u_short *, u_32_t));
+extern void fix_incksum __P((fr_info_t *, u_short *, u_32_t));
+extern void fix_outcksum __P((fr_info_t *, u_short *, u_32_t));
extern void fix_datacksum __P((u_short *, u_32_t));
#endif /* __IP_NAT_H__ */
diff --git a/contrib/ipfilter/ip_proxy.c b/contrib/ipfilter/ip_proxy.c
index e1e55f11acde..325f36259ec2 100644
--- a/contrib/ipfilter/ip_proxy.c
+++ b/contrib/ipfilter/ip_proxy.c
@@ -1,14 +1,8 @@
/*
- * Copyright (C) 1997-2000 by Darren Reed.
+ * Copyright (C) 1997-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 darrenr Exp $";
-#endif
-
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
# define _KERNEL
#endif
@@ -78,6 +72,10 @@ static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 d
# include <sys/malloc.h>
#endif
+#if !defined(lint)
+static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.6 2001/07/15 22:06:15 darrenr Exp $";
+#endif
+
#ifndef MIN
#define MIN(a,b) (((a)<(b))?(a):(b))
@@ -216,9 +214,13 @@ ip_t *ip;
fr_info_t *fin;
nat_t *nat;
{
+#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
+ mb_t *m = fin->fin_qfm;
+ int dosum = 1;
+#endif
+ tcphdr_t *tcp = NULL;
ap_session_t *aps;
aproxy_t *apr;
- tcphdr_t *tcp = NULL;
u_32_t sum;
short rv;
int err;
@@ -234,8 +236,13 @@ nat_t *nat;
* verify that the checksum is correct. If not, then
* don't do anything with this packet.
*/
-#if SOLARIS && defined(_KERNEL)
- sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
+#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
+ if (dohwcksum && (m->b_ick_flag == ICK_VALID)) {
+ sum = tcp->th_sum;
+ dosum = 0;
+ }
+ if (dosum)
+ sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
#else
sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
#endif
@@ -261,8 +268,9 @@ nat_t *nat;
if (tcp != NULL) {
err = appr_fixseqack(fin, ip, aps, APR_INC(err));
-#if SOLARIS && defined(_KERNEL)
- tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
+#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
+ if (dosum)
+ tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
#else
tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
#endif
diff --git a/contrib/ipfilter/ip_proxy.h b/contrib/ipfilter/ip_proxy.h
index 212900fbea7e..b8c8eb086cae 100644
--- a/contrib/ipfilter/ip_proxy.h
+++ b/contrib/ipfilter/ip_proxy.h
@@ -1,11 +1,9 @@
/*
- * Copyright (C) 1997-2000 by Darren Reed.
+ * Copyright (C) 1997-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
- * $Id: ip_proxy.h,v 2.8.2.4 2000/12/02 00:15:03 darrenr Exp $
+ * $Id: ip_proxy.h,v 2.8.2.7 2001/06/26 10:43:16 darrenr Exp $
*/
#ifndef __IP_PROXY_H__
@@ -102,7 +100,8 @@ typedef struct ftpside {
} ftpside_t;
typedef struct ftpinfo {
- u_int ftp_passok;
+ int ftp_passok;
+ int ftp_incok;
ftpside_t ftp_side[2];
} ftpinfo_t;
diff --git a/contrib/ipfilter/ip_raudio_pxy.c b/contrib/ipfilter/ip_raudio_pxy.c
index 9ea437c6a4cd..476e15949f35 100644
--- a/contrib/ipfilter/ip_raudio_pxy.c
+++ b/contrib/ipfilter/ip_raudio_pxy.c
@@ -1,5 +1,5 @@
/*
- * $Id: ip_raudio_pxy.c,v 1.7.2.3 2000/10/27 22:54:04 darrenr Exp $
+ * $Id: ip_raudio_pxy.c,v 1.7.2.6 2001/07/23 04:17:56 darrenr Exp $
*/
#if SOLARIS && defined(_KERNEL)
extern kmutex_t ipf_rw;
@@ -62,8 +62,8 @@ nat_t *nat;
raudio_t *rap = aps->aps_data;
unsigned char membuf[512 + 1], *s;
u_short id = 0;
- tcphdr_t *tcp;
int off, dlen;
+ tcphdr_t *tcp;
int len = 0;
mb_t *m;
#if SOLARIS
@@ -86,14 +86,16 @@ nat_t *nat;
dlen = msgdsize(m) - off;
if (dlen <= 0)
return 0;
- copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
+ dlen = MIN(sizeof(membuf), dlen);
+ copyout_mblk(m, off, dlen, (char *)membuf);
#else
m = *(mb_t **)fin->fin_mp;
dlen = mbufchainlen(m) - off;
if (dlen <= 0)
return 0;
- m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
+ dlen = MIN(sizeof(membuf), dlen);
+ m_copydata(m, off, dlen, (char *)membuf);
#endif
/*
* In all the startup parsing, ensure that we don't go outside
@@ -170,8 +172,8 @@ nat_t *nat;
unsigned char membuf[IPF_MAXPORTLEN + 1], *s;
tcphdr_t *tcp, tcph, *tcp2 = &tcph;
raudio_t *rap = aps->aps_data;
+ int off, dlen, slen, clen;
struct in_addr swa, swb;
- int off, dlen, slen;
int a1, a2, a3, a4;
u_short sp, dp;
fr_info_t fi;
@@ -202,13 +204,15 @@ nat_t *nat;
if (dlen <= 0)
return 0;
bzero(membuf, sizeof(membuf));
- copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
+ clen = MIN(sizeof(membuf), dlen);
+ copyout_mblk(m, off, clen, (char *)membuf);
#else
dlen = mbufchainlen(m) - off;
if (dlen <= 0)
return 0;
bzero(membuf, sizeof(membuf));
- m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
+ clen = MIN(sizeof(membuf), dlen);
+ m_copydata(m, off, clen, (char *)membuf);
#endif
seq = ntohl(tcp->th_seq);
@@ -217,7 +221,7 @@ nat_t *nat;
* We only care for the first 19 bytes coming back from the server.
*/
if (rap->rap_sseq == 0) {
- s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
+ s = (u_char *)memstr("PNA", (char *)membuf, 3, clen);
if (s == NULL)
return 0;
a1 = s - membuf;
@@ -278,6 +282,7 @@ nat_t *nat;
tcp2->th_dport = htons(dp);
fi.fin_data[0] = dp;
fi.fin_data[1] = sp;
+ fi.fin_out = 0;
ipn = nat_new(nat->nat_ptr, ip, &fi,
IPN_UDP | (sp ? 0 : FI_W_SPORT), NAT_OUTBOUND);
if (ipn != NULL) {
@@ -292,6 +297,7 @@ nat_t *nat;
tcp2->th_dport = 0; /* XXX - don't specify remote port */
fi.fin_data[0] = sp;
fi.fin_data[1] = 0;
+ fi.fin_out = 1;
ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT,
NAT_OUTBOUND);
if (ipn != NULL) {
diff --git a/contrib/ipfilter/ip_sfil.c b/contrib/ipfilter/ip_sfil.c
index f637381107b2..26ef65ff1a32 100644
--- a/contrib/ipfilter/ip_sfil.c
+++ b/contrib/ipfilter/ip_sfil.c
@@ -1,15 +1,13 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* I hate legaleese, don't you ?
*/
#if !defined(lint)
static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.9 2000/11/12 11:55:17 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.12 2001/07/18 14:57:09 darrenr Exp $";
#endif
#include <sys/types.h>
@@ -197,7 +195,7 @@ int *rp;
return error;
}
if (unit == IPL_LOGAUTH) {
- error = fr_auth_ioctl((caddr_t)data, cmd, NULL, NULL);
+ error = fr_auth_ioctl((caddr_t)data, mode, cmd, NULL, NULL);
RWLOCK_EXIT(&ipf_solaris);
return error;
}
@@ -458,6 +456,7 @@ caddr_t data;
}
fdp = &fp->fr_dif;
+ fdp->fd_mp = NULL;
fp->fr_flags &= ~FR_DUP;
if (*fdp->fd_ifname) {
ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
@@ -491,6 +490,7 @@ caddr_t data;
}
fdp = &fp->fr_tif;
+ fdp->fd_mp = NULL;
if (*fdp->fd_ifname) {
ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
if (!ill)
@@ -577,10 +577,6 @@ caddr_t data;
}
if (fg && fg->fg_head)
fg->fg_head->fr_ref--;
- if (unit == IPL_LOGAUTH) {
- error = fr_auth_ioctl(data, req, fp, ftail);
- goto out;
- }
if (f->fr_grhead)
fr_delgroup(f->fr_grhead, fp->fr_flags,
unit, set);
@@ -594,10 +590,6 @@ caddr_t data;
if (f) {
error = EEXIST;
} else {
- if (unit == IPL_LOGAUTH) {
- error = fr_auth_ioctl(data, req, fp, ftail);
- goto out;
- }
KMALLOC(f, frentry_t *);
if (f != NULL) {
if (fg && fg->fg_head)
diff --git a/contrib/ipfilter/ip_state.c b/contrib/ipfilter/ip_state.c
index 5d6396958eb5..649ad939ddf8 100644
--- a/contrib/ipfilter/ip_state.c
+++ b/contrib/ipfilter/ip_state.c
@@ -1,15 +1,8 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46 darrenr Exp $";
-#endif
-
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
@@ -97,6 +90,11 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46
# endif
#endif
+#if !defined(lint)
+static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.38 2001/07/23 13:49:46 darrenr Exp $";
+#endif
+
#ifndef MIN
# define MIN(a,b) (((a)<(b))?(a):(b))
#endif
@@ -140,7 +138,9 @@ u_long fr_tcpidletimeout = FIVE_DAYS,
fr_tcpclosed = 120,
fr_tcphalfclosed = 2 * 2 * 3600, /* 2 hours */
fr_udptimeout = 240,
- fr_icmptimeout = 120;
+ fr_udpacktimeout = 24,
+ fr_icmptimeout = 120,
+ fr_icmpacktimeout = 12;
int fr_statemax = IPSTATE_MAX,
fr_statesize = IPSTATE_SIZE;
int fr_state_doflush = 0,
@@ -241,6 +241,7 @@ caddr_t data;
if (error)
return EFAULT;
+ WRITE_ENTER(&ipf_state);
for (sp = ips_list; sp; sp = sp->is_next)
if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
!bcmp((char *)&sp->is_src, (char *)&st.is_src,
@@ -249,7 +250,6 @@ caddr_t data;
sizeof(st.is_dst)) &&
!bcmp((char *)&sp->is_ps, (char *)&st.is_ps,
sizeof(st.is_ps))) {
- WRITE_ENTER(&ipf_state);
#ifdef IPFILTER_LOG
ipstate_log(sp, ISL_REMOVE);
#endif
@@ -257,6 +257,7 @@ caddr_t data;
RWLOCK_EXIT(&ipf_state);
return 0;
}
+ RWLOCK_EXIT(&ipf_state);
return ESRCH;
}
@@ -502,8 +503,7 @@ u_int flags;
u_int pass;
int out;
- if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
- (fin->fin_fi.fi_fl & FI_SHORT))
+ if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT))
return NULL;
if (ips_num == fr_statemax) {
ips_stats.iss_max++;
@@ -663,7 +663,7 @@ u_int flags;
is->is_secmsk = 0xffff;
is->is_auth = fin->fin_fi.fi_auth;
is->is_authmsk = 0xffff;
- is->is_flags = fin->fin_fi.fi_fl & FI_CMP;
+ is->is_flags = fin->fin_fl & FI_CMP;
is->is_flags |= FI_CMP << 4;
is->is_flags |= flags & (FI_WILDP|FI_WILDA);
if (flags & (FI_WILDP|FI_WILDA))
@@ -688,7 +688,7 @@ u_int flags;
#endif
RWLOCK_EXIT(&ipf_state);
fin->fin_rev = IP6NEQ(is->is_dst, fin->fin_fi.fi_dst);
- if (fin->fin_fi.fi_fl & FI_FRAG)
+ if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG))
ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
return is;
}
@@ -717,6 +717,8 @@ tcphdr_t *tcp;
* Find difference between last checked packet and this packet.
*/
source = IP6EQ(fin->fin_fi.fi_src, is->is_src);
+ if (source && (ntohs(is->is_sport) != fin->fin_data[0]))
+ source = 0;
fdata = &is->is_tcp.ts_data[!source];
tdata = &is->is_tcp.ts_data[source];
seq = ntohl(tcp->th_seq);
@@ -809,7 +811,7 @@ tcphdr_t *tcp;
u_short sp, dp;
void *ifp;
- rev = fin->fin_rev = IP6NEQ(is->is_dst, dst);
+ rev = IP6NEQ(is->is_dst, dst);
ifp = fin->fin_ifp;
out = fin->fin_out;
@@ -817,6 +819,12 @@ tcphdr_t *tcp;
flags = is->is_flags;
sp = tcp->th_sport;
dp = tcp->th_dport;
+ if (!rev) {
+ if (!(flags & FI_W_SPORT) && (sp != is->is_sport))
+ rev = 1;
+ else if (!(flags & FI_W_DPORT) && (dp != is->is_dport))
+ rev = 1;
+ }
} else {
flags = is->is_flags & FI_WILDA;
sp = 0;
@@ -871,10 +879,10 @@ tcphdr_t *tcp;
if (tcp == NULL)
flags = is->is_flags & (FI_CMP|(FI_CMP<<4));
- if (((fin->fin_fi.fi_fl & (flags >> 4)) != (flags & FI_CMP)) ||
- ((fin->fin_fi.fi_optmsk & is->is_optmsk) != is->is_opt) ||
- ((fin->fin_fi.fi_secmsk & is->is_secmsk) != is->is_sec) ||
- ((fin->fin_fi.fi_auth & is->is_authmsk) != is->is_auth))
+ if (((fin->fin_fl & (flags >> 4)) != (flags & FI_CMP)) ||
+ (fin->fin_fi.fi_optmsk != is->is_opt) ||
+ (fin->fin_fi.fi_secmsk != is->is_sec) ||
+ (fin->fin_fi.fi_auth != is->is_auth))
return 0;
if ((flags & (FI_W_SPORT|FI_W_DPORT))) {
@@ -924,16 +932,11 @@ tcphdr_t *tcp;
if (ret >= 0) {
is->is_ifp[ret] = ifp;
#ifdef _KERNEL
- strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
- sizeof(is->is_ifname[1]));
+ strncpy(is->is_ifname[ret], IFNAME(fin->fin_ifp),
+ sizeof(is->is_ifname[ret]));
#endif
}
-#ifdef _KERNEL
- if (ret >= 0) {
- strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
- sizeof(is->is_ifname[1]));
- }
-#endif
+ fin->fin_rev = rev;
return 1;
}
@@ -1209,8 +1212,7 @@ fr_info_t *fin;
frentry_t *fr;
tcphdr_t *tcp;
- if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
- (fin->fin_fi.fi_fl & FI_SHORT))
+ if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT))
return NULL;
is = NULL;
@@ -1254,7 +1256,10 @@ fr_info_t *fin;
if ((is->is_p == pr) && (is->is_v == v) &&
fr_matchsrcdst(is, src, dst, fin, NULL) &&
fr_matchicmpqueryreply(v, is, ic)) {
- is->is_age = fr_icmptimeout;
+ if (fin->fin_rev)
+ is->is_age = fr_icmpacktimeout;
+ else
+ is->is_age = fr_icmptimeout;
break;
}
}
@@ -1302,6 +1307,11 @@ retry_tcpudp:
if (!fr_tcpstate(is, fin, ip, tcp)) {
continue;
}
+ } else if ((pr == IPPROTO_UDP)) {
+ if (fin->fin_rev)
+ is->is_age = fr_udpacktimeout;
+ else
+ is->is_age = fr_udptimeout;
}
break;
}
@@ -1345,7 +1355,7 @@ retry_tcpudp:
fr_delstate(is);
#endif
RWLOCK_EXIT(&ipf_state);
- if (fin->fin_fi.fi_fl & FI_FRAG)
+ if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG))
ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
return fr;
}
@@ -1420,7 +1430,8 @@ void fr_stateunload()
ips_stats.iss_inuse = 0;
ips_num = 0;
RWLOCK_EXIT(&ipf_state);
- KFREES(ips_table, fr_statesize * sizeof(ipstate_t *));
+ if (ips_table)
+ KFREES(ips_table, fr_statesize * sizeof(ipstate_t *));
ips_table = NULL;
}
diff --git a/contrib/ipfilter/ip_state.h b/contrib/ipfilter/ip_state.h
index 1d1bc0068d8a..b940d774ade6 100644
--- a/contrib/ipfilter/ip_state.h
+++ b/contrib/ipfilter/ip_state.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
- * $Id: ip_state.h,v 2.13.2.2 2000/08/23 11:01:31 darrenr Exp $
+ * $Id: ip_state.h,v 2.13.2.4 2001/06/26 10:43:17 darrenr Exp $
*/
#ifndef __IP_STATE_H__
#define __IP_STATE_H__
@@ -17,8 +15,12 @@
# define SIOCDELST _IOW(r, 61, struct ipstate *)
#endif
-#define IPSTATE_SIZE 5737
-#define IPSTATE_MAX 4013 /* Maximum number of states held */
+#ifndef IPSTATE_SIZE
+# define IPSTATE_SIZE 5737
+#endif
+#ifndef IPSTATE_MAX
+# define IPSTATE_MAX 4013 /* Maximum number of states held */
+#endif
#define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
(((s1) == (d2)) && ((d1) == (s2))))
diff --git a/contrib/ipfilter/ipf.c b/contrib/ipfilter/ipf.c
index 355c42ac284f..4d25fcedde52 100644
--- a/contrib/ipfilter/ipf.c
+++ b/contrib/ipfilter/ipf.c
@@ -1,12 +1,16 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#ifdef __FreeBSD__
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
#endif
#include <stdio.h>
#include <unistd.h>
@@ -43,7 +47,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.5 2000/10/25 10:37:11 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.10 2001/07/18 11:34:19 darrenr Exp $";
#endif
#if SOLARIS
@@ -74,13 +78,19 @@ static void closedevice __P((void));
static char *getline __P((char *, size_t, FILE *, int *));
static char *ipfname = IPL_NAME;
static void usage __P((void));
-static void showversion __P((void));
+static int showversion __P((void));
static int get_flags __P((void));
+#if SOLARIS
+# define OPTS "6AdDEf:F:Il:noPrsUvVyzZ"
+#else
+# define OPTS "6AdDEf:F:Il:noPrsvVyzZ"
+#endif
+
static void usage()
{
- fprintf(stderr, "usage: ipf [-6AdDEInoPrsUvVyzZ] %s %s %s\n",
+ fprintf(stderr, "usage: ipf [-%s] %s %s %s\n", OPTS,
"[-l block|pass|nomatch]", "[-F i|o|a|s|S]", "[-f filename]");
exit(1);
}
@@ -92,11 +102,9 @@ char *argv[];
{
int c;
- while ((c = getopt(argc, argv, "6AdDEf:F:Il:noPrsUvVyzZ")) != -1) {
+ while ((c = getopt(argc, argv, OPTS)) != -1) {
switch (c)
{
- case '?' :
- usage();
#ifdef USE_INET6
case '6' :
use_inet6 = 1;
@@ -146,10 +154,11 @@ char *argv[];
break;
#endif
case 'v' :
- opts |= OPT_VERBOSE;
+ opts += OPT_VERBOSE;
break;
case 'V' :
- showversion();
+ if (showversion())
+ exit(1);
break;
case 'y' :
frsync();
@@ -160,6 +169,9 @@ char *argv[];
case 'Z' :
zerostats();
break;
+ default :
+ usage();
+ break;
}
}
@@ -553,7 +565,7 @@ static void blockunknown()
#endif
-static void showversion()
+static int showversion()
{
struct friostat fio;
struct friostat *fiop=&fio;
@@ -565,13 +577,13 @@ static void showversion()
if ((vfd = open(ipfname, O_RDONLY)) == -1) {
perror("open device");
- return;
+ return 1;
}
if (ioctl(vfd, SIOCGETFS, &fiop)) {
perror("ioctl(SIOCGETFS)");
close(vfd);
- return;
+ return 1;
}
close(vfd);
flags = get_flags();
@@ -610,4 +622,6 @@ static void showversion()
s = "nomatch -> block";
printf("%s all, Logging: %savailable\n", s, fio.f_logging ? "" : "un");
printf("Active list: %d\n", fio.f_active);
+
+ return 0;
}
diff --git a/contrib/ipfilter/ipf.h b/contrib/ipfilter/ipf.h
index ee6ae4dc6548..e7a70ca7245f 100644
--- a/contrib/ipfilter/ipf.h
+++ b/contrib/ipfilter/ipf.h
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ipf.h 1.12 6/5/96
- * $Id: ipf.h,v 2.9.2.2 2000/05/06 11:20:20 darrenr Exp $
+ * $Id: ipf.h,v 2.9.2.3 2001/06/26 10:43:18 darrenr Exp $
*/
#ifndef __IPF_H__
diff --git a/contrib/ipfilter/ipfs.c b/contrib/ipfilter/ipfs.c
index d43fc56af446..baf3d1c83aa5 100644
--- a/contrib/ipfilter/ipfs.c
+++ b/contrib/ipfilter/ipfs.c
@@ -1,12 +1,16 @@
/*
- * Copyright (C) 1999 by Darren Reed.
+ * Copyright (C) 1999-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#ifdef __FreeBSD__
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
#endif
#include <stdio.h>
#include <unistd.h>
@@ -41,7 +45,7 @@
#include "ipf.h"
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.3 2001/01/10 06:20:12 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.7 2001/06/26 10:43:18 darrenr Exp $";
#endif
#ifndef IPF_SAVEDIR
@@ -532,6 +536,7 @@ char *file;
}
bzero((char *)&ipn, sizeof(ipn));
+ ipnp = &ipn;
/*
* 1. Read all state information in.
@@ -573,7 +578,7 @@ char *file;
}
} else
in = (nat_save_t *)malloc(sizeof(*in));
- bcopy((char *)&ipnp, (char *)in, sizeof(ipn));
+ bcopy((char *)ipnp, (char *)in, sizeof(ipn));
/*
* Check to see if this is the first state entry that will
diff --git a/contrib/ipfilter/ipft_ef.c b/contrib/ipfilter/ipft_ef.c
index cbdc5991cf70..0cb4623b58ed 100644
--- a/contrib/ipfilter/ipft_ef.c
+++ b/contrib/ipfilter/ipft_ef.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
@@ -51,7 +49,7 @@ etherfind -n -t
#if !defined(lint)
static const char sccsid[] = "@(#)ipft_ef.c 1.6 2/4/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
#endif
static int etherf_open __P((char *));
diff --git a/contrib/ipfilter/ipft_hx.c b/contrib/ipfilter/ipft_hx.c
index ccbc3ee0ba3e..2be1698afe5c 100644
--- a/contrib/ipfilter/ipft_hx.c
+++ b/contrib/ipfilter/ipft_hx.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <ctype.h>
@@ -42,7 +40,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)ipft_hx.c 1.1 3/9/96 (C) 1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
#endif
extern int opts;
diff --git a/contrib/ipfilter/ipft_pc.c b/contrib/ipfilter/ipft_pc.c
index 061b7e41e523..eced91fa3ab1 100644
--- a/contrib/ipfilter/ipft_pc.c
+++ b/contrib/ipfilter/ipft_pc.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <string.h>
@@ -33,7 +31,7 @@
#include "ipt.h"
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $";
#endif
struct llc {
@@ -46,7 +44,7 @@ struct llc {
* While many of these maybe the same, some do have different header formats
* which make this useful.
*/
-#define DLT_MAX 10
+#define DLT_MAX 14
static struct llc llcs[DLT_MAX+1] = {
{ 0, 0, 0 }, /* DLT_NULL */
@@ -59,7 +57,10 @@ static struct llc llcs[DLT_MAX+1] = {
{ 0, 0, 0 }, /* DLT_ARCNET */
{ 0, 0, 0 }, /* DLT_SLIP */
{ 0, 0, 0 }, /* DLT_PPP */
- { 0, 0, 0 } /* DLT_FDDI */
+ { 0, 0, 0 }, /* DLT_FDDI */
+ { 0, 0, 0 }, /* DLT_ATMRFC1483 */
+ { 0, 0, 0 }, /* DLT_LOOP */
+ { 0, 0, 0 } /* DLT_ENC */
};
static int pcap_open __P((char *));
@@ -114,7 +115,7 @@ char *fname;
swap_hdr(&ph);
}
- if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type > DLT_MAX) {
+ if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type >= DLT_MAX) {
(void) close(fd);
return -2;
}
diff --git a/contrib/ipfilter/ipft_sn.c b/contrib/ipfilter/ipft_sn.c
index 573c007b0678..1b5e219cbbc7 100644
--- a/contrib/ipfilter/ipft_sn.c
+++ b/contrib/ipfilter/ipft_sn.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
@@ -37,7 +35,7 @@
#include "ipt.h"
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $";
#endif
struct llc {
@@ -78,6 +76,7 @@ char *fname;
{
struct snoophdr sh;
int fd;
+ int s_v;
if (sfd != -1)
return sfd;
@@ -90,16 +89,18 @@ char *fname;
if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh))
return -2;
- if (sh.s_v != SNOOP_VERSION ||
- sh.s_type < 0 || sh.s_type > SDL_MAX) {
+ s_v = (int)ntohl(sh.s_v);
+ s_type = (int)ntohl(sh.s_type);
+
+ if (s_v != SNOOP_VERSION ||
+ s_type < 0 || s_type > SDL_MAX) {
(void) close(fd);
return -2;
}
sfd = fd;
- s_type = sh.s_type;
printf("opened snoop file %s:\n", fname);
- printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, sh.s_v, s_type);
+ printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type);
return fd;
}
@@ -118,20 +119,22 @@ static int snoop_close()
static int snoop_read_rec(rec)
struct snooppkt *rec;
{
- int n, p;
+ int n, plen, ilen;
if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec))
return -2;
- if (rec->sp_ilen > rec->sp_plen || rec->sp_plen < sizeof(*rec))
+ ilen = (int)ntohl(rec->sp_ilen);
+ plen = (int)ntohl(rec->sp_plen);
+ if (ilen > plen || plen < sizeof(*rec))
return -2;
- p = rec->sp_plen - sizeof(*rec);
- n = MIN(p, rec->sp_ilen);
+ plen -= sizeof(*rec);
+ n = MIN(plen, ilen);
if (!n || n < 0)
return -3;
- return p;
+ return plen;
}
diff --git a/contrib/ipfilter/ipft_td.c b/contrib/ipfilter/ipft_td.c
index 457591c446f5..5f470eed2da4 100644
--- a/contrib/ipfilter/ipft_td.c
+++ b/contrib/ipfilter/ipft_td.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
@@ -60,7 +58,7 @@ tcpdump -nqte
#if !defined(lint)
static const char sccsid[] = "@(#)ipft_td.c 1.8 2/4/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
#endif
static int tcpd_open __P((char *));
diff --git a/contrib/ipfilter/ipft_tx.c b/contrib/ipfilter/ipft_tx.c
index 2668976ca352..1e650f5177df 100644
--- a/contrib/ipfilter/ipft_tx.c
+++ b/contrib/ipfilter/ipft_tx.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1995-2000 by Darren Reed.
+ * Copyright (C) 1995-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <ctype.h>
@@ -43,7 +41,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.1 2001/01/10 06:19:53 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.4 2001/06/26 10:43:18 darrenr Exp $";
#endif
extern int opts;
@@ -223,12 +221,12 @@ int *out;
bzero(ipopts, sizeof(ipopts));
ip->ip_hl = sizeof(*ip) >> 2;
ip->ip_v = IPVERSION;
- for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; )
+ for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && (i < 19); )
cps[++i] = strtok(NULL, " \b\t\r\n");
- if (i < 2)
- return 1;
cpp = cps;
+ if (!*cpp)
+ return 1;
c = **cpp;
if (!isalpha(c) || (tolower(c) != 'o' && tolower(c) != 'i')) {
@@ -237,12 +235,16 @@ int *out;
}
*out = (tolower(c) == 'o') ? 1 : 0;
cpp++;
+ if (!*cpp)
+ return 1;
if (!strcasecmp(*cpp, "on")) {
cpp++;
if (!*cpp)
return 1;
*ifn = strdup(*cpp++);
+ if (!*cpp)
+ return 1;
}
c = **cpp;
diff --git a/contrib/ipfilter/ipl.h b/contrib/ipfilter/ipl.h
index 3529d6510143..472bcce2f4f0 100644
--- a/contrib/ipfilter/ipl.h
+++ b/contrib/ipfilter/ipl.h
@@ -1,17 +1,15 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ipl.h 1.21 6/5/96
- * $Id: ipl.h,v 2.15.2.17 2001/01/14 13:47:15 darrenr Exp $
+ * $Id: ipl.h,v 2.15.2.23 2001/07/23 13:52:10 darrenr Exp $
*/
#ifndef __IPL_H__
#define __IPL_H__
-#define IPL_VERSION "IP Filter: v3.4.16"
+#define IPL_VERSION "IP Filter: v3.4.20"
#endif
diff --git a/contrib/ipfilter/iplang/iplang.h b/contrib/ipfilter/iplang/iplang.h
index d8986c8d8b7d..f36a3843c0aa 100644
--- a/contrib/ipfilter/iplang/iplang.h
+++ b/contrib/ipfilter/iplang/iplang.h
@@ -1,9 +1,7 @@
/*
* Copyright (C) 1997-1998 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
typedef struct iface {
int if_MTU;
diff --git a/contrib/ipfilter/ipmon.c b/contrib/ipfilter/ipmon.c
index 9250e2457437..0ccc94765fa5 100644
--- a/contrib/ipfilter/ipmon.c
+++ b/contrib/ipfilter/ipmon.c
@@ -1,15 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 darrenr Exp $";
-#endif
-
#ifndef SOLARIS
#define SOLARIS (defined(__SVR4) || defined(__svr4__)) && defined(sun)
#endif
@@ -37,7 +30,9 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar
# include <sys/filio.h>
# include <sys/byteorder.h>
#endif
-#include <strings.h>
+#if !defined(__SVR4) && !defined(__GNUC__)
+# include <strings.h>
+#endif
#include <signal.h>
#include <stdlib.h>
#include <stddef.h>
@@ -70,6 +65,11 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar
#include "netinet/ip_nat.h"
#include "netinet/ip_state.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.13 2001/07/19 12:24:59 darrenr Exp $";
+#endif
+
#if defined(sun) && !defined(SOLARIS2)
#define STRERROR(x) sys_errlist[x]
@@ -121,6 +121,7 @@ static void print_statelog __P((FILE *, char *, int));
static void dumphex __P((FILE *, u_char *, int));
static int read_log __P((int, int *, char *, int));
static void write_pid __P((char *));
+static char *icmpname __P((u_int, u_int));
char *hostname __P((int, int, u_32_t *));
char *portname __P((int, char *, u_int));
@@ -133,7 +134,7 @@ static char *getproto __P((u_int));
static char **protocols = NULL;
static char **udp_ports = NULL;
static char **tcp_ports = NULL;
-
+static char *argv0 = "ipmon";
#define OPT_SYSLOG 0x001
#define OPT_RESOLVE 0x002
@@ -155,7 +156,49 @@ static char **tcp_ports = NULL;
#endif
-void handlehup(sig)
+#define ICMPUNREACHNAMES 14
+static char *icmpunreachnames[ICMPUNREACHNAMES] = {
+ "net",
+ "host",
+ "protocol",
+ "port",
+ "needfrag",
+ "srcfail",
+ "net_unknown",
+ "host_unknown",
+ "isolated",
+ "net_prohib",
+ "host_prohib",
+ "tosnet",
+ "toshost",
+ "admin_prohibit"
+};
+
+#define ICMPTYPES 19
+static char *icmptypes[ICMPTYPES] = {
+ "echoreply",
+ NULL,
+ NULL,
+ "unreach",
+ "sourcequench",
+ "redirect",
+ NULL,
+ NULL,
+ "echo",
+ "routeradvert",
+ "routersolicit",
+ "timxceed",
+ "paramprob",
+ "timestamp",
+ "timestampreply",
+ "inforeq",
+ "inforeply",
+ "maskreq",
+ "maskreply"
+};
+
+
+static void handlehup(sig)
int sig;
{
FILE *fp;
@@ -265,6 +308,8 @@ char *hostname(res, v, ip)
int res, v;
u_32_t *ip;
{
+# define MAX_INETA 16
+ static char hname[MAXHOSTNAMELEN + MAX_INETA + 3];
#ifdef USE_INET6
static char hostbuf[MAXHOSTNAMELEN+1];
#endif
@@ -278,8 +323,8 @@ u_32_t *ip;
hp = gethostbyaddr((char *)ip, sizeof(ip), AF_INET);
if (!hp)
return inet_ntoa(ipa);
- return hp->h_name;
-
+ sprintf(hname, "%.*s[%s]", MAXHOSTNAMELEN, hp->h_name, inet_ntoa(ipa));
+ return hname;
}
#ifdef USE_INET6
(void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1);
@@ -315,6 +360,67 @@ u_int port;
}
+#define TYPECODE(x,y) (((x) << 8) | (y))
+
+static char *icmpname(type, code)
+u_int type;
+u_int code;
+{
+ static char name[80];
+ char codeval[8], *s;
+ u_int typecode;
+
+ sprintf(codeval, "%d", code);
+
+ s = NULL;
+ if (type < ICMPTYPES)
+ s = icmptypes[type];
+ if (s == NULL)
+ sprintf(name, "icmptype(%d)/", type);
+ else
+ sprintf(name, "%s/", s);
+
+ if (type == ICMP_UNREACH) {
+ if (code >= ICMPUNREACHNAMES)
+ sprintf(name + strlen(name), "%d", code);
+ else
+ strcat(name, icmpunreachnames[code]);
+ } else {
+ typecode = (type << 8) | code;
+
+ switch (typecode)
+ {
+ case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_NET) :
+ strcat(name, "net");
+ break;
+ case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_HOST) :
+ strcat(name, "host");
+ break;
+ case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSNET) :
+ strcat(name, "tosnet");
+ break;
+ case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST) :
+ strcat(name, "toshost");
+ break;
+ case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS) :
+ strcat(name, "intrans");
+ break;
+ case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_REASS) :
+ strcat(name, "reass");
+ break;
+ case TYPECODE(ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT) :
+ strcat(name, "optabsent");
+ break;
+ default:
+ strcat(name, codeval);
+ break;
+ }
+ }
+
+ return name;
+}
+
+
static void dumphex(log, buf, len)
FILE *log;
u_char *buf;
@@ -739,9 +845,9 @@ int blen;
ic = (struct icmp *)((char *)ip + hl);
(void) sprintf(t, "%s -> ", hostname(res, v, s));
t += strlen(t);
- (void) sprintf(t, "%s PR icmp len %hu %hu icmp %d/%d",
+ (void) sprintf(t, "%s PR icmp len %hu %hu icmp %s",
hostname(res, v, d), hl, plen,
- ic->icmp_type, ic->icmp_code);
+ icmpname((u_int) ic->icmp_type, (u_int) ic->icmp_code));
if (ic->icmp_type == ICMP_UNREACH ||
ic->icmp_type == ICMP_SOURCEQUENCH ||
ic->icmp_type == ICMP_PARAMPROB ||
@@ -879,7 +985,7 @@ FILE *log;
if ((fd = open(file, O_RDWR)) == -1) {
(void) fprintf(stderr, "%s: open: %s\n", file,STRERROR(errno));
- exit(-1);
+ exit(1);
}
if (ioctl(fd, SIOCIPFFB, &flushed) == 0) {
@@ -942,7 +1048,7 @@ char *argv[];
int fd[3], doread, n, i;
int tr, nr, regular[3], c;
int fdt[3], devices = 0, make_daemon = 0;
- char buf[512], *iplfile[3], *s;
+ char buf[512], *iplfile[3];
extern int optind;
extern char *optarg;
@@ -952,6 +1058,12 @@ char *argv[];
iplfile[1] = IPNAT_NAME;
iplfile[2] = IPSTATE_NAME;
+ argv0 = strrchr(argv[0], '/');
+ if (argv0 == NULL)
+ argv0 = argv[0];
+ else
+ argv0++;
+
while ((c = getopt(argc, argv, "?abDf:FhnN:o:O:pP:sS:tvxX")) != -1)
switch (c)
{
@@ -1002,14 +1114,9 @@ char *argv[];
pidfile = optarg;
break;
case 's' :
- s = strrchr(argv[0], '/');
- if (s == NULL)
- s = argv[0];
- else
- s++;
- openlog(s, LOG_NDELAY|LOG_PID, LOGFAC);
- s = NULL;
+ openlog(argv0, LOG_NDELAY|LOG_PID, LOGFAC);
opts |= OPT_SYSLOG;
+ log = NULL;
break;
case 'S' :
opts |= OPT_STATE;
@@ -1031,7 +1138,7 @@ char *argv[];
default :
case 'h' :
case '?' :
- usage(argv[0]);
+ usage(argv0);
}
init_tabs();
@@ -1052,13 +1159,14 @@ char *argv[];
(void) fprintf(stderr,
"%s: open: %s\n", iplfile[i],
STRERROR(errno));
- exit(-1);
+ exit(1);
+ /* NOTREACHED */
}
-
if (fstat(fd[i], &sb) == -1) {
(void) fprintf(stderr, "%d: fstat: %s\n",fd[i],
STRERROR(errno));
- exit(-1);
+ exit(1);
+ /* NOTREACHED */
}
if (!(regular[i] = !S_ISCHR(sb.st_mode)))
devices++;
@@ -1069,25 +1177,36 @@ char *argv[];
logfile = argv[optind];
log = logfile ? fopen(logfile, "a") : stdout;
if (log == NULL) {
-
(void) fprintf(stderr, "%s: fopen: %s\n", argv[optind],
STRERROR(errno));
- exit(-1);
+ exit(1);
+ /* NOTREACHED */
}
setvbuf(log, NULL, _IONBF, 0);
} else
log = NULL;
if (make_daemon && ((log != stdout) || (opts & OPT_SYSLOG))) {
- if (fork() > 0)
+#if BSD
+ daemon(0, !(opts & OPT_SYSLOG));
+#else
+ int pid;
+ if ((pid = fork()) > 0)
exit(0);
- write_pid(pidfile);
+ if (pid < 0) {
+ (void) fprintf(stderr, "%s: fork() failed: %s\n", argv0,
+ STRERROR(errno));
+ exit(1);
+ /* NOTREACHED */
+ }
+ setsid();
+ if ((opts & OPT_SYSLOG))
+ close(2);
+#endif /* !BSD */
close(0);
close(1);
- close(2);
- setsid();
- } else
- write_pid(pidfile);
+ }
+ write_pid(pidfile);
signal(SIGHUP, handlehup);
@@ -1100,8 +1219,12 @@ char *argv[];
continue;
if (!regular[i]) {
if (ioctl(fd[i], FIONREAD, &tr) == -1) {
- perror("ioctl(FIONREAD)");
- exit(-1);
+ if (opts & OPT_SYSLOG)
+ syslog(LOG_CRIT, "ioctl(FIONREAD): %m");
+ else
+ perror("ioctl(FIONREAD)");
+ exit(1);
+ /* NOTREACHED */
}
} else {
tr = (lseek(fd[i], 0, SEEK_CUR) < sb.st_size);
@@ -1126,14 +1249,14 @@ char *argv[];
{
case -1 :
if (opts & OPT_SYSLOG)
- syslog(LOG_ERR, "read: %m\n");
+ syslog(LOG_CRIT, "read: %m\n");
else
perror("read");
doread = 0;
break;
case 1 :
if (opts & OPT_SYSLOG)
- syslog(LOG_ERR, "aborting logging\n");
+ syslog(LOG_CRIT, "aborting logging\n");
else
fprintf(log, "aborting logging\n");
doread = 0;
diff --git a/contrib/ipfilter/ipnat.c b/contrib/ipfilter/ipnat.c
index 51af2e10e8fe..b8cb37ee14b3 100644
--- a/contrib/ipfilter/ipnat.c
+++ b/contrib/ipfilter/ipnat.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
*/
@@ -57,7 +55,7 @@ extern char *sys_errlist[];
#if !defined(lint)
static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.5 2000/12/02 00:15:04 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.9 2001/07/18 15:06:33 darrenr Exp $";
#endif
@@ -110,10 +108,10 @@ int main(argc, argv)
int argc;
char *argv[];
{
- char *file = NULL;
int fd = -1, opts = 0, c, mode = O_RDWR;
+ char *file = NULL, *core = NULL;
- while ((c = getopt(argc, argv, "CdFf:hlnrsv")) != -1)
+ while ((c = getopt(argc, argv, "CdFf:hlM:nrsv")) != -1)
switch (c)
{
case 'C' :
@@ -135,6 +133,9 @@ char *argv[];
opts |= OPT_LIST;
mode = O_RDONLY;
break;
+ case 'M' :
+ core = optarg;
+ break;
case 'n' :
opts |= OPT_NODO;
mode = O_RDONLY;
@@ -153,6 +154,13 @@ char *argv[];
usage(argv[0]);
}
+ if (core != NULL) {
+ if (openkmem(core) == -1)
+ exit(1);
+ (void) setgid(getgid());
+ (void) setuid(getuid());
+ }
+
gethostname(thishost, sizeof(thishost));
thishost[sizeof(thishost) - 1] = '\0';
@@ -292,8 +300,10 @@ ipnat_t *ipnat;
void dostats(fd, opts)
int fd, opts;
{
+ hostmap_t hm, *hmp, **maptable;
natstat_t ns, *nsp = &ns;
nat_t **nt[2], *np, nat;
+ u_int hv, hv1, hv2;
ipnat_t ipn;
bzero((char *)&ns, sizeof(ns));
@@ -353,15 +363,21 @@ int fd, opts;
printf("\n\tage %lu use %hu sumd %s/",
nat.nat_age, nat.nat_use,
getsumd(nat.nat_sumd[0]));
+ hv1 = NAT_HASH_FN(nat.nat_inip.s_addr,
+ nat.nat_inport,
+ 0xffffffff),
+ hv1 = NAT_HASH_FN(nat.nat_oip.s_addr,
+ hv1 + nat.nat_oport,
+ NAT_TABLE_SZ),
+ hv2 = NAT_HASH_FN(nat.nat_outip.s_addr,
+ nat.nat_outport,
+ 0xffffffff),
+ hv2 = NAT_HASH_FN(nat.nat_oip.s_addr,
+ hv2 + nat.nat_oport,
+ NAT_TABLE_SZ),
printf("%s pr %u bkt %d/%d flags %x ",
getsumd(nat.nat_sumd[1]), nat.nat_p,
- (int)NAT_HASH_FN(nat.nat_inip.s_addr,
- nat.nat_inport,
- NAT_TABLE_SZ),
- (int)NAT_HASH_FN(nat.nat_outip.s_addr,
- nat.nat_outport,
- NAT_TABLE_SZ),
- nat.nat_flags);
+ hv1, hv2, nat.nat_flags);
#ifdef USE_QUAD_T
printf("bytes %qu pkts %qu",
(unsigned long long)nat.nat_bytes,
@@ -379,6 +395,38 @@ int fd, opts;
printaps(nat.nat_aps, opts);
}
+ if (opts & OPT_VERBOSE) {
+ printf("\nList of active host mappings:\n");
+
+ maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
+ ns.ns_hostmap_sz);
+ if (kmemcpy((char *)maptable, (u_long)ns.ns_maptable,
+ sizeof(hostmap_t *) * ns.ns_hostmap_sz)) {
+ perror("kmemcpy (maptable)");
+ return;
+ }
+
+ for (hv = 0; hv < ns.ns_hostmap_sz; hv++) {
+ hmp = maptable[hv];
+
+ while(hmp) {
+
+ if (kmemcpy((char *)&hm, (u_long)hmp,
+ sizeof(hostmap_t))) {
+ perror("kmemcpy (hostmap)");
+ return;
+ }
+
+ printf("%s -> ",
+ inet_ntoa(hm.hm_realip));
+ printf("%s ", inet_ntoa(hm.hm_mapip));
+ printf("(use = %d hv = %u)\n",
+ hm.hm_ref, hv);
+ hmp = hm.hm_next;
+ }
+ }
+ free(maptable);
+ }
free(nt[0]);
}
}
diff --git a/contrib/ipfilter/ipsd/ipsd.c b/contrib/ipfilter/ipsd/ipsd.c
index 4ed6d70e5147..261ad89985c1 100644
--- a/contrib/ipfilter/ipsd/ipsd.c
+++ b/contrib/ipfilter/ipsd/ipsd.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1995-1998 Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* The author of this software makes no garuntee about the
* performance of this package or its suitability to fulfill any purpose.
@@ -37,7 +35,7 @@
#ifndef lint
static const char sccsid[] = "@(#)ipsd.c 1.3 12/3/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1 1999/08/04 17:30:56 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $";
#endif
extern char *optarg;
diff --git a/contrib/ipfilter/ipsd/ipsd.h b/contrib/ipfilter/ipsd/ipsd.h
index 1dbe1c4caa67..a8f58c33f781 100644
--- a/contrib/ipfilter/ipsd/ipsd.h
+++ b/contrib/ipfilter/ipsd/ipsd.h
@@ -1,9 +1,7 @@
/*
* (C)opyright 1995-1998 Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* The author of this software makes no garuntee about the
* performance of this package or its suitability to fulfill any purpose.
diff --git a/contrib/ipfilter/ipsd/ipsdr.c b/contrib/ipfilter/ipsd/ipsdr.c
index 3b95ca083f55..298f655944c9 100644
--- a/contrib/ipfilter/ipsd/ipsdr.c
+++ b/contrib/ipfilter/ipsd/ipsdr.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1995-1998 Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* The author of this software makes no garuntee about the
* performance of this package or its suitability to fulfill any purpose.
@@ -38,7 +36,7 @@
#ifndef lint
static const char sccsid[] = "@(#)ipsdr.c 1.3 12/3/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1 1999/08/04 17:30:57 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $";
#endif
extern char *optarg;
diff --git a/contrib/ipfilter/ipsd/linux.h b/contrib/ipfilter/ipsd/linux.h
index 61f52b3ba13b..d9606cbba15d 100644
--- a/contrib/ipfilter/ipsd/linux.h
+++ b/contrib/ipfilter/ipsd/linux.h
@@ -1,9 +1,7 @@
/*
* Copyright (C) 1997-1998 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)linux.h 1.1 8/19/95
*/
diff --git a/contrib/ipfilter/ipsd/sbpf.c b/contrib/ipfilter/ipsd/sbpf.c
index 5d128c40f53f..97bb4ce0ff3a 100644
--- a/contrib/ipfilter/ipsd/sbpf.c
+++ b/contrib/ipfilter/ipsd/sbpf.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1995-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
*/
#include <stdio.h>
diff --git a/contrib/ipfilter/ipsd/sdlpi.c b/contrib/ipfilter/ipsd/sdlpi.c
index 9ec7b3f80a7c..c08fe6977988 100644
--- a/contrib/ipfilter/ipsd/sdlpi.c
+++ b/contrib/ipfilter/ipsd/sdlpi.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
*/
diff --git a/contrib/ipfilter/ipsd/slinux.c b/contrib/ipfilter/ipsd/slinux.c
index 5b2734b6e9e2..2c5aa97d2e2a 100644
--- a/contrib/ipfilter/ipsd/slinux.c
+++ b/contrib/ipfilter/ipsd/slinux.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* The author of this software makes no garuntee about the
* performance of this package or its suitability to fulfill any purpose.
diff --git a/contrib/ipfilter/ipsd/snit.c b/contrib/ipfilter/ipsd/snit.c
index 3f3aa500b116..ec7178f1f806 100644
--- a/contrib/ipfilter/ipsd/snit.c
+++ b/contrib/ipfilter/ipsd/snit.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* The author of this software makes no garuntee about the
* performance of this package or its suitability to fulfill any purpose.
diff --git a/contrib/ipfilter/ipsend/arp.c b/contrib/ipfilter/ipsend/arp.c
index e4159faf0378..898815acada8 100644
--- a/contrib/ipfilter/ipsend/arp.c
+++ b/contrib/ipfilter/ipsend/arp.c
@@ -1,14 +1,8 @@
/*
* arp.c (C) 1995-1998 Darren Reed
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Exp $";
-#endif
#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
@@ -30,6 +24,11 @@ static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Ex
#include "ipsend.h"
#include "iplang/iplang.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: arp.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $";
+#endif
+
/*
* lookup host and return
diff --git a/contrib/ipfilter/ipsend/hpux.c b/contrib/ipfilter/ipsend/hpux.c
index 42078e3b7f54..463fdbfdafff 100644
--- a/contrib/ipfilter/ipsend/hpux.c
+++ b/contrib/ipfilter/ipsend/hpux.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1997-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <strings.h>
diff --git a/contrib/ipfilter/ipsend/ip.c b/contrib/ipfilter/ipsend/ip.c
index c5eacb3ea622..db6d477956d5 100644
--- a/contrib/ipfilter/ipsend/ip.c
+++ b/contrib/ipfilter/ipsend/ip.c
@@ -1,14 +1,8 @@
/*
* ip.c (C) 1995-1998 Darren Reed
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "%W% %G% (C)1995";
-static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr Exp $";
-#endif
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
@@ -33,6 +27,10 @@ static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr
#endif
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "%W% %G% (C)1995";
+static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.3 2001/07/15 22:00:13 darrenr Exp $";
+#endif
static char *ipbuf = NULL, *ethbuf = NULL;
diff --git a/contrib/ipfilter/ipsend/ipresend.1 b/contrib/ipfilter/ipsend/ipresend.1
index ab9047154c26..6014313587b0 100644
--- a/contrib/ipfilter/ipsend/ipresend.1
+++ b/contrib/ipfilter/ipsend/ipresend.1
@@ -2,7 +2,7 @@
.SH NAME
ipresend \- resend IP packets out to network
.SH SYNOPSIS
-.B ipsend
+.B ipresend
[
.B \-EHPRSTX
] [
diff --git a/contrib/ipfilter/ipsend/ipresend.c b/contrib/ipfilter/ipsend/ipresend.c
index bad0f67343f8..4a4ec1cc966b 100644
--- a/contrib/ipfilter/ipsend/ipresend.c
+++ b/contrib/ipfilter/ipsend/ipresend.c
@@ -6,14 +6,8 @@
* conditions, enough of the TCP header is missing for unpredictable
* results unless the filter is aware that this can happen.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darrenr Exp $";
-#endif
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
@@ -34,6 +28,11 @@ static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darre
#endif
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $";
+#endif
+
extern char *optarg;
extern int optind;
diff --git a/contrib/ipfilter/ipsend/ipsend.c b/contrib/ipfilter/ipsend/ipsend.c
index 3dd39af7f788..74f624e4d76d 100644
--- a/contrib/ipfilter/ipsend/ipsend.c
+++ b/contrib/ipfilter/ipsend/ipsend.c
@@ -6,14 +6,8 @@
* conditions, enough of the TCP header is missing for unpredictable
* results unless the filter is aware that this can happen.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 darrenr Exp $";
-#endif
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
@@ -36,6 +30,11 @@ static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 dar
#include "ipsend.h"
#include "ipf.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.3 2001/07/15 22:00:14 darrenr Exp $";
+#endif
+
extern char *optarg;
extern int optind;
diff --git a/contrib/ipfilter/ipsend/ipsend.h b/contrib/ipfilter/ipsend/ipsend.h
index e2f8ff8472ee..71e5490c6ece 100644
--- a/contrib/ipfilter/ipsend/ipsend.h
+++ b/contrib/ipfilter/ipsend/ipsend.h
@@ -6,11 +6,7 @@
* conditions, enough of the TCP header is missing for unpredictable
* results unless the filter is aware that this can happen.
*
- * The author provides this program as-is, with no gaurantee for its
- * suitability for any specific purpose. The author takes no responsibility
- * for the misuse/abuse of this program and provides it for the sole purpose
- * of testing packet filter policies. This file maybe distributed freely
- * providing it is not modified and that this notice remains in tact.
+ * See the IPFILTER.LICENCE file for details on licencing.
*
*/
#ifndef __P
@@ -67,3 +63,9 @@ extern int kmemcpy __P((char *, void *, int));
#ifndef OPT_RAW
#define OPT_RAW 0x80000
#endif
+
+#ifndef __STDC__
+# ifndef const
+# define const
+# endif
+#endif
diff --git a/contrib/ipfilter/ipsend/ipsopt.c b/contrib/ipfilter/ipsend/ipsopt.c
index 2827c7797303..691ee7d69521 100644
--- a/contrib/ipfilter/ipsend/ipsopt.c
+++ b/contrib/ipfilter/ipsend/ipsopt.c
@@ -1,14 +1,8 @@
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr Exp $";
-#endif
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
@@ -25,13 +19,9 @@ static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr
#include <arpa/inet.h>
#include "ipsend.h"
-
-#ifndef __P
-# ifdef __STDC__
-# define __P(x) x
-# else
-# define __P(x) ()
-# endif
+#if !defined(lint)
+static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $";
#endif
diff --git a/contrib/ipfilter/ipsend/iptest.c b/contrib/ipfilter/ipsend/iptest.c
index dffee98d65f1..d4d37ba6707b 100644
--- a/contrib/ipfilter/ipsend/iptest.c
+++ b/contrib/ipfilter/ipsend/iptest.c
@@ -6,14 +6,8 @@
* conditions, enough of the TCP header is missing for unpredictable
* results unless the filter is aware that this can happen.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr Exp $";
-#endif
#include <stdio.h>
#include <netdb.h>
#include <unistd.h>
@@ -38,6 +32,11 @@ static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr
#endif
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2.2.2 2001/07/15 22:00:14 darrenr Exp $";
+#endif
+
extern char *optarg;
extern int optind;
diff --git a/contrib/ipfilter/ipsend/iptests.c b/contrib/ipfilter/ipsend/iptests.c
index 0eb263b9e8ee..a133e346fd05 100644
--- a/contrib/ipfilter/ipsend/iptests.c
+++ b/contrib/ipfilter/ipsend/iptests.c
@@ -1,14 +1,8 @@
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darrenr Exp $";
-#endif
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
@@ -80,6 +74,11 @@ static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darren
#endif
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $";
+#endif
+
#define PAUSE() tv.tv_sec = 0; tv.tv_usec = 10000; \
(void) select(0, NULL, NULL, NULL, &tv)
diff --git a/contrib/ipfilter/ipsend/larp.c b/contrib/ipfilter/ipsend/larp.c
index d64e70127312..d178d644895c 100644
--- a/contrib/ipfilter/ipsend/larp.c
+++ b/contrib/ipfilter/ipsend/larp.c
@@ -1,13 +1,11 @@
/*
* larp.c (C) 1995-1998 Darren Reed
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#if !defined(lint)
static const char sccsid[] = "@(#)larp.c 1.1 8/19/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: larp.c,v 2.1 1999/08/04 17:31:10 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: larp.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
#endif
#include <stdio.h>
#include <errno.h>
diff --git a/contrib/ipfilter/ipsend/linux.h b/contrib/ipfilter/ipsend/linux.h
index ae2e05f58264..2d2a243c4d96 100644
--- a/contrib/ipfilter/ipsend/linux.h
+++ b/contrib/ipfilter/ipsend/linux.h
@@ -1,9 +1,7 @@
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
- * This code may be freely distributed as long as it retains this notice
- * and is not changed in any way. The author accepts no responsibility
- * for the use of this software. I hate legaleese, don't you ?
+ * See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)linux.h 1.1 8/19/95
*/
diff --git a/contrib/ipfilter/ipsend/lsock.c b/contrib/ipfilter/ipsend/lsock.c
index a430e19903a4..058ab40e1895 100644
--- a/contrib/ipfilter/ipsend/lsock.c
+++ b/contrib/ipfilter/ipsend/lsock.c
@@ -1,13 +1,11 @@
/*
* lsock.c (C) 1995-1998 Darren Reed
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#if !defined(lint)
static const char sccsid[] = "@(#)lsock.c 1.2 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1 1999/08/04 17:31:11 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
#endif
#include <stdio.h>
#include <unistd.h>
diff --git a/contrib/ipfilter/ipsend/resend.c b/contrib/ipfilter/ipsend/resend.c
index 095aa9eb87f8..0d4102ce1e71 100644
--- a/contrib/ipfilter/ipsend/resend.c
+++ b/contrib/ipfilter/ipsend/resend.c
@@ -6,14 +6,8 @@
* conditions, enough of the TCP header is missing for unpredictable
* results unless the filter is aware that this can happen.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 darrenr Exp $";
-#endif
#include <stdio.h>
#include <netdb.h>
#include <string.h>
@@ -39,6 +33,12 @@ static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 dar
#endif
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $";
+#endif
+
+
extern int opts;
static u_char pbuf[65536]; /* 1 big packet */
diff --git a/contrib/ipfilter/ipsend/sbpf.c b/contrib/ipfilter/ipsend/sbpf.c
index f84deb9aaa52..5b8428c8486d 100644
--- a/contrib/ipfilter/ipsend/sbpf.c
+++ b/contrib/ipfilter/ipsend/sbpf.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1995-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <netdb.h>
@@ -43,7 +41,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)sbpf.c 1.3 8/25/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
#endif
/*
diff --git a/contrib/ipfilter/ipsend/sdlpi.c b/contrib/ipfilter/ipsend/sdlpi.c
index 3d797c1e33c5..dcd842211e03 100644
--- a/contrib/ipfilter/ipsend/sdlpi.c
+++ b/contrib/ipfilter/ipsend/sdlpi.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
@@ -40,7 +38,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)sdlpi.c 1.3 10/30/95 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1.4.2 2001/06/26 10:43:22 darrenr Exp $";
#endif
#define CHUNKSIZE 8192
@@ -58,7 +56,8 @@ int sport, tout;
char devname[16], *s, buf[256];
int i, fd;
- (void) sprintf(devname, "/dev/%s", device);
+ (void) strcpy(devname, "/dev/");
+ (void) strncat(devname, device, sizeof(devname) - strlen(devname));
s = devname + 5;
while (*s && !isdigit(*s))
diff --git a/contrib/ipfilter/ipsend/sirix.c b/contrib/ipfilter/ipsend/sirix.c
index 5317a9042b90..4178c0eaea94 100644
--- a/contrib/ipfilter/ipsend/sirix.c
+++ b/contrib/ipfilter/ipsend/sirix.c
@@ -2,9 +2,7 @@
* (C)opyright 1992-1998 Darren Reed.
* (C)opyright 1997 Marc Boucher.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <sys/types.h>
diff --git a/contrib/ipfilter/ipsend/slinux.c b/contrib/ipfilter/ipsend/slinux.c
index 353f3ad4fff3..7438d1c25cf9 100644
--- a/contrib/ipfilter/ipsend/slinux.c
+++ b/contrib/ipfilter/ipsend/slinux.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
@@ -29,7 +27,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)slinux.c 1.2 8/25/95";
-static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1 1999/08/04 17:31:14 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
#endif
#define CHUNKSIZE 8192
diff --git a/contrib/ipfilter/ipsend/snit.c b/contrib/ipfilter/ipsend/snit.c
index 40aaae5a1a4c..6f2c66269e2a 100644
--- a/contrib/ipfilter/ipsend/snit.c
+++ b/contrib/ipfilter/ipsend/snit.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
@@ -40,7 +38,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)snit.c 1.5 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: snit.c,v 2.1 1999/08/04 17:31:15 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: snit.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
#endif
#define CHUNKSIZE 8192
diff --git a/contrib/ipfilter/ipsend/sock.c b/contrib/ipfilter/ipsend/sock.c
index 2ee5028a7101..b20bf932dd0f 100644
--- a/contrib/ipfilter/ipsend/sock.c
+++ b/contrib/ipfilter/ipsend/sock.c
@@ -1,14 +1,8 @@
/*
* sock.c (C) 1995-1998 Darren Reed
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
-#if !defined(lint)
-static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darrenr Exp $";
-#endif
#include <stdio.h>
#include <unistd.h>
#include <string.h>
@@ -66,6 +60,12 @@ static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darre
#include <netinet/tcp_var.h>
#include "ipsend.h"
+#if !defined(lint)
+static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed";
+static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $";
+#endif
+
+
int nproc;
struct proc *proc;
diff --git a/contrib/ipfilter/ipsend/ultrix.c b/contrib/ipfilter/ipsend/ultrix.c
index ffab2cef9cba..f41a8a9a7481 100644
--- a/contrib/ipfilter/ipsend/ultrix.c
+++ b/contrib/ipfilter/ipsend/ultrix.c
@@ -1,9 +1,7 @@
/*
* (C)opyright 1998 Darren Reed. (from tcplog)
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <strings.h>
diff --git a/contrib/ipfilter/ipt.c b/contrib/ipfilter/ipt.c
index 34a35e953603..4749e38948a0 100644
--- a/contrib/ipfilter/ipt.c
+++ b/contrib/ipfilter/ipt.c
@@ -1,12 +1,16 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#ifdef __FreeBSD__
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
#endif
#include <stdio.h>
#include <assert.h>
@@ -55,7 +59,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6 2000/03/13 22:10:25 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6.2.2 2001/06/26 10:43:19 darrenr Exp $";
#endif
extern char *optarg;
diff --git a/contrib/ipfilter/ipt.h b/contrib/ipfilter/ipt.h
index bdc6a29f51ca..677c74aff7e3 100644
--- a/contrib/ipfilter/ipt.h
+++ b/contrib/ipfilter/ipt.h
@@ -1,10 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
- * $Id: ipt.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $
+ * See the IPFILTER.LICENCE file for details on licencing.
+ * $Id: ipt.h,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $
*/
#ifndef __IPT_H__
diff --git a/contrib/ipfilter/kmem.c b/contrib/ipfilter/kmem.c
index ab90bba9d2ba..3cad5a0531c1 100644
--- a/contrib/ipfilter/kmem.c
+++ b/contrib/ipfilter/kmem.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
* kmemcpy() - copies n bytes from kernel memory into user buffer.
@@ -18,16 +16,24 @@
#include <sys/file.h>
#include "kmem.h"
+#ifndef __STDC__
+# define const
+#endif
+
#if !defined(lint)
static const char sccsid[] = "@(#)kmem.c 1.4 1/12/96 (C) 1992 Darren Reed";
-static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2.2.3 2001/07/15 22:06:16 darrenr Exp $";
#endif
static int kmemfd = -1;
-int openkmem()
+int openkmem(core)
+char *core;
{
- if ((kmemfd = open(KMEM,O_RDONLY)) == -1)
+ if (core == NULL)
+ core = KMEM;
+
+ if ((kmemfd = open(core, O_RDONLY)) == -1)
{
perror("kmeminit:open");
return -1;
@@ -45,7 +51,7 @@ register int n;
if (!n)
return 0;
if (kmemfd == -1)
- if (openkmem() == -1)
+ if (openkmem(NULL) == -1)
return -1;
if (lseek(kmemfd, pos, 0) == -1)
{
@@ -76,7 +82,7 @@ register int n;
if (!n)
return 0;
if (kmemfd == -1)
- if (openkmem() == -1)
+ if (openkmem(NULL) == -1)
return -1;
if (lseek(kmemfd, pos, 0) == -1)
{
diff --git a/contrib/ipfilter/kmem.h b/contrib/ipfilter/kmem.h
index d6ed3c4e7592..08a6c5ecac95 100644
--- a/contrib/ipfilter/kmem.h
+++ b/contrib/ipfilter/kmem.h
@@ -1,10 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
- * $Id: kmem.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $
+ * See the IPFILTER.LICENCE file for details on licencing.
+ * $Id: kmem.h,v 2.2.2.2 2001/06/26 10:43:19 darrenr Exp $
*/
#ifndef __KMEM_H__
@@ -17,7 +15,7 @@
# define __P(x) ()
# endif
#endif
-extern int openkmem __P((void));
+extern int openkmem __P((char *));
extern int kmemcpy __P((char *, long, int));
extern int kstrncpy __P((char *, long, int));
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index 243edac80b48..c359703256d6 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -374,7 +374,7 @@ against, e.g.:
# packets with ONLY the SYN flag set.
... flags SA
- # becomes "flags SA/AUPRFS" and will match any
+ # becomes "flags SA/AUPRFSC" and will match any
# packet with only the SYN and ACK flags set.
... flags S/SA
diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4
index 26aa604e7e44..15f587bc83f4 100644
--- a/contrib/ipfilter/man/ipl.4
+++ b/contrib/ipfilter/man/ipl.4
@@ -76,4 +76,4 @@ ipf(4)
.SH BUGS
Packet headers are dropped when the internal buffer (static size) fills.
.SH FILES
-/dev/ipl0
+/dev/ipl
diff --git a/contrib/ipfilter/misc.c b/contrib/ipfilter/misc.c
index 38b385d5994b..df65e2c2839e 100644
--- a/contrib/ipfilter/misc.c
+++ b/contrib/ipfilter/misc.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#if (SOLARIS2 >= 7)
# define _SYS_VARARGS_H
@@ -52,7 +50,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)misc.c 1.3 2/4/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: misc.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: misc.c,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $";
#endif
extern int opts;
diff --git a/contrib/ipfilter/ml_ipl.c b/contrib/ipfilter/ml_ipl.c
index 0ee29cb55bfd..4db9a9b06722 100644
--- a/contrib/ipfilter/ml_ipl.c
+++ b/contrib/ipfilter/ml_ipl.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors. The author accepts no
+ * See the IPFILTER.LICENCE file for details on licencing.
* responsibility and is not changed in any way.
*
* I hate legaleese, don't you ?
diff --git a/contrib/ipfilter/mlf_ipl.c b/contrib/ipfilter/mlf_ipl.c
index 3ca7df328d70..50c2d94a34c6 100644
--- a/contrib/ipfilter/mlf_ipl.c
+++ b/contrib/ipfilter/mlf_ipl.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
@@ -13,12 +11,24 @@
#include <sys/param.h>
-#if defined(__FreeBSD__) && (__FreeBSD__ > 1)
+#if defined(__FreeBSD__)
# ifdef IPFILTER_LKM
-# include <osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <osreldate.h>
+# endif
+# endif
# define ACTUALLY_LKM_NOT_KERNEL
# else
-# include <sys/osreldate.h>
+# ifndef __FreeBSD_cc_version
+# include <sys/osreldate.h>
+# else
+# if __FreeBSD_cc_version < 430000
+# include <sys/osreldate.h>
+# endif
+# endif
# endif
#endif
#include <sys/systm.h>
@@ -53,19 +63,16 @@
#if (__FreeBSD_version >= 300000)
# include <sys/socket.h>
#endif
-#if (__FreeBSD_version >= 199511)
#include <net/if.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <net/route.h>
+#include <net/if.h>
#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/tcpip.h>
-#endif
-#if (__FreeBSD__ > 1)
-# include <sys/sysent.h>
-#endif
+#include <sys/sysent.h>
#include <sys/lkm.h>
#include "netinet/ipl.h"
#include "netinet/ip_compat.h"
@@ -392,7 +399,7 @@ int cmd, ver;
# endif
}
# endif /* IPFILTER_LKM */
-static ipl_devsw_installed = 0;
+static int ipl_devsw_installed = 0;
static void ipl_drvinit __P((void *unused))
{
diff --git a/contrib/ipfilter/mli_ipl.c b/contrib/ipfilter/mli_ipl.c
index a451a1092c0f..24120296070a 100644
--- a/contrib/ipfilter/mli_ipl.c
+++ b/contrib/ipfilter/mli_ipl.c
@@ -1,10 +1,8 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
* (C)opyright 1997 by Marc Boucher.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original authors and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/* TODO: (MARCXXX)
diff --git a/contrib/ipfilter/mln_ipl.c b/contrib/ipfilter/mln_ipl.c
index 777ca9f1d900..bda0f2e42cf9 100644
--- a/contrib/ipfilter/mln_ipl.c
+++ b/contrib/ipfilter/mln_ipl.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
diff --git a/contrib/ipfilter/mls_ipl.c b/contrib/ipfilter/mls_ipl.c
index 391b81446edd..bc8f3ed642ca 100644
--- a/contrib/ipfilter/mls_ipl.c
+++ b/contrib/ipfilter/mls_ipl.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/*
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
@@ -42,7 +40,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)mls_ipl.c 2.6 10/15/95 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $";
#endif
extern int ipldetach __P((void));
diff --git a/contrib/ipfilter/natparse.c b/contrib/ipfilter/natparse.c
index 9655615cfa50..f2377086084e 100644
--- a/contrib/ipfilter/natparse.c
+++ b/contrib/ipfilter/natparse.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <string.h>
@@ -54,7 +52,7 @@ extern char *sys_errlist[];
#if !defined(lint)
static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.6 2000/07/08 02:14:40 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.11 2001/07/17 14:33:09 darrenr Exp $";
#endif
@@ -160,6 +158,8 @@ void *ptr;
printf(" udp");
if (np->in_flags & IPN_ROUNDR)
printf(" round-robin");
+ if (np->in_flags & IPN_FRAG)
+ printf(" frag");
printf("\n");
if (opts & OPT_DEBUG)
printf("\t%p %lu %#x %u %p %d\n", np->in_ifp,
@@ -231,6 +231,8 @@ void *ptr;
ntohs(np->in_pmax));
}
}
+ if (np->in_flags & IPN_FRAG)
+ printf(" frag");
printf("\n");
if (opts & OPT_DEBUG) {
printf("\tifp %p space %lu nextip %s pnext %d",
@@ -277,6 +279,7 @@ int linenum;
char *s, *t, *cps[31], **cpp;
int i, cnt;
+ proto = NULL;
if ((s = strchr(line, '\n')))
*s = '\0';
@@ -553,7 +556,7 @@ int linenum;
} else
ipn.in_pmin = 0;
} else if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) {
- if (strrchr(*cpp, '/') != NULL) {
+ if (!*cpp || strrchr(*cpp, '/') != NULL) {
fprintf(stderr, "%d: No netmask supported in %s\n",
linenum, "destination host for redirect");
return NULL;
@@ -623,6 +626,11 @@ int linenum;
ipn.in_flags |= IPN_ROUNDR;
}
+ if (*cpp && !strcasecmp(*cpp, "frag")) {
+ cpp++;
+ ipn.in_flags |= IPN_FRAG;
+ }
+
if (*cpp) {
fprintf(stderr,
"%d: extra junk at the end of rdr: %s\n",
@@ -641,6 +649,11 @@ int linenum;
if ((ipn.in_redir & NAT_MAPBLK) != 0)
nat_setgroupmap(&ipn);
+ if (*cpp && !strcasecmp(*cpp, "frag")) {
+ cpp++;
+ ipn.in_flags |= IPN_FRAG;
+ }
+
if (!*cpp)
return &ipn;
diff --git a/contrib/ipfilter/opt.c b/contrib/ipfilter/opt.c
index ae153a1bb17f..e0dd125d9a8d 100644
--- a/contrib/ipfilter/opt.c
+++ b/contrib/ipfilter/opt.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <stdio.h>
#include <string.h>
@@ -27,7 +25,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)opt.c 1.8 4/10/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: opt.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: opt.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $";
#endif
extern int opts;
diff --git a/contrib/ipfilter/parse.c b/contrib/ipfilter/parse.c
index 0441ad53500c..56bc3fcb5f2b 100644
--- a/contrib/ipfilter/parse.c
+++ b/contrib/ipfilter/parse.c
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#include <sys/types.h>
#if !defined(__SVR4) && !defined(__svr4__)
@@ -394,7 +392,15 @@ int linenum;
linenum);
return NULL;
}
- if (**cpp == '!') {
+ if (!strcmp(*cpp, "!")) {
+ fil.fr_flags |= FR_NOTSRCIP;
+ if (!*++cpp) {
+ fprintf(stderr,
+ "%d: missing host after from\n",
+ linenum);
+ return NULL;
+ }
+ } else if (**cpp == '!') {
fil.fr_flags |= FR_NOTSRCIP;
(*cpp)++;
}
@@ -424,7 +430,15 @@ int linenum;
return NULL;
}
ch = 0;
- if (**cpp == '!') {
+ if (!strcmp(*cpp, "!")) {
+ fil.fr_flags |= FR_NOTDSTIP;
+ if (!*++cpp) {
+ fprintf(stderr,
+ "%d: missing host after from\n",
+ linenum);
+ return NULL;
+ }
+ } else if (**cpp == '!') {
fil.fr_flags |= FR_NOTDSTIP;
(*cpp)++;
}
diff --git a/contrib/ipfilter/pcap.h b/contrib/ipfilter/pcap.h
index 1a5338265051..aa2479811a89 100644
--- a/contrib/ipfilter/pcap.h
+++ b/contrib/ipfilter/pcap.h
@@ -1,10 +1,9 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
- * $Id: pcap.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $
+ * See the IPFILTER.LICENCE file for details on licencing.
+ *
+ * $Id: pcap.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $
*/
/*
* This header file is constructed to match the version described by
diff --git a/contrib/ipfilter/relay.c b/contrib/ipfilter/relay.c
index 59190864837b..58a44f0a17b5 100644
--- a/contrib/ipfilter/relay.c
+++ b/contrib/ipfilter/relay.c
@@ -107,7 +107,7 @@ char *argv[];
int fd, sl = sizeof(sl), se;
openlog(argv[0], LOG_PID|LOG_NDELAY, LOG_DAEMON);
- if ((fd = open("/dev/ipl", O_RDONLY)) == -1) {
+ if ((fd = open("/dev/ipnat", O_RDONLY)) == -1) {
se = errno;
perror("open");
errno = se;
@@ -115,6 +115,9 @@ char *argv[];
exit(-1);
}
+ bzero(&nl, sizeof(nl));
+ nl.nl_flags = IPN_TCP;
+
bzero(&sin, sizeof(sin));
sin.sin_family = AF_INET;
sl = sizeof(sin);
@@ -151,8 +154,8 @@ char *argv[];
exit(-1);
}
- sin.sin_port = nl.nl_inport;
- sin.sin_addr = nl.nl_inip;
+ sin.sin_port = nl.nl_realport;
+ sin.sin_addr = nl.nl_realip;
sl = sizeof(sin);
fd = socket(AF_INET, SOCK_STREAM, 0);
diff --git a/contrib/ipfilter/snoop.h b/contrib/ipfilter/snoop.h
index df800aec3ec9..2f6c305d22bc 100644
--- a/contrib/ipfilter/snoop.h
+++ b/contrib/ipfilter/snoop.h
@@ -1,9 +1,7 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
#ifndef __SNOOP_H__
@@ -11,7 +9,7 @@
/*
* written to comply with the RFC (1761) from Sun.
- * $Id: snoop.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $
+ * $Id: snoop.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $
*/
struct snoophdr {
char s_id[8];
diff --git a/contrib/ipfilter/solaris.c b/contrib/ipfilter/solaris.c
index 1e82ec0ba4c6..b526327b1f8c 100644
--- a/contrib/ipfilter/solaris.c
+++ b/contrib/ipfilter/solaris.c
@@ -1,12 +1,10 @@
/*
- * Copyright (C) 1993-2000 by Darren Reed.
+ * Copyright (C) 1993-2001 by Darren Reed.
*
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
+ * See the IPFILTER.LICENCE file for details on licencing.
*/
/* #pragma ident "@(#)solaris.c 1.12 6/5/96 (C) 1995 Darren Reed"*/
-#pragma ident "@(#)$Id: solaris.c,v 2.15.2.8 2000/11/27 10:28:41 darrenr Exp $"
+#pragma ident "@(#)$Id: solaris.c,v 2.15.2.20 2001/07/18 14:58:28 darrenr Exp $"
#include <sys/systm.h>
#include <sys/types.h>
@@ -147,7 +145,7 @@ static struct modlinkage modlink1 = { MODREV_1, &iplmod, NULL };
static size_t hdrsizes[57][2] = {
{ 0, 0 },
{ IFT_OTHER, 0 },
- { IFT_1822, 0 },
+ { IFT_1822, 14 }, /* 14 for ire0 ?? */
{ IFT_HDH1822, 0 },
{ IFT_X25DDN, 0 },
{ IFT_X25, 0 },
@@ -210,8 +208,6 @@ int _init()
{
int ipfinst;
- if (fr_running < 0)
- return -1;
ipfinst = mod_install(&modlink1);
#ifdef IPFDEBUG
cmn_err(CE_NOTE, "IP Filter: _init() = %d", ipfinst);
@@ -224,8 +220,6 @@ int _fini(void)
{
int ipfinst;
- if (fr_running < 0)
- return -1;
ipfinst = mod_remove(&modlink1);
#ifdef IPFDEBUG
cmn_err(CE_NOTE, "IP Filter: _fini() = %d", ipfinst);
@@ -239,8 +233,6 @@ struct modinfo *modinfop;
{
int ipfinst;
- if (fr_running < 0)
- return -1;
ipfinst = mod_info(&modlink1, modinfop);
#ifdef IPFDEBUG
cmn_err(CE_NOTE, "IP Filter: _info(%x) = %x", modinfop, ipfinst);
@@ -275,6 +267,31 @@ dev_info_t *dip;
}
+static void ipf_ire_walk(ire, arg)
+ire_t *ire;
+void *arg;
+{
+ qif_t *qif = arg;
+
+ if ((ire->ire_type == IRE_CACHE) &&
+#if SOLARIS2 >= 6
+ (ire->ire_ipif != NULL) &&
+ (ire->ire_ipif->ipif_ill == qif->qf_ill)
+#else
+ (ire_to_ill(ire) == qif->qf_ill)
+#endif
+ ) {
+#if SOLARIS2 >= 8
+ mblk_t *m = ire->ire_fp_mp;
+#else
+ mblk_t *m = ire->ire_ll_hdr_mp;
+#endif
+ if (m != NULL)
+ qif->qf_hl = m->b_wptr - m->b_rptr;
+ }
+}
+
+
static int ipf_attach(dip, cmd)
dev_info_t *dip;
ddi_attach_cmd_t cmd;
@@ -336,6 +353,14 @@ ddi_attach_cmd_t cmd;
drv_usectohz(500000));
if (fr_running == 1)
return DDI_SUCCESS;
+#if SOLARIS2 >= 8
+ case DDI_RESUME :
+ case DDI_PM_RESUME :
+ if (ipfr_timer_id == 0)
+ ipfr_timer_id = timeout(ipfr_slowtimer, NULL,
+ drv_usectohz(500000));
+ return DDI_SUCCESS;
+#endif
default:
return DDI_FAILURE;
}
@@ -403,6 +428,19 @@ ddi_detach_cmd_t cmd;
cmn_err(CE_CONT, "%s detached\n", ipfilter_version);
return (DDI_SUCCESS);
}
+#if SOLARIS2 >= 8
+ case DDI_SUSPEND :
+ case DDI_PM_SUSPEND :
+ if (ipfr_timer_id != 0) {
+ untimeout(ipfr_timer_id);
+ ipfr_timer_id = 0;
+ }
+ if (synctimeoutid) {
+ untimeout(synctimeoutid);
+ synctimeoutid = 0;
+ }
+ return DDI_SUCCESS;
+#endif
default:
return (DDI_FAILURE);
}
@@ -479,7 +517,7 @@ size_t off;
m = m->b_cont;
cmn_err(CE_CONT, " !IP %s:%d %d %p %p %p %d %p/%d %p/%d %p %d %d %p\n",
- qif ? qif->qf_name : "?", out, qif->qf_hl, q,
+ qif ? qif->qf_name : "?", out, qif ? qif->qf_hl : -1, q,
q ? q->q_ptr : NULL, q ? q->q_qinfo : NULL,
mt->b_wptr - mt->b_rptr, m, MTYPE(m), mt, MTYPE(mt), m->b_rptr,
m->b_wptr - m->b_rptr, off, ip);
@@ -529,8 +567,8 @@ int out;
{
register mblk_t *m, *mt = *mp;
register ip_t *ip;
- size_t hlen, len, off, mlen, iphlen, plen;
- int err, synced = 0, sap, p;
+ size_t hlen, len, off, off2, mlen, iphlen, plen, woff;
+ int err, synced = 0, sap, p, realigned = 0, multi = 0;
u_char *bp;
#if SOLARIS2 >= 8
ip6_t *ip6;
@@ -556,8 +594,21 @@ tryagain:
bp = (u_char *)ALIGN32(mt->b_rptr);
if (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO) {
dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp;
- if (dl->dl_primitive != DL_UNITDATA_IND &&
- dl->dl_primitive != DL_UNITDATA_REQ) {
+ if (dl->dl_primitive == DL_UNITDATA_IND) {
+ multi = dl->dl_group_address;
+ m = mt->b_cont;
+ /*
+ * This is a complete kludge to try and work around
+ * some bizarre packets which drop through into
+ * fr_donotip.
+ */
+ if (m && multi && ((*((u_char *)m->b_rptr) == 0x0) &&
+ ((*((u_char *)m->b_rptr + 2) == 0x45)))) {
+ ip = (ip_t *)(m->b_rptr + 2);
+ off = 2;
+ } else
+ off = 0;
+ } else if (dl->dl_primitive != DL_UNITDATA_REQ) {
ip = (ip_t *)dl;
if ((ip->ip_v == IPVERSION) &&
(ip->ip_hl == (sizeof(*ip) >> 2)) &&
@@ -584,19 +635,6 @@ tryagain:
return 0; /* No data blocks */
}
- /*
- * This is a complete kludge to try and work around some bizarre
- * packets which drop through into fr_donotip.
- */
- if ((mt != m) && (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO)) {
- dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp;
- if ((dl->dl_primitive == DL_UNITDATA_IND) &&
- (dl->dl_group_address == 1))
- if (((*((u_char *)m->b_rptr) == 0x0) &&
- ((*((u_char *)m->b_rptr + 2) == 0x45))))
- off += 2;
- }
-
ip = (ip_t *)(m->b_rptr + off); /* MMM */
/*
@@ -648,10 +686,13 @@ tryagain:
((char *)&tlen)[0] = ((char *)&ip6->ip6_plen)[0];
((char *)&tlen)[1] = ((char *)&ip6->ip6_plen)[1];
plen = ntohs(tlen);
- sap = IP6_DL_SAP;
+ if (!plen)
+ return -1; /* Jumbo gram */
+ plen += sizeof(*ip6);
}
#endif
else {
+ plen = 0;
hlen = 0;
sap = -1;
}
@@ -659,34 +700,77 @@ tryagain:
/*
* Ok, the IP header isn't on a 32bit aligned address so junk it.
*/
- if (((u_int)ip & 0x3) || (len < hlen) || (sap == -1)) {
- mblk_t *m2;
- u_char *s;
+ if (((u_long)ip & 0x3) || (plen > mlen) || (len < hlen) ||
+ (sap == -1)) {
+ mblk_t *m1, *m2;
+ u_char *s, c;
+ int v;
/*
* Junk using pullupmsg - it's next to useless.
*/
fixalign:
+ if (off)
+ m->b_rptr -= off;
+ c = *(u_char *)ip;
+ c >>= 4;
+ if (c != 4
+#if SOLARIS2 >= 8
+ && c != 6
+#endif
+ ) {
+ frstats[out].fr_notip++;
+ return (fr_flags & FF_BLOCKNONIP) ? -1 : 0;
+ }
+
+ if (realigned)
+ return -1;
+ realigned = 1;
+ off2 = (size_t)((u_long)ip & 0x3);
+ if (off2)
+ off2 = 4 - off2;
len = msgdsize(m);
- m2 = allocb(len, BPRI_HI);
+ m2 = allocb(len + off2, BPRI_HI);
if (m2 == NULL) {
frstats[out].fr_pull[1]++;
return -1;
}
+ MTYPE(m2) = M_DATA;
+ if (m->b_rptr != (u_char *)ip)
+ m2->b_rptr += off2;
m2->b_wptr = m2->b_rptr + len;
- s = (u_char *)ip;
- for (bp = m2->b_rptr; m; bp += len) {
- len = m->b_wptr - s;
- bcopy(m->b_rptr, bp, len);
- m = m->b_cont;
- if (m)
- s = m->b_rptr;
+ m1 = m;
+ s = (u_char *)m->b_rptr;
+ for (bp = m2->b_rptr; m1 && (bp < m2->b_wptr); bp += len) {
+ len = MIN(m1->b_wptr - s, m2->b_wptr - bp);
+ bcopy(s, bp, len);
+ m1 = m1->b_cont;
+ if (m1)
+ s = m1->b_rptr;
+ }
+
+ if (mt != m && mt->b_cont == m && !off) {
+ /*
+ * check if the buffer we're changing is chained in-
+ * between other buffers and unlink/relink as required.
+ */
+ (void) unlinkb(mt); /* should return 'm' */
+ m1 = unlinkb(m);
+ if (m1)
+ linkb(m2, m1);
+ freemsg(m);
+ linkb(mt, m2);
+ } else {
+ if (m == mt) {
+ m1 = unlinkb(mt);
+ if (m1)
+ linkb(m2, m1);
+ }
+ freemsg(mt);
+ *mp = m2;
+ mt = m2;
}
- *mp = m2;
- MTYPE(m2) = M_DATA;
- freemsg(mt);
- mt = m2;
frstats[out].fr_pull[0]++;
synced = 1;
@@ -714,7 +798,7 @@ fixalign:
#ifndef sparc
# if SOLARIS2 >= 8
if (sap == IP6_DL_SAP) {
- ip6->ip6_plen = plen;
+ ip6->ip6_plen = plen - sizeof(*ip6);
} else {
# endif
__ipoff = (u_short)ip->ip_off;
@@ -734,7 +818,7 @@ fixalign:
if ((
#if SOLARIS2 >= 8
- (sap == IP6_DL_SAP) && (mlen < iphlen + plen)) ||
+ (sap == IP6_DL_SAP) && (mlen < plen)) ||
((sap == 0) &&
#endif
((iphlen < hlen) || (iphlen > plen) || (mlen < plen)))) {
@@ -744,7 +828,7 @@ fixalign:
#ifndef sparc
# if SOLARIS2 >= 8
if (sap == IP6_DL_SAP) {
- ip6->ip6_plen = htons(plen);
+ ip6->ip6_plen = htons(plen - sizeof(*ip6));
} else {
# endif
__ipoff = (u_short)ip->ip_off;
@@ -790,15 +874,13 @@ fixalign:
break;
}
+ woff = 0;
if (hlen > mlen) {
hlen = mlen;
-#if SOLARIS2 >= 8
- } else if (sap == IP6_DL_SAP) {
- if (m->b_wptr - m->b_rptr > plen + hlen)
- m->b_wptr = m->b_rptr + plen + hlen;
-#endif
- } else if (m->b_wptr - m->b_rptr > plen)
- m->b_wptr = m->b_rptr + plen;
+ } else if (m->b_wptr - m->b_rptr > plen) {
+ woff = m->b_wptr - m->b_rptr - plen;
+ m->b_wptr -= woff;
+ }
/*
* If we don't have enough data in the mblk or we haven't yet copied
@@ -806,7 +888,7 @@ fixalign:
*/
if ((hlen > len)) {
if (!pullupmsg(m, (int)hlen)) {
- cmn_err(CE_NOTE, "pullupmsg failed\n");
+ cmn_err(CE_NOTE, "pullupmsg failed");
frstats[out].fr_pull[1]++;
return -1;
}
@@ -818,8 +900,9 @@ fixalign:
qif->qf_off = off;
qif->qf_len = len;
err = fr_check(ip, iphlen, qif->qf_ill, out, qif, mp);
- if (err == 2)
+ if (err == 2) {
goto fixalign;
+ }
/*
* Copy back the ip header data if it was changed, we haven't yet
* freed the message and we aren't going to drop the packet.
@@ -828,11 +911,12 @@ fixalign:
*/
if (*mp != NULL) {
if (*mp == mt) {
+ m->b_wptr += woff;
m->b_rptr -= off;
#ifndef sparc
# if SOLARIS2 >= 8
if (sap == IP6_DL_SAP) {
- ip6->ip6_plen = htons(plen);
+ ip6->ip6_plen = htons(plen - sizeof(*ip6));
} else {
# endif
__ipoff = (u_short)ip->ip_off;
@@ -847,13 +931,37 @@ fixalign:
#endif
} else
cmn_err(CE_NOTE,
- "!IP Filter: *mp %p mt %p %s\n", *mp, mt,
+ "!IP Filter: *mp %p mt %p %s", *mp, mt,
"mblk changed, cannot revert ip_len, ip_off");
}
return err;
}
+/*
+ * Only called for M_IOCACK messages
+ */
+void fr_qif_update(qif, mp)
+qif_t *qif;
+mblk_t *mp;
+{
+ struct iocblk *iocp;
+
+ if (!qif || !mp)
+ return;
+ iocp = (struct iocblk *)mp->b_rptr;
+ if (mp->b_cont && (iocp->ioc_cmd == DL_IOC_HDR_INFO)) {
+ mp = mp->b_cont;
+ if (MTYPE(mp) == M_PROTO && mp->b_cont) {
+ mp = mp->b_cont;
+ if (MTYPE(mp) == M_DATA) {
+ qif->qf_hl = mp->b_wptr - mp->b_rptr;
+ }
+ }
+ }
+}
+
+
int fr_qin(q, mb)
queue_t *q;
mblk_t *mb;
@@ -863,6 +971,7 @@ mblk_t *mb;
if (fr_running <= 0) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
@@ -871,6 +980,17 @@ mblk_t *mb;
mblk_t *m1;
m1 = copymsg(mb);
+ if (!m1) {
+ frstats[0].fr_drop++;
+ mb->b_next = NULL;
+ mb->b_prev = NULL;
+ freemsg(mb);
+ return 0;
+ }
+ m1->b_next = mb->b_next;
+ mb->b_next = NULL;
+ m1->b_prev = mb->b_prev;
+ mb->b_prev = NULL;
freemsg(mb);
mb = m1;
frstats[0].fr_copy++;
@@ -881,6 +1001,7 @@ again:
if (fr_running <= 0) {
RWLOCK_EXIT(&ipf_solaris);
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
@@ -925,17 +1046,21 @@ again:
frstats[0].fr_drop++;
RWLOCK_EXIT(&ipf_solaris);
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
- bcopy((char *)qif, (char *)&qf, sizeof(qf));
- qif = &qf;
- type = MTYPE(mb);
pnext = qif->qf_rqinfo->qi_putp;
+ type = MTYPE(mb);
+ if (type == M_IOCACK)
+ fr_qif_update(qif, mb);
+ else {
+ bcopy((char *)qif, (char *)&qf, sizeof(qf));
- if (datamsg(type) || (type == M_BREAK))
- err = fr_precheck(&mb, q, qif, 0);
+ if (datamsg(type) || (type == M_BREAK))
+ err = fr_precheck(&mb, q, &qf, 0);
+ }
RWLOCK_EXIT(&ipfs_mutex);
RWLOCK_EXIT(&ipf_solaris);
@@ -944,11 +1069,13 @@ again:
if (pnext)
return (*pnext)(q, mb);
- cmn_err(CE_WARN, "!IP Filter: inp NULL: qif %x q %x info %x",
- qif, q, q->q_qinfo);
+ cmn_err(CE_WARN,
+ "!IP Filter: inp NULL: qif %x %s q %x info %x",
+ &qf, qf.qf_name, q, q->q_qinfo);
}
if (mb) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
}
return 0;
@@ -964,14 +1091,32 @@ mblk_t *mb;
if (fr_running <= 0) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
- if (mb->b_datap->db_ref > 1) {
+#if SOLARIS2 >= 6
+ if ((!dohwcksum || mb->b_ick_flag != ICK_VALID) &&
+ (mb->b_datap->db_ref > 1))
+#else
+ if (mb->b_datap->db_ref > 1)
+#endif
+ {
mblk_t *m1;
m1 = copymsg(mb);
+ if (!m1) {
+ frstats[1].fr_drop++;
+ mb->b_next = NULL;
+ mb->b_prev = NULL;
+ freemsg(mb);
+ return 0;
+ }
+ m1->b_next = mb->b_next;
+ mb->b_next = NULL;
+ m1->b_prev = mb->b_prev;
+ mb->b_prev = NULL;
freemsg(mb);
mb = m1;
frstats[1].fr_copy++;
@@ -982,6 +1127,7 @@ again:
if (fr_running <= 0) {
RWLOCK_EXIT(&ipf_solaris);
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
@@ -998,7 +1144,7 @@ again:
synced = 1;
goto again;
}
- /* fr_donotip(0, NULL, q, mb, mb, NULL, 0); */
+ /* fr_donotip(1, NULL, q, mb, mb, NULL, 0); */
RWLOCK_EXIT(&ipf_solaris);
return (*pnext)(q, mb);
}
@@ -1036,17 +1182,21 @@ again:
frstats[1].fr_drop++;
RWLOCK_EXIT(&ipf_solaris);
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
- bcopy((char *)qif, (char *)&qf, sizeof(qf));
- qif = &qf;
- type = MTYPE(mb);
pnext = qif->qf_wqinfo->qi_putp;
+ type = MTYPE(mb);
+ if (type == M_IOCACK)
+ fr_qif_update(qif, mb);
+ else {
+ bcopy((char *)qif, (char *)&qf, sizeof(qf));
- if (datamsg(type) || (type == M_BREAK))
- err = fr_precheck(&mb, q, qif, 1);
+ if (datamsg(type) || (type == M_BREAK))
+ err = fr_precheck(&mb, q, &qf, 1);
+ }
RWLOCK_EXIT(&ipfs_mutex);
RWLOCK_EXIT(&ipf_solaris);
@@ -1057,10 +1207,11 @@ again:
cmn_err(CE_WARN,
"!IP Filter: outp NULL: qif %x %s q %x info %x",
- qif, qif->qf_name, q, q->q_qinfo);
+ &qf, qf.qf_name, q, q->q_qinfo);
}
if (mb) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
}
return 0;
@@ -1080,6 +1231,7 @@ void *arg;
RWLOCK_EXIT(&ipf_solaris);
}
+
static int ipf_ip_qin(q, mb)
queue_t *q;
mblk_t *mb;
@@ -1089,6 +1241,7 @@ mblk_t *mb;
if (fr_running <= 0) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
@@ -1100,18 +1253,24 @@ mblk_t *mb;
if (fr_running <= 0) {
RWLOCK_EXIT(&ipf_solaris);
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
return 0;
}
ioc = (struct iocblk *)mb->b_rptr;
- switch (ioc->ioc_cmd) {
+ switch (ioc->ioc_cmd)
+ {
+ case DL_IOC_HDR_INFO:
+ fr_qif_update(qif_from_queue(q), mb);
+ break;
case I_LINK:
case I_UNLINK:
case SIOCSIFADDR:
case SIOCSIFFLAGS:
#ifdef IPFDEBUG
- cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x\n", ioc->ioc_cmd);
+ cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x",
+ ioc->ioc_cmd);
#endif
WRITE_ENTER(&ipfs_mutex);
if (synctimeoutid == 0) {
@@ -1135,7 +1294,7 @@ extern struct streamtab ipinfo;
void solipdrvattach()
{
#ifdef IPFDEBUG
- cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx\n",
+ cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx",
ipdrvattcnt, &ipinfo);
#endif
@@ -1150,7 +1309,7 @@ void solipdrvattach()
int solipdrvdetach()
{
#ifdef IPFDEBUG
- cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx\n",
+ cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx",
ipdrvattcnt, &ipinfo);
#endif
@@ -1212,7 +1371,7 @@ void solattach()
KMALLOC(qif, qif_t *);
if (!qif) {
cmn_err(CE_WARN,
- "IP Filter: malloc(%d) for qif_t failed\n",
+ "IP Filter: malloc(%d) for qif_t failed",
sizeof(qif_t));
RWLOCK_EXIT(&ipfs_mutex);
continue;
@@ -1288,11 +1447,17 @@ void solattach()
(hdrsizes[il->ill_type][0] == il->ill_type))
qif->qf_hl = hdrsizes[il->ill_type][1];
- if (qif->qf_hl == 0)
+ if (qif->qf_hl == 0 && il->ill_type != IFT_OTHER)
cmn_err(CE_WARN,
- "Unknown layer 2 header size for %s type %d\n",
- qif->qf_name, il->ill_type);
+ "Unknown layer 2 header size for %s type %d",
+ il->ill_name, il->ill_type);
}
+
+ /*
+ * XXX Awful hack for PPP; fix when PPP/snoop fixed.
+ */
+ if (il->ill_type == IFT_ETHER && !il->ill_bcast_addr_length)
+ qif->qf_hl = 0;
#endif
strncpy(qif->qf_name, il->ill_name, sizeof(qif->qf_name));
qif->qf_name[sizeof(qif->qf_name) - 1] = '\0';
@@ -1377,6 +1542,7 @@ void solattach()
#endif
out->q_qinfo = &qif->qf_wqinit;
+ ire_walk(ipf_ire_walk, (char *)qif);
RWLOCK_EXIT(&ipfs_mutex);
cmn_err(CE_CONT, "IP Filter: attach to [%s,%d] - %s\n",
qif->qf_name, il->ill_ppa,
@@ -1634,7 +1800,7 @@ frdest_t *fdp;
* data, not the original, if and only if it is already pointing at
* the current mblk data.
*/
- if (ip == (ip_t *)qf->qf_m->b_rptr && qf->qf_m != mb)
+ if ((ip == (ip_t *)qf->qf_m->b_rptr) && (qf->qf_m != mb))
ip = (ip_t *)mb->b_rptr;
/*
@@ -1646,6 +1812,7 @@ frdest_t *fdp;
mp = (*mpp)->b_cont;
(*mpp)->b_cont = NULL;
(*mpp)->b_prev = NULL;
+ (*mpp)->b_next = NULL;
freemsg(*mpp);
*mpp = mp;
}
@@ -1666,7 +1833,7 @@ frdest_t *fdp;
if (!ir)
ir = (ire_t *)-1;
- fd.fd_ifp = (struct ifnet *)ir;
+ fd.fd_ifp = (struct ifnet *)ir;
fd.fd_ip = ip->ip_dst;
fdp = &fd;
}
@@ -1715,6 +1882,7 @@ frdest_t *fdp;
if (ifp == NULL)
goto bad_fastroute;
fr = fin->fin_fr;
+
/*
* In case we're here due to "to <if>" being used with
* "keep state", check that we're going in the correct
@@ -1722,7 +1890,7 @@ frdest_t *fdp;
*/
if ((fr != NULL) && (fdp->fd_ifp != NULL) &&
(fin->fin_rev != 0) && (fdp == &fr->fr_tif))
- return -1;
+ return 1;
fin->fin_ifp = ifp;
if (fin->fin_out == 0) {
@@ -1783,6 +1951,7 @@ frdest_t *fdp;
q = WR(ir->ire_rfq);
if (q) {
mb->b_prev = NULL;
+ mb->b_next = NULL;
mb->b_queue = q;
RWLOCK_EXIT(&ipfs_mutex);
RWLOCK_EXIT(&ipf_solaris);
@@ -1804,13 +1973,16 @@ frdest_t *fdp;
READ_ENTER(&ipf_solaris);
READ_ENTER(&ipfs_mutex);
ipl_frouteok[0]++;
+ *mpp = NULL;
return 0;
}
}
bad_fastroute:
mb->b_prev = NULL;
+ mb->b_next = NULL;
freemsg(mb);
ipl_frouteok[1]++;
+ *mpp = NULL;
return -1;
}
diff --git a/contrib/ipfilter/test/Makefile b/contrib/ipfilter/test/Makefile
index 0726cdd3863b..385c1dec9d55 100644
--- a/contrib/ipfilter/test/Makefile
+++ b/contrib/ipfilter/test/Makefile
@@ -15,7 +15,7 @@ first:
-mkdir -p results
# Filtering tests
-ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14
+ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14
# Rule parsing tests
ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11
@@ -28,7 +28,7 @@ ntests: n1 n2 n3 n4 n5 n6 n7
f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f14:
@/bin/sh ./dotest $@
-f12:
+f12 f13:
@/bin/sh ./hextest $@
i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11:
@@ -38,6 +38,6 @@ n1 n2 n3 n4 n5 n6 n7:
@/bin/sh ./nattest $@
clean:
- /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 results/*
+ /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f13 f12 f14 results/*
/bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11
/bin/rm -f n1 n2 n3 n4 n5 n6 n7
diff --git a/contrib/ipfilter/test/expected/i7 b/contrib/ipfilter/test/expected/i7
index d1b79788771f..db9cd0120bcb 100644
--- a/contrib/ipfilter/test/expected/i7
+++ b/contrib/ipfilter/test/expected/i7
@@ -1,4 +1,4 @@
pass in on ed0(!) proto tcp from 127.0.0.1/32 to 127.0.0.1/32 port = 23 flags S/SA
-block in on lo0(!) proto tcp from any to any flags A/0xbf
+block in on lo0(!) proto tcp from any to any flags A/FSRPAUC
pass in on lo0(!) proto tcp from any to any flags /SPA
-block in on lo0(!) proto tcp from any to any flags 0x80/A
+block in on lo0(!) proto tcp from any to any flags C/A
diff --git a/contrib/ipfilter/test/input/f13 b/contrib/ipfilter/test/input/f13
index 56ec16d99b83..b90d6bacdf6b 100644
--- a/contrib/ipfilter/test/input/f13
+++ b/contrib/ipfilter/test/input/f13
@@ -33,6 +33,10 @@
45 00 001c 0008 2000 3f 11 0000 01010101 02010101
0035003500040000
+# 1.1.1.1,1 -> 2.1.1.1,1 TTL=63 UDP MF FO=0 (short)
+45 00 0018 0008 2000 3f 11 0000 01010101 02010101
+00350036
+
# 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP FO=1
45 00 001c 0008 0001 3f 11 0000 01010101 02010101
0000000000000000