aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPeter Wemm <peter@FreeBSD.org>1997-03-02 15:50:35 +0000
committerPeter Wemm <peter@FreeBSD.org>1997-03-02 15:50:35 +0000
commit413e00145c3f486f87ed078f02b03545cc6aec9c (patch)
treeca11d3e65b58ac6ba4fc4209514e540b4acad5f0
parent3589f3628a5b767f1bfec12dfd5e1cdf1eaee79e (diff)
downloadsrc-413e00145c3f486f87ed078f02b03545cc6aec9c.tar.gz
src-413e00145c3f486f87ed078f02b03545cc6aec9c.zip
Import ipfilter 3.1.8 kernel componentsvendor/ipfilter-sys/ipfilter3_1_8
Notes
Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=23285 svn path=/vendor-sys/ipfilter/ipfilter3_1_8/; revision=23287; tag=vendor/ipfilter-sys/ipfilter3_1_8
-rw-r--r--sys/netinet/fil.c70
-rw-r--r--sys/netinet/ip_fil.c8
-rw-r--r--sys/netinet/ip_frag.c3
-rw-r--r--sys/netinet/ip_nat.c21
-rw-r--r--sys/netinet/ip_state.c8
5 files changed, 68 insertions, 42 deletions
diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index de776f9fc5c8..9f953614e42d 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed";
-static char rcsid[] = "$Id: fil.c,v 2.0.1.4 1997/02/04 13:59:41 darrenr Exp $";
+static char rcsid[] = "$Id: fil.c,v 2.0.1.7 1997/02/18 10:53:47 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -97,10 +97,19 @@ extern int ipl_unreach, ipllog();
# endif
#endif
+#ifndef IPF_LOGGING
+#define IPF_LOGGING 0
+#endif
+#ifdef IPF_DEFAULT_PASS
+#define IPF_NOMATCH (IPF_DEFAULT_PASS|FR_NOMATCH)
+#else
+#define IPF_NOMATCH (FR_NOMATCH)
+#endif
+
struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
*ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } };
-int fr_flags = 0, fr_active = 0;
+int fr_flags = IPF_LOGGING, fr_active = 0;
fr_info_t frcache[2];
@@ -573,16 +582,12 @@ int out;
frstats[out].fr_chit++;
pass = fin->fin_fr->fr_flags;
} else {
- pass = FR_NOMATCH;
+ pass = IPF_NOMATCH;
if ((fin->fin_fr = ipfilter[out][fr_active]))
- pass = FR_SCANLIST(FR_NOMATCH, ip, fin, m);
+ pass = FR_SCANLIST(IPF_NOMATCH, ip, fin, m);
bcopy((char *)fin, (char *)fc, FI_CSIZE);
- if (pass & FR_NOMATCH) {
+ if (pass & FR_NOMATCH)
frstats[out].fr_nom++;
-#ifdef NOMATCH
- pass |= NOMATCH;
-#endif
- }
}
fr = fin->fin_fr;
@@ -651,34 +656,40 @@ logit:
/*
* Should we return an ICMP packet to indicate error
* status passing through the packet filter ?
+ * WARNING: ICMP error packets AND TCP RST packets should
+ * ONLY be sent in repsonse to incoming packets. Sending them
+ * in response to outbound packets can result in a panic on
+ * some operating systems.
*/
+ if (!out) {
#ifdef _KERNEL
- if (pass & FR_RETICMP) {
+ if (pass & FR_RETICMP) {
# if SOLARIS
- ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
- qif, ip->ip_src);
+ ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
+ qif, ip->ip_src);
# else
- ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
- ifp, ip->ip_src);
- m = NULL; /* freed by icmp_error() */
+ ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
+ ifp, ip->ip_src);
+ m = *mp = NULL; /* freed by icmp_error() */
# endif
- frstats[0].fr_ret++;
- } else if ((pass & FR_RETRST) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
- if (SEND_RESET(ip, qif, q) == 0)
- frstats[1].fr_ret++;
- }
+ frstats[0].fr_ret++;
+ } else if ((pass & FR_RETRST) &&
+ !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if (SEND_RESET(ip, qif, q) == 0)
+ frstats[1].fr_ret++;
+ }
#else
- if (pass & FR_RETICMP) {
- verbose("- ICMP unreachable sent\n");
- frstats[0].fr_ret++;
- } else if ((pass & FR_RETRST) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
- verbose("- TCP RST sent\n");
- frstats[1].fr_ret++;
- }
+ if (pass & FR_RETICMP) {
+ verbose("- ICMP unreachable sent\n");
+ frstats[0].fr_ret++;
+ } else if ((pass & FR_RETRST) &&
+ !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ verbose("- TCP RST sent\n");
+ frstats[1].fr_ret++;
+ }
#endif
+ }
}
#ifdef _KERNEL
# if !SOLARIS
@@ -691,7 +702,6 @@ logit:
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
ipfr_fastroute(m, fin, fdp);
m = *mp = NULL;
- pass = 0;
}
if (mc)
ipfr_fastroute(mc, fin, &fr->fr_dif);
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index 7a244345640e..fec484670f4b 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.5 1997/01/29 13:41:45 darrenr Exp $";
+static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.7 1997/02/19 12:45:02 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -70,7 +70,7 @@ static int iplused = 0;
#endif /* IPFILTER_LOG */
static void frflush();
static int frrequest();
-static int (*fr_savep)();
+static int (*fr_savep)() = NULL;
#if _BSDI_VERSION >= 199501
# include <sys/device.h>
@@ -732,6 +732,9 @@ frdest_t *fdp;
dst = (struct sockaddr_in *)&ro->ro_dst;
dst->sin_family = AF_INET;
dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
+#ifdef __bsdi__
+ dst->sin_len = sizeof(*dst);
+#endif
#if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__)
# ifdef RTF_CLONING
rtalloc_ign(ro, RTF_CLONING);
@@ -780,7 +783,6 @@ frdest_t *fdp;
#if BSD >= 199306
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
ro->ro_rt);
-
#else
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
#endif
diff --git a/sys/netinet/ip_frag.c b/sys/netinet/ip_frag.c
index 6665404b9830..7ed97ceb56fd 100644
--- a/sys/netinet/ip_frag.c
+++ b/sys/netinet/ip_frag.c
@@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-1995 Darren Reed";
-static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.1 1997/01/09 15:14:43 darrenr Exp $";
+static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.2 1997/02/16 06:17:35 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@@ -127,7 +127,6 @@ int pass;
fr->ipfr_ttl = fr_ipfrttl;
fr->ipfr_pass = pass & ~(FR_LOGFIRST|FR_LOG);
fr->ipfr_off = (ip->ip_off & 0x1fff) + (fin->fin_dlen >> 3);
- *fp = fr;
ipfr_stats.ifs_new++;
ipfr_inuse++;
MUTEX_EXIT(&ipf_frag);
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index afe9761bc093..ee59a6cda1dd 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -9,7 +9,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.10 1997/02/08 06:38:49 darrenr Exp $";
+static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.11 1997/02/16 06:26:47 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@@ -155,12 +155,13 @@ int cmd, mode;
{
register ipnat_t *nat, *n = NULL, **np = NULL;
ipnat_t natd;
- int error = 0, ret;
+ int error = 0, ret, s;
/*
* For add/delete, look to see if the NAT entry is already present
*/
MUTEX_ENTER(&ipf_nat);
+ SPLNET(s);
if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
IRCOPY(data, (char *)&natd, sizeof(natd));
nat = &natd;
@@ -260,6 +261,7 @@ int cmd, mode;
IWCOPY((caddr_t)&ret, data, sizeof(ret));
break;
}
+ SPLX(s);
MUTEX_EXIT(&ipf_nat);
return error;
}
@@ -857,11 +859,13 @@ fr_info_t *fin;
*/
void ip_natunload()
{
- MUTEX_ENTER(&ipf_nat);
+ int s;
+ MUTEX_ENTER(&ipf_nat);
+ SPLNET(s);
(void) clear_natlist();
(void) flush_nattable();
-
+ SPLX(s)
MUTEX_EXIT(&ipf_nat);
}
@@ -873,14 +877,19 @@ void ip_natunload()
void ip_natexpire()
{
register struct nat *nat, **natp;
+ int s;
MUTEX_ENTER(&ipf_nat);
- for (natp = &nat_instances; (nat = *natp); natp = &nat->nat_next) {
- if (--nat->nat_age)
+ SPLNET(s);
+ for (natp = &nat_instances; (nat = *natp); ) {
+ if (--nat->nat_age) {
+ natp = &nat->nat_next;
continue;
+ }
*natp = nat->nat_next;
nat_delete(nat);
nat_stats.ns_expire++;
}
+ SPLX(s);
MUTEX_EXIT(&ipf_nat);
}
diff --git a/sys/netinet/ip_state.c b/sys/netinet/ip_state.c
index 62a49aa250ed..2643ce95a633 100644
--- a/sys/netinet/ip_state.c
+++ b/sys/netinet/ip_state.c
@@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed";
-static char rcsid[] = "$Id: ip_state.c,v 2.0.1.2 1997/01/09 15:22:45 darrenr Exp $";
+static char rcsid[] = "$Id: ip_state.c,v 2.0.1.3 1997/02/16 06:18:36 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@@ -411,13 +411,16 @@ void fr_stateunload()
{
register int i;
register ipstate_t *is, **isp;
+ int s;
MUTEX_ENTER(&ipf_state);
+ SPLNET(s);
for (i = 0; i < IPSTATE_SIZE; i++)
for (isp = &ips_table[i]; (is = *isp); ) {
*isp = is->is_next;
KFREE(is);
}
+ SPLX(s);
MUTEX_EXIT(&ipf_state);
}
@@ -430,8 +433,10 @@ void fr_timeoutstate()
{
register int i;
register ipstate_t *is, **isp;
+ int s;
MUTEX_ENTER(&ipf_state);
+ SPLNET(s);
for (i = 0; i < IPSTATE_SIZE; i++)
for (isp = &ips_table[i]; (is = *isp); )
if (is->is_age && !--is->is_age) {
@@ -444,6 +449,7 @@ void fr_timeoutstate()
ips_num--;
} else
isp = &is->is_next;
+ SPLX(s);
MUTEX_EXIT(&ipf_state);
}