aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--contrib/ipfilter/.cvsignore28
-rw-r--r--contrib/ipfilter/BSD/.cvsignore22
-rw-r--r--contrib/ipfilter/COMPILE.2.511
-rw-r--r--contrib/ipfilter/COMPILE.Solaris219
-rw-r--r--contrib/ipfilter/FWTK/FWTK.sed0
-rw-r--r--contrib/ipfilter/FWTK/fwtk-2.1-transparency.txt707
-rw-r--r--contrib/ipfilter/FWTK/tproxy.diff82
-rw-r--r--contrib/ipfilter/FreeBSD-4.0/INST.FreeBSD-424
-rwxr-xr-xcontrib/ipfilter/FreeBSD-4.0/ipv6-patch61
-rw-r--r--contrib/ipfilter/INSTALL.BSDOS35
-rw-r--r--contrib/ipfilter/INSTALL.BSDOS344
-rw-r--r--contrib/ipfilter/INSTALL.IRIX108
-rw-r--r--contrib/ipfilter/INSTALL.Linux50
-rw-r--r--contrib/ipfilter/INSTALL.NetBSD59
-rw-r--r--contrib/ipfilter/INSTALL.Sol228
-rw-r--r--contrib/ipfilter/INSTALL.SunOS40
-rw-r--r--contrib/ipfilter/LICENCE16
-rw-r--r--contrib/ipfilter/QNX_OCL.txt275
-rw-r--r--contrib/ipfilter/UPGRADE_NOTICE10
-rw-r--r--contrib/ipfilter/bpf.h450
-rwxr-xr-xcontrib/ipfilter/buildlinux16
-rwxr-xr-xcontrib/ipfilter/buildsunos168
-rw-r--r--contrib/ipfilter/common.c610
-rw-r--r--contrib/ipfilter/etc/etc.sed2
-rw-r--r--contrib/ipfilter/facpri.c151
-rw-r--r--contrib/ipfilter/facpri.h40
-rw-r--r--contrib/ipfilter/fil.c6209
-rw-r--r--contrib/ipfilter/fils.c1536
-rw-r--r--contrib/ipfilter/inet_addr.c199
-rw-r--r--contrib/ipfilter/ip_auth.c804
-rw-r--r--contrib/ipfilter/ip_auth.h66
-rw-r--r--contrib/ipfilter/ip_compat.h2295
-rw-r--r--contrib/ipfilter/ip_fil.h1368
-rw-r--r--contrib/ipfilter/ip_fil_freebsd.c1692
-rw-r--r--contrib/ipfilter/ip_frag.c858
-rw-r--r--contrib/ipfilter/ip_frag.h86
-rw-r--r--contrib/ipfilter/ip_ftp_pxy.c1454
-rw-r--r--contrib/ipfilter/ip_h323_pxy.c296
-rw-r--r--contrib/ipfilter/ip_htable.c455
-rw-r--r--contrib/ipfilter/ip_htable.h71
-rw-r--r--contrib/ipfilter/ip_ipsec_pxy.c343
-rw-r--r--contrib/ipfilter/ip_irc_pxy.c435
-rw-r--r--contrib/ipfilter/ip_lfil.c975
-rw-r--r--contrib/ipfilter/ip_log.c674
-rw-r--r--contrib/ipfilter/ip_lookup.c530
-rw-r--r--contrib/ipfilter/ip_lookup.h65
-rw-r--r--contrib/ipfilter/ip_msnrpc_pxy.c328
-rw-r--r--contrib/ipfilter/ip_nat.c4834
-rw-r--r--contrib/ipfilter/ip_nat.h477
-rw-r--r--contrib/ipfilter/ip_netbios_pxy.c122
-rw-r--r--contrib/ipfilter/ip_pool.c786
-rw-r--r--contrib/ipfilter/ip_pool.h87
-rw-r--r--contrib/ipfilter/ip_pptp_pxy.c527
-rw-r--r--contrib/ipfilter/ip_proxy.c854
-rw-r--r--contrib/ipfilter/ip_proxy.h453
-rw-r--r--contrib/ipfilter/ip_raudio_pxy.c338
-rw-r--r--contrib/ipfilter/ip_rcmd_pxy.c236
-rw-r--r--contrib/ipfilter/ip_rpcb_pxy.c1460
-rw-r--r--contrib/ipfilter/ip_scan.c594
-rw-r--r--contrib/ipfilter/ip_scan.h108
-rw-r--r--contrib/ipfilter/ip_sfil.c991
-rw-r--r--contrib/ipfilter/ip_state.c3802
-rw-r--r--contrib/ipfilter/ip_state.h261
-rw-r--r--contrib/ipfilter/ip_sync.c1001
-rw-r--r--contrib/ipfilter/ip_sync.h117
-rw-r--r--contrib/ipfilter/ipf.c764
-rw-r--r--contrib/ipfilter/ipfs.c859
-rw-r--r--contrib/ipfilter/ipft_ef.c155
-rw-r--r--contrib/ipfilter/ipft_hx.c173
-rw-r--r--contrib/ipfilter/ipft_pc.c275
-rw-r--r--contrib/ipfilter/ipft_sn.c219
-rw-r--r--contrib/ipfilter/ipft_td.c193
-rw-r--r--contrib/ipfilter/ipft_tx.c353
-rw-r--r--contrib/ipfilter/ipl.h19
-rw-r--r--contrib/ipfilter/ipl_ldev.c83
-rw-r--r--contrib/ipfilter/iplang/.cvsignore9
-rw-r--r--contrib/ipfilter/ipmon.c1493
-rw-r--r--contrib/ipfilter/ipnat.c433
-rw-r--r--contrib/ipfilter/ipsd/ip_compat.h201
-rw-r--r--contrib/ipfilter/ipsd/ipsd.sed0
-rw-r--r--contrib/ipfilter/ipsend/.OLD/ip_compat.h244
-rw-r--r--contrib/ipfilter/ipsend/.cvsignore3
-rw-r--r--contrib/ipfilter/ipsend/ip_compat.h242
-rw-r--r--contrib/ipfilter/ipsend/ipsend.sed3
-rw-r--r--contrib/ipfilter/ipsend/ultrix.c84
-rw-r--r--contrib/ipfilter/ipt.c551
-rw-r--r--contrib/ipfilter/kmem.c244
-rw-r--r--contrib/ipfilter/linux.h19
-rw-r--r--contrib/ipfilter/man/ipf.1109
-rw-r--r--contrib/ipfilter/man/ipnat.148
-rw-r--r--contrib/ipfilter/man/man.sed1
-rw-r--r--contrib/ipfilter/misc.c207
-rw-r--r--contrib/ipfilter/ml_ipl.c165
-rw-r--r--contrib/ipfilter/mlfk_ipl.c271
-rw-r--r--contrib/ipfilter/mlh_rule.c114
-rw-r--r--contrib/ipfilter/mli_ipl.c596
-rw-r--r--contrib/ipfilter/mln_ipl.c295
-rw-r--r--contrib/ipfilter/mls_ipl.c213
-rw-r--r--contrib/ipfilter/natparse.c902
-rw-r--r--contrib/ipfilter/net/.cvsignore1
-rw-r--r--contrib/ipfilter/opt.c179
-rw-r--r--contrib/ipfilter/opt_inet6.h1
-rw-r--r--contrib/ipfilter/parse.c1510
-rw-r--r--contrib/ipfilter/pcap.h34
-rw-r--r--contrib/ipfilter/printnat.c487
-rw-r--r--contrib/ipfilter/printstate.c151
-rw-r--r--contrib/ipfilter/relay.c227
-rw-r--r--contrib/ipfilter/rules/.cvsignore1
-rw-r--r--contrib/ipfilter/rules/rules.sed5
-rw-r--r--contrib/ipfilter/samples/.cvsignore4
-rw-r--r--contrib/ipfilter/solaris.c2131
-rw-r--r--contrib/ipfilter/test/.cvsignore87
-rw-r--r--contrib/ipfilter/test/expected/116
-rw-r--r--contrib/ipfilter/test/expected/10108
-rw-r--r--contrib/ipfilter/test/expected/1166
-rw-r--r--contrib/ipfilter/test/expected/1254
-rw-r--r--contrib/ipfilter/test/expected/1440
-rw-r--r--contrib/ipfilter/test/expected/236
-rw-r--r--contrib/ipfilter/test/expected/340
-rw-r--r--contrib/ipfilter/test/expected/440
-rw-r--r--contrib/ipfilter/test/expected/51344
-rw-r--r--contrib/ipfilter/test/expected/61344
-rw-r--r--contrib/ipfilter/test/expected/754
-rw-r--r--contrib/ipfilter/test/expected/836
-rw-r--r--contrib/ipfilter/test/expected/9108
-rw-r--r--contrib/ipfilter/test/expected/expected.sed0
-rw-r--r--contrib/ipfilter/test/input/14
-rw-r--r--contrib/ipfilter/test/input/106
-rw-r--r--contrib/ipfilter/test/input/1111
-rw-r--r--contrib/ipfilter/test/input/1235
-rw-r--r--contrib/ipfilter/test/input/1339
-rw-r--r--contrib/ipfilter/test/input/145
-rw-r--r--contrib/ipfilter/test/input/26
-rw-r--r--contrib/ipfilter/test/input/35
-rw-r--r--contrib/ipfilter/test/input/45
-rw-r--r--contrib/ipfilter/test/input/528
-rw-r--r--contrib/ipfilter/test/input/628
-rw-r--r--contrib/ipfilter/test/input/79
-rw-r--r--contrib/ipfilter/test/input/86
-rw-r--r--contrib/ipfilter/test/input/96
-rw-r--r--contrib/ipfilter/test/input/input.sed0
-rw-r--r--contrib/ipfilter/test/input/ipf6-126
-rw-r--r--contrib/ipfilter/test/regress/14
-rw-r--r--contrib/ipfilter/test/regress/1018
-rw-r--r--contrib/ipfilter/test/regress/116
-rw-r--r--contrib/ipfilter/test/regress/126
-rw-r--r--contrib/ipfilter/test/regress/136
-rw-r--r--contrib/ipfilter/test/regress/148
-rw-r--r--contrib/ipfilter/test/regress/26
-rw-r--r--contrib/ipfilter/test/regress/38
-rw-r--r--contrib/ipfilter/test/regress/48
-rw-r--r--contrib/ipfilter/test/regress/548
-rw-r--r--contrib/ipfilter/test/regress/648
-rw-r--r--contrib/ipfilter/test/regress/76
-rw-r--r--contrib/ipfilter/test/regress/86
-rw-r--r--contrib/ipfilter/test/regress/918
-rw-r--r--contrib/ipfilter/test/regress/ipf6-13
-rw-r--r--contrib/ipfilter/test/regress/regress.sed0
-rw-r--r--contrib/ipfilter/test/test.sed6
159 files changed, 0 insertions, 58911 deletions
diff --git a/contrib/ipfilter/.cvsignore b/contrib/ipfilter/.cvsignore
deleted file mode 100644
index 616828f4144d..000000000000
--- a/contrib/ipfilter/.cvsignore
+++ /dev/null
@@ -1,28 +0,0 @@
-ipf
-sparcv7
-sparcv9
-h
-ipf-darren
-bugs
-ipftest
-patches
-state
-cbits
-CVS
-old
-new
-netinet
-import
-bak
-streams
-cvs.diff
-threads
-glibc
-hp
-windows
-ipnat
-opt_inet6.h
-ippool
-ipmon
-ip_rules.c
-ip_rules.h
diff --git a/contrib/ipfilter/BSD/.cvsignore b/contrib/ipfilter/BSD/.cvsignore
deleted file mode 100644
index c149a0043f45..000000000000
--- a/contrib/ipfilter/BSD/.cvsignore
+++ /dev/null
@@ -1,22 +0,0 @@
-ipf
-ipfs
-ipfstat
-ipftest
-ipmon
-ipnat
-ipresend
-ipsend
-iptest
-vnode_if.h
-if_ipl
-i386
-amiga
-FreeBSD*
-BSDOS*
-NetBSD*
-OpenBSD*
-*_lex_var.h
-*_y.c
-*_l.c
-*_y.h
-ip_rules.*
diff --git a/contrib/ipfilter/COMPILE.2.5 b/contrib/ipfilter/COMPILE.2.5
deleted file mode 100644
index ae550f896e49..000000000000
--- a/contrib/ipfilter/COMPILE.2.5
+++ /dev/null
@@ -1,11 +0,0 @@
-
-If you get the following error whilst compiling:
-
-In file included from /usr/local/lib/gcc-lib/sparc-sun-solaris2.3/2.6.3/include/sys/user.h:48,
- from /usr/include/sys/file.h:15,
- from ../ip_nat.c:15:
-/usr/include/sys/psw.h:19: #error Kernel include of psw.h
-
-Remove (comment out) the line in
-/usr/local/lib/gcc-lib/sparc-sun-solaris2.3/2.6.3include/sys/user.h
-which includes psw.h
diff --git a/contrib/ipfilter/COMPILE.Solaris2 b/contrib/ipfilter/COMPILE.Solaris2
deleted file mode 100644
index 45442c5a4051..000000000000
--- a/contrib/ipfilter/COMPILE.Solaris2
+++ /dev/null
@@ -1,19 +0,0 @@
-If you have BOTH GNU make and the normal make shipped with your system,
-DO NOT use the GNU make to build this package. If you have any errors
-relating to "(" or "TOP", check that you are using /usr/ccs/bin/make as
-shipped with Solaris 2.
-
-If you get the following error whilst compiling:
-
-In file included from /usr/local/lib/gcc-lib/sparc-sun-solaris2.3/2.6.3/include/sys/user.h:48,
- from /usr/include/sys/file.h:15,
- from ../ip_nat.c:15:
-/usr/include/sys/psw.h:19: #error Kernel include of psw.h
-
-That means that you have a version of gcc build under on older release
-of Solaris 2.x
-
-You need to reinstall gcc after each Solaris upgrade; gcc creates its own
-set of modified system include files which are only valid for the exact
-release on which gcc was build.
-
diff --git a/contrib/ipfilter/FWTK/FWTK.sed b/contrib/ipfilter/FWTK/FWTK.sed
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/contrib/ipfilter/FWTK/FWTK.sed
+++ /dev/null
diff --git a/contrib/ipfilter/FWTK/fwtk-2.1-transparency.txt b/contrib/ipfilter/FWTK/fwtk-2.1-transparency.txt
deleted file mode 100644
index 2e719383f32b..000000000000
--- a/contrib/ipfilter/FWTK/fwtk-2.1-transparency.txt
+++ /dev/null
@@ -1,707 +0,0 @@
-diff -c -r ./ftp-gw/ftp-gw.c ../../fwtk-2.1-violated/fwtk/ftp-gw/ftp-gw.c
-*** ./ftp-gw/ftp-gw.c Thu Feb 5 19:05:43 1998
---- ../../fwtk-2.1-violated/fwtk/ftp-gw/ftp-gw.c Thu May 21 17:36:09 1998
-***************
-*** 44,49 ****
---- 44,51 ----
-
- extern char *optarg;
-
-+ char *getdsthost();
-+
- #include "firewall.h"
-
-
-***************
-*** 88,93 ****
---- 90,97 ----
- static int cmdcnt = 0;
- static int timeout = PROXY_TIMEOUT;
-
-+ static int do_transparent = 0;
-+
-
- static int cmd_user();
- static int cmd_authorize();
-***************
-*** 101,106 ****
---- 105,111 ----
- static int cmd_passthru();
- static void saveline();
- static void flushsaved();
-+ static int connectdest();
-
- #define OP_CONN 001 /* only valid if connected */
- #define OP_WCON 002 /* writethrough if connected */
-***************
-*** 173,178 ****
---- 178,184 ----
- char xuf[1024];
- char huf[512];
- char *passuser = (char *)0; /* passed user as av */
-+ char *psychic, *hotline;
-
- #ifndef LOG_DAEMON
- openlog("ftp-gw",LOG_PID);
-***************
-*** 317,322 ****
---- 323,332 ----
- } else
- timeout = PROXY_TIMEOUT;
-
-+ psychic = getdsthost(0, NULL);
-+ if (psychic)
-+ do_transparent++;
-+
- /* display a welcome file or message */
- if(passuser == (char *)0) {
- if((cf = cfg_get("welcome-msg",confp)) != (Cfg *)0) {
-***************
-*** 324,329 ****
---- 334,345 ----
- syslog(LLEV,"fwtkcfgerr: welcome-msg must have one parameter, line %d",cf->ln);
- exit(1);
- }
-+ if (do_transparent) {
-+ if (sayfile2(0, cf->argv[0], 220)) {
-+ syslog(LLEV,"fwtksyserr: cannot display welcome %.512s: %m",cf->argv[0]);
-+ exit(1);
-+ }
-+ } else
- if(sayfile(0,cf->argv[0],220)) {
- syslog(LLEV,"fwtksyserr: cannot display welcome %.512s: %m",cf->argv[0]);
- exit(1);
-***************
-*** 336,341 ****
---- 352,360 ----
- if(say(0,"220-Proxy first requires authentication"))
- exit(1);
-
-+ if (do_transparent)
-+ sprintf(xuf, "220-%s FTP proxy (Version %s) ready.",huf, FWTK_VERSION_MINOR);
-+ else
- sprintf(xuf, "220 %s FTP proxy (Version %s) ready.",huf, FWTK_VERSION_MINOR);
- if(say(0,xuf))
- exit(1);
-***************
-*** 357,362 ****
---- 376,384 ----
- exit(1);
- }
-
-+ if (do_transparent)
-+ connectdest(psychic, 21);
-+
- /* main loop */
- while(1) {
- FD_ZERO(&rdy);
-***************
-*** 653,658 ****
---- 675,696 ----
- return(sayn(0,noad,sizeof(noad)-1));
- }
-
-+ if (do_transparent) {
-+ if((rfd == (-1)) && (x = connectdest(dest,port)))
-+ return x;
-+
-+ sprintf(buf,"USER %s",user);
-+
-+ if (say(rfd, buf))
-+ return(1);
-+
-+ x = getresp(rfd, buf, sizeof(buf), 1);
-+ if (sendsaved(0, x))
-+ return(1);
-+
-+ return(say(0, buf));
-+ }
-+
- if(*dest == '\0')
- dest = "localhost";
-
-***************
-*** 694,705 ****
- char ebuf[512];
-
- strcpy(ebuf,buf);
-! sprintf(buf,"521 %s: %s",dest,ebuf);
- rfd = -1;
- return(say(0,buf));
- }
-! sprintf(buf,"----GATEWAY CONNECTED TO %s----",dest);
-! saveline(buf);
-
- /* we are now connected and need to try the autologin thing */
- x = getresp(rfd,buf,sizeof(buf),1);
---- 732,748 ----
- char ebuf[512];
-
- strcpy(ebuf,buf);
-! if (do_transparent)
-! sprintf(buf, "521 %s,%d: %s", dest, ntohs(port), ebuf);
-! else
-! sprintf(buf,"521 %s: %s",dest,ebuf);
- rfd = -1;
- return(say(0,buf));
- }
-! if (!do_transparent) {
-! sprintf(buf,"----GATEWAY CONNECTED TO %s----",dest);
-! saveline(buf);
-! }
-
- /* we are now connected and need to try the autologin thing */
- x = getresp(rfd,buf,sizeof(buf),1);
-***************
-*** 1889,1891 ****
---- 1932,2050 ----
- dup(nread);
- }
- #endif
-+
-+ static int connectdest(dest, port)
-+ char *dest;
-+ short port;
-+ {
-+ char buf[1024], mbuf[512];
-+ int msg_int, x;
-+
-+ if(*dest == '\0')
-+ dest = "localhost";
-+
-+ if(validests != (char **)0) {
-+ char **xp;
-+ int x;
-+
-+ for(xp = validests; *xp != (char *)0; xp++) {
-+ if(**xp == '!' && hostmatch(*xp + 1,dest)) {
-+ return(baddest(0,dest));
-+ } else {
-+ if(hostmatch(*xp,dest))
-+ break;
-+ }
-+ }
-+ if(*xp == (char *)0)
-+ return(baddest(0,dest));
-+ }
-+
-+ /* Extended permissions processing goes in here for destination */
-+ if(extendperm) {
-+ msg_int = auth_perm(confp, authuser, "ftp-gw", dest,(char *)0);
-+ if(msg_int == 1) {
-+ sprintf(mbuf,"Permission denied for user %s to connect to %s",authuser,dest);
-+ syslog(LLEV,"deny host=%s/%s connect to %s user=%s",rladdr,riaddr,dest,authuser);
-+ say(0,mbuf);
-+ return(1);
-+ } else {
-+ if(msg_int == -1) {
-+ sprintf(mbuf,"No match in netperm-table for %s to ftp to %s",authuser,dest);
-+ say(0,mbuf);
-+ return(1);
-+ }
-+ }
-+ }
-+
-+ syslog(LLEV,"permit host=%s/%s connect to %s",rladdr,riaddr,dest);
-+
-+ if((rfd = conn_server(dest,port,0,buf)) < 0) {
-+ char ebuf[512];
-+
-+ strcpy(ebuf,buf);
-+ if (do_transparent)
-+ sprintf(buf,"521 %s,%d: %s",dest,ntohs(port),ebuf);
-+ else
-+ sprintf(buf,"521 %s: %s",dest,ebuf);
-+ rfd = -1;
-+ return(say(0,buf));
-+ }
-+ if (!do_transparent) {
-+ sprintf(buf,"----GATEWAY CONNECTED TO %s----",dest);
-+ saveline(buf);
-+ }
-+
-+ /* we are now connected and need to try the autologin thing */
-+ x = getresp(rfd,buf,sizeof(buf),1);
-+ if(x / 100 != COMPLETE) {
-+ sendsaved(0,-1);
-+ return(say(0,buf));
-+ }
-+ saveline(buf);
-+
-+ sendsaved(0,-1);
-+ return 0;
-+ }
-+
-+ /* quick hack */
-+ sayfile2(fd,fn,code)
-+ int fd;
-+ char *fn;
-+ int code;
-+ {
-+ FILE *f;
-+ char buf[BUFSIZ];
-+ char yuf[BUFSIZ];
-+ char *c;
-+ int x;
-+ int saidsomething = 0;
-+
-+ if((f = fopen(fn,"r")) == (FILE *)0)
-+ return(1);
-+ while(fgets(buf,sizeof(buf),f) != (char *)0) {
-+ if((c = index(buf,'\n')) != (char *)0)
-+ *c = '\0';
-+ x = fgetc(f);
-+ if(feof(f))
-+ sprintf(yuf,"%3.3d-%s",code,buf);
-+ else {
-+ sprintf(yuf,"%3.3d-%s",code,buf);
-+ ungetc(x,f);
-+ }
-+ if(say(fd,yuf)) {
-+ fclose(f);
-+ return(1);
-+ }
-+ saidsomething++;
-+ }
-+ fclose(f);
-+ if (!saidsomething) {
-+ syslog(LLEV,"fwtkcfgerr: sayfile for %d is empty",code);
-+ sprintf(yuf, "%3.3d The file to display is empty",code);
-+ if(say(fd,yuf)) {
-+ fclose(f);
-+ return(1);
-+ }
-+ }
-+ return(0);
-+ }
-diff -c -r ./http-gw/http-gw.c ../../fwtk-2.1-violated/fwtk/http-gw/http-gw.c
-*** ./http-gw/http-gw.c Fri Feb 6 18:32:25 1998
---- ../../fwtk-2.1-violated/fwtk/http-gw/http-gw.c Thu May 21 17:00:47 1998
-***************
-*** 27,32 ****
---- 27,35 ----
- static char http_buffer[8192];
- static char reason[8192];
- static int checkBrowserType = 1;
-+ static int do_transparent = 0;
-+
-+ char * getdsthost();
-
- static void do_logging()
- { char *proto = "GOPHER";
-***************
-*** 473,478 ****
---- 476,490 ----
- /*(NOT A SPECIAL FORM)*/
-
- if((rem_type & TYPE_LOCAL)== 0){
-+ char * psychic = getdsthost(sockfd, &def_port);
-+ if (psychic) {
-+ if (strlen(psychic) <= MAXHOSTNAMELEN) {
-+ do_transparent ++;
-+ strncpy(def_httpd, psychic, strlen(psychic));
-+ strncpy(def_server, psychic, strlen(psychic));
-+ }
-+ }
-+
- /* See if it can be forwarded */
-
- if( can_forward(buf)){
-***************
-*** 1564,1570 ****
- parse_vec[0],
- parse_vec[1],
- ourname, ourport);
-! }else{
- sprintf(new_reply,"%s\tgopher://%s:%s/%c%s\t%s\t%u",
- parse_vec[0], parse_vec[2],
- parse_vec[3], chk_type_ch,
---- 1576,1589 ----
- parse_vec[0],
- parse_vec[1],
- ourname, ourport);
-! }
-! else
-! if (do_transparent) {
-! sprintf(new_reply, "%s\t%s\t%s\t%s",
-! parse_vec[0], parse_vec[1],
-! parse_vec[2],parse_vec[3]);
-! }
-! else {
- sprintf(new_reply,"%s\tgopher://%s:%s/%c%s\t%s\t%u",
- parse_vec[0], parse_vec[2],
- parse_vec[3], chk_type_ch,
-diff -c -r ./lib/hnam.c ../../fwtk-2.1-violated/fwtk/lib/hnam.c
-*** ./lib/hnam.c Tue Dec 10 13:08:48 1996
---- ../../fwtk-2.1-violated/fwtk/lib/hnam.c Thu May 21 17:10:00 1998
-***************
-*** 23,28 ****
---- 23,33 ----
-
- #include "firewall.h"
-
-+ #ifdef __FreeBSD__ /* or OpenBSD, NetBSD, BSDI, etc. Fix this for your system. */
-+ #include <net/if.h>
-+ #include "ip_nat.h"
-+ #endif /* __FreeBSD__ */
-+
-
- char *
- maphostname(name)
-***************
-*** 49,52 ****
---- 54,132 ----
- }
- bcopy(hp->h_addr,&sin.sin_addr,hp->h_length);
- return(inet_ntoa(sin.sin_addr));
-+ }
-+
-+ char *getdsthost(fd, ptr)
-+ int fd;
-+ int *ptr;
-+ {
-+ struct sockaddr_in sin;
-+ struct hostent * hp;
-+ int sl = sizeof(struct sockaddr_in), err = 0, local_h = 0, i = 0;
-+ char buf[255], hostbuf[255];
-+ #ifdef __FreeBSD__
-+ struct sockaddr_in rsin;
-+ struct natlookup natlookup;
-+ #endif
-+
-+ #ifdef linux
-+ if (!(err = getsockname(0, &sin, &sl))) {
-+ if(ptr)
-+ * ptr = ntohs(sin.sin_port);
-+
-+ sprintf(buf, "%s", inet_ntoa(sin.sin_addr));
-+ gethostname(hostbuf, 254);
-+ hp = gethostbyname(hostbuf);
-+ while (hp->h_addr_list[i]) {
-+ bzero(&sin, &sl);
-+ memcpy(&sin.sin_addr, hp->h_addr_list[i++],
-+ sizeof(hp->h_addr_list[i++]));
-+
-+ if (!strcmp(buf, inet_ntoa(sin.sin_addr)))
-+ local_h++;
-+ }
-+
-+ if(local_h)
-+ return(NULL);
-+ else
-+ return(buf);
-+ }
-+ #endif
-+
-+ #ifdef __FreeBSD__
-+ /* The basis for this block of code is Darren Reed's
-+ * patches to the TIS ftwk's ftp-gw.
-+ */
-+ bzero((char*)&sin, sizeof(sin));
-+ bzero((char*)&rsin, sizeof(rsin));
-+
-+ if (getsockname(fd, (struct sockaddr*)&sin, &sl) < 0)
-+ return NULL;
-+
-+ sl = sizeof(rsin);
-+
-+ if(getpeername(fd, (struct sockaddr*)&rsin, &sl) < 0)
-+ return NULL;
-+
-+ natlookup.nl_inport=sin.sin_port;
-+ natlookup.nl_outport=rsin.sin_port;
-+ natlookup.nl_inip=sin.sin_addr;
-+ natlookup.nl_outip=rsin.sin_addr;
-+
-+ if ((natfd = open("/dev/ipl",O_RDONLY)) < 0)
-+ return NULL;
-+
-+ if (ioctl(natfd, SIOCGNATL,&natlookup) == (-1))
-+ return NULL;
-+
-+ close(natfd);
-+
-+ if (ptr)
-+ *ptr = ntohs(natlookup.nl_inport);
-+
-+ sprintf(buf, "%s", inet_ntoa(natlookup.nl_inip));
-+ #endif
-+
-+ /* No transparent proxy support */
-+ return(NULL);
- }
-diff -c -r ./plug-gw/plug-gw.c ../../fwtk-2.1-violated/fwtk/plug-gw/plug-gw.c
-*** ./plug-gw/plug-gw.c Thu Feb 5 19:07:35 1998
---- ../../fwtk-2.1-violated/fwtk/plug-gw/plug-gw.c Thu May 21 17:29:01 1998
-***************
-*** 43,48 ****
---- 43,50 ----
- static char **validdests = (char **)0;
- static int net_write();
-
-+ static int do_transparent = 0;
-+
- main(ac,av)
- int ac;
- char *av[];
-***************
-*** 198,206 ****
---- 200,220 ----
- char *ptr;
- int state = 0;
- int ssl_plug = 0;
-+ char * getdsthost();
-+ int pport = 0;
-
- struct timeval timo;
-
-+ /* Transparent plug-gw is probably a bad idea, but then, plug-gw is a bad
-+ * idea ..
-+ */
-+ dhost = getdsthost(0, &pport);
-+ if (dhost) {
-+ do_transparent++;
-+ portid = pport;
-+ }
-+
-+
- if(c->flags & PERM_DENY) {
- if (p == -1)
- syslog(LLEV,"deny host=%.512s/%.20s port=any",rhost,raddr);
-***************
-*** 220,226 ****
- syslog(LLEV,"fwtkcfgerr: -plug-to takes an argument, line %d",c->ln);
- exit (1);
- }
-! dhost = av[x];
- continue;
- }
-
---- 234,241 ----
- syslog(LLEV,"fwtkcfgerr: -plug-to takes an argument, line %d",c->ln);
- exit (1);
- }
-! if (!dhost)
-! dhost = av[x];
- continue;
- }
-
-diff -c -r ./rlogin-gw/rlogin-gw.c ../../fwtk-2.1-violated/fwtk/rlogin-gw/rlogin-gw.c
-*** ./rlogin-gw/rlogin-gw.c Thu Feb 5 19:08:38 1998
---- ../../fwtk-2.1-violated/fwtk/rlogin-gw/rlogin-gw.c Thu May 21 17:20:25 1998
-***************
-*** 103,108 ****
---- 103,111 ----
- static int trusted = 0;
- static int doX = 0;
- static char *prompt;
-+ static int do_transparent = 0;
-+
-+ char * getdsthost();
-
- main(ac,av)
- int ac;
-***************
-*** 123,128 ****
---- 126,132 ----
- static char *tokav[56];
- int tokac;
- struct timeval timo;
-+ char * psychic;
-
- #ifndef LOG_NDELAY
- openlog("rlogin-gw",LOG_PID);
-***************
-*** 188,194 ****
- xforwarder = cf->argv[0];
- }
-
-!
-
- if((cf = cfg_get("directory",confp)) != (Cfg *)0) {
- if(cf->argc != 1) {
---- 192,203 ----
- xforwarder = cf->argv[0];
- }
-
-! psychic = getdsthost(0, NULL);
-! if (psychic) {
-! do_transparent++;
-! strncpy(dest, psychic, 511);
-! dest[511] = '\0';
-! }
-
- if((cf = cfg_get("directory",confp)) != (Cfg *)0) {
- if(cf->argc != 1) {
-***************
-*** 266,271 ****
---- 275,281 ----
- if((p = index(rusername,'@')) != (char *)0) {
- char *namp;
-
-+ dest[0] = '\0';
- *p++ = '\0';
- if(*p == '\0')
- p = "localhost";
-***************
-*** 297,302 ****
---- 307,326 ----
-
- if(dest[0] != '\0') {
- /* Setup connection directly to remote machine */
-+ if ((cf = cfg_get("welcome-msg",confp)) != (Cfg *)0) {
-+ if (cf->argc != 1) {
-+ syslog(LLEV,"fwtkcfgerr: welcome-msg must have one parameter, line %d",cf->ln);
-+ exit(1);
-+ }
-+
-+ if (sayfile(0, cf->argv[0])) {
-+ syslog(LLEV,"fwtksyserr: cannot display welcome %s: %m",cf->argv[0]);
-+ exit(1);
-+ }
-+ }
-+
-+ /* Hey fwtk developer people -- this connect_dest thing is *nasty!* */
-+
- sprintf(buf,"connect %.1000s",dest);
- tokac = enargv(buf, tokav, 56, tokbuf, sizeof(tokbuf));
- if (cmd_connect(tokac, tokav, buf) != 2)
-***************
-*** 535,548 ****
- char ebuf[512];
-
- syslog(LLEV,"permit host=%.512s/%.20s connect to %.512s",rhost,raddr,namp);
-! if(strlen(namp) > 20)
-! namp[20] = '\0';
-! if(rusername[0] != '\0')
-! sprintf(ebuf,"Trying %s@%s...",rusername,namp);
-! else
-! sprintf(ebuf,"Trying %s...",namp);
-! if(say(0,ebuf))
-! return(1);
- } else
- syslog(LLEV,"permit host=%.512s/%.20s connect to %.512s",rhost,raddr,av[1]);
- if((serfd = conn_server(av[1],RLOGINPORT,1,buf)) < 0) {
---- 559,574 ----
- char ebuf[512];
-
- syslog(LLEV,"permit host=%.512s/%.20s connect to %.512s",rhost,raddr,namp);
-! if (!do_transparent) {
-! if(strlen(namp) > 20)
-! namp[20] = '\0';
-! if(rusername[0] != '\0')
-! sprintf(ebuf,"Trying %s@%s...",rusername,namp);
-! else
-! sprintf(ebuf,"Trying %s...",namp);
-! if(say(0,ebuf))
-! return(1);
-! }
- } else
- syslog(LLEV,"permit host=%.512s/%.20s connect to %.512s",rhost,raddr,av[1]);
- if((serfd = conn_server(av[1],RLOGINPORT,1,buf)) < 0) {
-diff -c -r ./tn-gw/tn-gw.c ../../fwtk-2.1-violated/fwtk/tn-gw/tn-gw.c
-*** ./tn-gw/tn-gw.c Thu Feb 5 19:11:36 1998
---- ../../fwtk-2.1-violated/fwtk/tn-gw/tn-gw.c Thu May 21 17:25:06 1998
-***************
-*** 91,96 ****
---- 91,100 ----
- static int cmd_xforward();
- static int cmd_timeout();
-
-+ char * getdsthost();
-+
-+ static int do_transparent = 0;
-+
- static int tn3270 = 1; /* don't do tn3270 stuff */
- static int doX;
-
-***************
-*** 144,149 ****
---- 148,155 ----
- char tokbuf[BSIZ];
- char *tokav[56];
- int tokac;
-+ int port;
-+ char * psychic;
-
- #ifndef LOG_DAEMON
- openlog("tn-gw",LOG_PID);
-***************
-*** 325,330 ****
---- 331,362 ----
- }
- }
-
-+ psychic = getdsthost(0, &port);
-+ if (psychic) {
-+ if ((strlen(psychic) + 10) < 510) {
-+ do_transparent++;
-+ if (port)
-+ sprintf(dest, "%s:%d", psychic, port);
-+ else
-+ sprintf(dest, "%s", psychic);
-+
-+ if (!welcomedone)
-+ if ((cf = cfg_get("welcome-msg", confp)) != (Cfg *)0) {
-+ if (cf->argc != 1) {
-+ syslog(LLEV,"fwtkcfgerr: welcome-msg must have one parameter, line %d",cf->ln);
-+ exit(1);
-+ }
-+
-+ if (sayfile(0, cf->argv[0])) {
-+ syslog(LLEV,"fwtksyserr: cannot display welcome %s:%m",cf->argv[0]);
-+ exit(1);
-+ }
-+
-+ welcomedone = 1;
-+ }
-+ }
-+ }
-+
- while (argc > 1) {
- argc--;
- argv++;
-***************
-*** 947,955 ****
- char ebuf[512];
-
- syslog(LLEV,"permit host=%.512s/%.20s destination=%.512s",rladdr,riaddr,namp);
-! sprintf(ebuf,"Trying %.100s port %d...",namp,port);
-! if(say(0,ebuf))
-! return(1);
- } else
- syslog(LLEV,"permit host=%.512s/%.20s destination=%.512s",rladdr,riaddr,av[1]);
-
---- 979,989 ----
- char ebuf[512];
-
- syslog(LLEV,"permit host=%.512s/%.20s destination=%.512s",rladdr,riaddr,namp);
-! if (!do_transparent) {
-! sprintf(ebuf,"Trying %.100s port %d...",namp,port);
-! if(say(0,ebuf))
-! return(1);
-! }
- } else
- syslog(LLEV,"permit host=%.512s/%.20s destination=%.512s",rladdr,riaddr,av[1]);
-
-***************
-*** 991,998 ****
-
- syslog(LLEV,"connected host=%.512s/%.20s destination=%.512s",rladdr,riaddr,av[1]);
- strncpy(dest,av[1], 511);
-! sprintf(buf, "Connected to %.512s.", dest);
-! say(0, buf);
- return(2);
- }
-
---- 1025,1034 ----
-
- syslog(LLEV,"connected host=%.512s/%.20s destination=%.512s",rladdr,riaddr,av[1]);
- strncpy(dest,av[1], 511);
-! if (!do_transparent) {
-! sprintf(buf, "Connected to %.512s.", dest);
-! say(0, buf);
-! }
- return(2);
- }
-
diff --git a/contrib/ipfilter/FWTK/tproxy.diff b/contrib/ipfilter/FWTK/tproxy.diff
deleted file mode 100644
index 234404bf2364..000000000000
--- a/contrib/ipfilter/FWTK/tproxy.diff
+++ /dev/null
@@ -1,82 +0,0 @@
-*** tproxy.c.orig Fri Dec 20 10:53:24 1996
---- tproxy.c Sun Jan 3 11:33:55 1999
-***************
-*** 135,140 ****
---- 135,144 ----
- #include <netinet/in.h>
- #include <sys/signal.h>
- #include <syslog.h>
-+ #include <unistd.h>
-+ #include <fcntl.h>
-+ #include <sys/ioctl.h>
-+ #include <net/if.h>
- #include "tproxy.h"
-
- #ifdef AIX
-***************
-*** 147,152 ****
---- 151,159 ----
- #define bzero(buf,size) memset(buf, '\0', size);
- #endif /* SYSV */
-
-+ #include "ip_compat.h"
-+ #include "ip_fil.h"
-+ #include "ip_nat.h"
-
-
- /* socket to audio server */
-***************
-*** 324,329 ****
---- 331,369 ----
- char localbuf[2048];
- void timeout();
- extern int errno;
-+ /*
-+ * IP-Filter block
-+ */
-+ struct sockaddr_in laddr, faddr;
-+ struct natlookup natlookup;
-+ int slen, natfd;
-+
-+ bzero((char *)&laddr, sizeof(laddr));
-+ bzero((char *)&faddr, sizeof(faddr));
-+ slen = sizeof(laddr);
-+ if (getsockname(0, (struct sockaddr *)&laddr, &slen) < 0)
-+ return -1;
-+ slen = sizeof(faddr);
-+ if (getpeername(0, (struct sockaddr *)&faddr, &slen) < 0)
-+ return -1;
-+ natlookup.nl_inport = laddr.sin_port;
-+ natlookup.nl_outport = faddr.sin_port;
-+ natlookup.nl_inip = laddr.sin_addr;
-+ natlookup.nl_outip = faddr.sin_addr;
-+ natlookup.nl_flags = IPN_TCP;
-+ if ((natfd = open(IPL_NAT, O_RDONLY)) < 0)
-+ return -1;
-+ if (ioctl(natfd, SIOCGNATL, &natlookup) == -1) {
-+ syslog(LOG_ERR, "SIOCGNATL failed: %m\n");
-+ close(natfd);
-+ return -1;
-+ }
-+ close(natfd);
-+ strcpy(hostname, inet_ntoa(natlookup.nl_realip));
-+ serverport = ntohs(natlookup.nl_realport);
-+ /*
-+ * End of IP-Filter block
-+ */
-
- /* setup a timeout in case dialog doesn't finish */
- signal(SIGALRM, timeout);
-***************
-*** 337,344 ****
---- 377,386 ----
- * and modify the call to (and subroutine) serverconnect() as
- * appropriate.
- */
-+ #if 0
- strcpy(hostname, "randomhostname");
- serverport = 7070;
-+ #endif
- /* Can we connect to the server */
- if ( (serverfd = serverconnect(hostname, serverport)) < 0 ) {
- /* errno may still be set from previous call */
diff --git a/contrib/ipfilter/FreeBSD-4.0/INST.FreeBSD-4 b/contrib/ipfilter/FreeBSD-4.0/INST.FreeBSD-4
deleted file mode 100644
index 7d1b7a2b8f4c..000000000000
--- a/contrib/ipfilter/FreeBSD-4.0/INST.FreeBSD-4
+++ /dev/null
@@ -1,24 +0,0 @@
-To build a kernel with the IP filter, follow these seven steps:
-
- 1. do "make freebsd4"
-
- 2. do "make install-bsd"
- (probably has to be done as root)
-
- 3. run "FreeBSD-4.0/kinstall" as root
-
- 4. build a new kernel
-
- 5. install the new kernel
-
- 6. If not using DEVFS, create devices for IP Filter as follows:
- mknod /dev/ipl c 79 0
- mknod /dev/ipnat c 79 1
- mknod /dev/ipstate c 79 2
- mknod /dev/ipauth c 79 3
-
- 7. reboot
-
-
-Darren Reed
-darrenr@pobox.com
diff --git a/contrib/ipfilter/FreeBSD-4.0/ipv6-patch b/contrib/ipfilter/FreeBSD-4.0/ipv6-patch
deleted file mode 100755
index c232b2c15972..000000000000
--- a/contrib/ipfilter/FreeBSD-4.0/ipv6-patch
+++ /dev/null
@@ -1,61 +0,0 @@
-*** ip6_input.c.orig Sun Feb 13 14:32:01 2000
---- ip6_input.c Wed Apr 26 22:31:34 2000
-***************
-*** 121,126 ****
---- 121,127 ----
-
- extern struct domain inet6domain;
- extern struct ip6protosw inet6sw[];
-+ extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
-
- u_char ip6_protox[IPPROTO_MAX];
- static int ip6qmaxlen = IFQ_MAXLEN;
-***************
-*** 302,307 ****
---- 303,317 ----
- ip6stat.ip6s_badvers++;
- in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
- goto bad;
-+ }
-+
-+ if (fr_checkp) {
-+ struct mbuf *m1 = m;
-+
-+ if ((*fr_checkp)(ip6, sizeof(*ip6), m->m_pkthdr.rcvif,
-+ 0, &m1) || !m1)
-+ return;
-+ ip6 = mtod(m = m1, struct ip6_hdr *);
- }
-
- ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
-*** ip6_output.c.orig Fri Mar 10 01:57:16 2000
---- ip6_output.c Wed Apr 26 22:34:34 2000
-***************
-*** 108,113 ****
---- 108,115 ----
- #include <netinet6/ip6_fw.h>
- #endif
-
-+ extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
-+
- static MALLOC_DEFINE(M_IPMOPTS, "ip6_moptions", "internet multicast options");
-
- struct ip6_exthdrs {
-***************
-*** 754,759 ****
---- 756,770 ----
- ip6->ip6_src.s6_addr16[1] = 0;
- if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
- ip6->ip6_dst.s6_addr16[1] = 0;
-+ }
-+
-+ if (fr_checkp) {
-+ struct mbuf *m1 = m;
-+
-+ if ((error = (*fr_checkp)(ip6, sizeof(*ip6), ifp, 1, &m1)) ||
-+ !m1)
-+ goto done;
-+ ip6 = mtod(m = m1, struct ip6_hdr *);
- }
-
- #ifdef IPV6FIREWALL
diff --git a/contrib/ipfilter/INSTALL.BSDOS b/contrib/ipfilter/INSTALL.BSDOS
deleted file mode 100644
index 17d9602ef8ab..000000000000
--- a/contrib/ipfilter/INSTALL.BSDOS
+++ /dev/null
@@ -1,35 +0,0 @@
-
-BSD/OS users.
--------------
-
-First, you need to build IP Filter. Do this from the "ip_fil3.2.x"
-directory with the command "make bsdos". If this completes successfully,
-install the various bits and pieces with "make install-bsd".
-
-Prior to starting, it is a good idea for you to know what your kernel config
-file is (it appears that the script guesses incorrectly at present).
-
-Once you have that in mind, run the 'kinstall' script in the correct
-BSDOS3 or BSDOS4 directory. This will attempt to patch a bunch of files
-or install the relevant .o files if you don't have kernel source.
-It will also go and install all the IP Filter .c and .h files where they
-can be find when it comes time to build the kernel.
-
-The script will then pause and ask you for your kernel configuration
-file. After you enter this, it will add "options IPFILTER" to your
-kernel configuration file. IF YOU WANT TO DO LOGGING, ADD
-"options IPFILTER_LOG" to your kernel configuration file NOW!
-
-Now that you've got your kernel configuration file done, use config
-to setup a new kernel build and complete with make.
-
-When the kernel rebuilt is complete, put it into / and reboot with
-your new kernel. If IP Filter has been configured into your kernel
-correctly, you will see a message like this when your system boots:
-
-IP Filter: initialized. Default = pass all, Logging = enabled
-
-Upon logging in, the IP Filter commands ipfstat, et al, should all
-function properly.
-
-Darren
diff --git a/contrib/ipfilter/INSTALL.BSDOS3 b/contrib/ipfilter/INSTALL.BSDOS3
deleted file mode 100644
index 8842b981911c..000000000000
--- a/contrib/ipfilter/INSTALL.BSDOS3
+++ /dev/null
@@ -1,44 +0,0 @@
-
-BSD/OS 3.x users.
------------------
-
-First, you will need to either:
-(a) have a source license for the kernel so you can patch some files or
-(b) obtain the relevant pre-compiled .o files (I can't supply these yet).
-
-The files which you will need patched are:
-ip_input.c, ip_output.c (maybe in_proto.c and ioconf.c.i386 too - NOT sure).
-
-First, you need to build IP Filter. Do this from the "ip_fil3.2.x"
-directory with the command "make bsdos". If this completes successfully,
-install the various bits and pieces with "make install-bsd".
-
-Prior to starting, it is a good idea for you to know what your kernel config
-file is (it appears that the script guesses incorrectly at present).
-
-Once you have that in mind, run the 'kinstall' script in the BSDOS3
-directory. This will attempt to patch a bunch of files. If you've
-obtained the relevant .o files, ignore the errors, otherwise please
-report them to me and mention which version of BSD/OS you are using
-and on what platform (Sparc, i386, etc). It will also go and install
-all the IP Filter .c and .h files where they can be find when it comes
-time to build the kernel.
-
-The script will then pause and ask you for your kernel configuration
-file. After you enter this, it will add "options IPFILTER" to your
-kernel configuration file. IF YOU WANT TO DO LOGGING, ADD
-"options IPFILTER_LOG" to your kernel configuration file NOW!
-
-Now that you've got your kernel configuration file done, use config
-to setup a new kernel build and complete with make.
-
-When the kernel rebuilt is complete, put it into / and reboot with
-your new kernel. If IP Filter has been configured into your kernel
-correctly, you will see a message like this when your system boots:
-
-IP Filter: initialized. Default = pass all, Logging = enabled
-
-Upon logging in, the IP Filter commands ipfstat, et al, should all
-function properly.
-
-Darren
diff --git a/contrib/ipfilter/INSTALL.IRIX b/contrib/ipfilter/INSTALL.IRIX
deleted file mode 100644
index b64d4349879b..000000000000
--- a/contrib/ipfilter/INSTALL.IRIX
+++ /dev/null
@@ -1,108 +0,0 @@
-
-IP Filter has been mostly tested under IRIX 6.2. It should work under IRIX 6.3
-as well. Under IRIX 5.3, it has been successfully compiled and linked in the
-kernel, but not tested. Compilation under IRIX >= 6.4 is not yet supported.
-
-To build a kernel with the IP filter and install it on your system,
-follow these steps:
-
- 1. edit the top-level Makefile to
- a) comment-out the IPFLKM definition.
- This means changing the line reading:
- IPFLKM=-DIPFILTER_LKM
- to
- #IPFLKM=-DIPFILTER_LKM
- b) select the system's compiler (cc)
- This means changing the line reading:
- CC=gcc
- to
- CC=cc
- b) enable full optimization
- This means changing the lines reading:
- DEBUG=-g
- CFLAGS=-I$$(TOP)
- to
- DEBUG=
- CFLAGS=-O2 -I$$(TOP)
-
- 1. do "make irix" (Warning: GNU make is not supported, so if it has
- been installed on your system, verify your path and/or do "which make"
- to guarantee that IRIX's /sbin/make has precedence)
-
- 2. do "make install-irix" as root
- (a new kernel will be automatically built)
-
- 3. determine the filtering rules and place them in /etc/ipf.conf
- and /etc/ipnat.conf
-
- 4. do "init 6" as root to reboot with the new kernel
-
- After restarting, the filter should be active and behaving according to
- the rules loaded from /etc/ipf.conf and /etc/ipfnat.conf.
-
- These files can be changed at any time, and reloaded using the
- following command sequence:
-
- # sh /etc/init.d/ipf stop; sh /etc/init.d/ipf start
-
-
-To remove the IP Filter from your kernel, follow these steps:
-
- 1. Delete the /var/sysgen/boot/ipfilter.o file
-
- # rm /var/sysgen/boot/ipfilter.o
-
- 2. If SGI's ipfilter.o had been previously installed, restore it
- back to its original location
-
- # mv /var/sysgen/boot/ipfilter.o.DIST /var/sysgen/boot/ipfilter.o
-
- 3. Build a new kernel
-
- # /etc/autoconfig
-
- 4. Delete the /etc/rc2.d/S33ipf symbolic link
-
- # rm /etc/rc2.d/S33ipf
-
- 5. Reboot
-
- # init 6
-
-
-ADDITIONAL NOTES:
-
- - The IP filter uses the same kernel interface to the IP driver as
- SGI's ipfilter. In fact, it is installed in place of SGI's
- /var/sysgen/boot/ipfilter.o module, after renaming it (if installed)
- to /var/sysgen/boot/ipfilter.o.DIST. You should ensure that SGI's
- ipfilterd daemon is not running simultaneously, since this package uses
- the same major device number.
-
- - We have not tested IP Filter on a multiprocessor machine yet.
- However, feel free to try it and send your experiences/patches
- back to marc@CAM.ORG. SGI prescribes that kernel code be built on such
- systems with -D_MP_NETLOCKS -DMP. Therefore, these flags should
- probably be uncommented on the DFLAGS line of IRIX/Makefile if your
- machine has more than one processor.
-
- - It is also possible to build IP Filter as a dynamically loadable
- kernel module (by retaining the IPFLKM=-DIPFILTER_LKM definition in the
- top-level Makefile), but this is not recommended other than for testing
- and debugging purposes, because the only possible method for dynamic
- attachment to the IP stack (instruction patching) is highly dependent
- on the processor architecture. The code provided has only been tested
- with IP22 CPU boards and can sometime cause panics during loading due
- to a potential race condition.
-
-
-CREDITS:
-
- IP Filter was ported to IRIX by Marc Boucher <marc@CAM.ORG>
-
- Marc Boucher wishes to thank the
- ICARI Institute (http://www.icari.qc.ca)
- and
- Aurelio Cascio <aurelio@toonboom.com>
- for their financial support and testing facilities, respectively.
-
diff --git a/contrib/ipfilter/INSTALL.Linux b/contrib/ipfilter/INSTALL.Linux
deleted file mode 100644
index 1a5d15b59f02..000000000000
--- a/contrib/ipfilter/INSTALL.Linux
+++ /dev/null
@@ -1,50 +0,0 @@
-IP-Filter on Linux 2.0.31
--------------------------
-
-NOTE: I have *ONLY* compiled and created patches for using IP Filter on
- Linux 2.0.31. Any other kernel revision may need seprate patches.
- Also, I've only tested on a x86 CPU so I can't make any guarantees
- about it working on Sparc/Mac/Amiga.
-
-First, you should do a sanity check of your system to make sure it will
-compile IP Filter. You will need a "libfl" and a "libelf". If you don't
-have these, install them before proceeding.
-
-The installation and compiliation process assumes that Linux 2.0.31
-will be in the /usr/src/linux directory and that all the symbolic links
-in /usr/include match. /usr/src/linux may be a symbolic link too, but
-it must point to a 2.0.31 kernel source tree.
-
-The first step is to make the IP Filter binaries. Do this with a
-"make linux" from the ip_fil3.2.x directory. If this completes with
-no errors, install IP Filter with a "make install-linux".
-
-Now that the user part of it is complete, it is time to work on the kernel.
-To start this off, run "Linux/minstall". This will configure the devices
-you will need for the IP Filter. Then run "Linux/kinstall". This will
-patch your kernel source code and configuration files so you can enabled IP
-Filter. You must now go to /usr/src/linux and configure your kernel using one
-of the available interfaces to enable IP Filter. IP Filter will be presented
-as a three way choice "y/m/n" - select "m" to enable it. Save your kernel
-configuration file, rebuild, install and reboot with the new kernel.
-
-When you've rebooted with the new kernel, you should be able to load
-IP Filter with the command "insmod if_ipl". All going will, you will
-see a message like this on your console:
-
-IP Filter: initialized. Default = pass all, Logging = enabled
-
-indicating that IP Filter has successfully been loaded into the kernel
-and is awaiting.
-
-Darren
-
-Features Not Available on Linux, yet:
-
-- compiled into the kernel
-"<action> in on <if> to <if> ..."
-"<action> in on <if> dup-to <if> ..."
-"<action> in on <if> fastroute ..."
-"block return-rst ..."
-"map ... proxy ..." (Linux's masquerading is better at present)
-
diff --git a/contrib/ipfilter/INSTALL.NetBSD b/contrib/ipfilter/INSTALL.NetBSD
deleted file mode 100644
index 012d6d7f8d2d..000000000000
--- a/contrib/ipfilter/INSTALL.NetBSD
+++ /dev/null
@@ -1,59 +0,0 @@
-
-To build a kernel for use with the loadable kernel module, follow these
-steps:
- 1. do "make netbsd"
-
- 2. do "make install-bsd"
- (probably has to be done as root)
-
- 3(a) NetBSD systems prior to 1.2:
- run "NetBSD/minstall" as root
- 3(b) NetBSD 1.2 systems or later:
- run "NetBSD-1.2/minstall" as root
-
- 4. build a new kernel
-
- 5. install and reboot with the new kernel
-
- 6. use modload(8) to load the packet filter with:
- modload if_ipl.o
-
- 7. do "modstat" to confirm that it has been loaded successfully.
-
-There is no need to use mknod to create the device in /dev;
-- upon loading the module, it will create itself with the correct values,
- under the name (IPL_NAME) from the Makefile. It will also remove itself
- from /dev when it is modunload'd.
-
-To build a kernel with the IP filter, follow these steps:
-
- 1. do "make netbsd"
-
- 2. do "make install-bsd"
- (probably has to be done as root)
-
- 3(a) NetBSD systems prior to 1.2:
- run "NetBSD/kinstall" as root
- 3(b) NetBSD 1.2 systems or later:
- run "NetBSD-1.2/kinstall" as root
- 3(c) If conf.c fails on the 2nd hunk of the patch, you will have to
- manually apply the patch.
-
- 4. build a new kernel
-
- 5. Create device files. For NetBSD-1.2 (or later), use 49 as the
- major number. For NetBSD-1.1 or earlier, use 59. Run these
- commands as root, substituting <major> for the appropriate number:
-
- mknod /dev/ipl c <major> 0
- mknod /dev/ipnat c <major> 1
- mknod /dev/ipstate c <major> 2
- mknod /dev/ipauth c <major> 3
-
- ** NOTE: both the numbers 49 and 59 should be substituted with
- whatever number you inserted it into conf.c as.
-
- 6. install and reboot with the new kernel
-
-Darren Reed
-darrenr@pobox.com
diff --git a/contrib/ipfilter/INSTALL.Sol2 b/contrib/ipfilter/INSTALL.Sol2
deleted file mode 100644
index 5ba84b931985..000000000000
--- a/contrib/ipfilter/INSTALL.Sol2
+++ /dev/null
@@ -1,28 +0,0 @@
-
-For those running Solaris 2.5 or later, please read COMPILE.2.5 before
-building IP Filter.
-
-Type "make solaris" to build all the required binaries. DO NOT USE THE
-GNU make!!!
-
-Once IP Filter has been successfully compiled, you may then install it using
-the usual package method (using pkgadd), however, the package needs to be
-created, prior to pkgadd'ing. To create the package in /var/spool/pkg, change
-directory to SunOS5 and enter the following command:
-
-make package
-
-This will build the package into SunOS5/<arch>/root, copy that to
-/var/spool/pkg as a package and then start the installation using
-pkgadd.
-
-As part of the postinstall script, it will install loadable kernel module
-as part of Solaris 2 (using add_drv) making it available for immeadiate use.
-
-IP Filter will be installed into /opt/CYBSipf (programs, manual pages and
-examples) and create a directory /etc/opt/CYBSipf with a null body file
-called "ipf.conf" using touch. The rc scripts have been written to look
-for the configuration file here, using the installed binaries in /sbin.
-
-Darren Reed
-darrenr@pobox.com
diff --git a/contrib/ipfilter/INSTALL.SunOS b/contrib/ipfilter/INSTALL.SunOS
deleted file mode 100644
index 0d4dd8c5e07a..000000000000
--- a/contrib/ipfilter/INSTALL.SunOS
+++ /dev/null
@@ -1,40 +0,0 @@
-
-To install as a Loadable Kernel Module (LKM):
-
- 1. do a "make solaris" in this directory
-
- 2. Run the script "SunOS4/minstall" as root.
-
- 3. change directory to SunOS4 and run "make install"
-
- 4. Reboot using the new kernel
-
- 5. use modload(8) to load the packet filter with:
- modload if_ipl.o
-
- 6. do "modstat" to confirm that it has been loaded successfully.
-
- There is no need to use mknod to create the device in /dev;
- - upon loading the module, it will create itself with the correct
- values, under the name (IPL_NAME) from the Makefile. It will
- also remove itself from /dev when it is modunload'd.
-
-
-To install as part of a SunOS 4.1.x kernel:
-
- 1. do a "make solaris" in this directory
-
- 2. Run the script "SunOS4/kinstall" as root.
- NOTE: This script sets up /dev/ipl as char. device 59,0
- in /sys/sun/conf.c
-
- 3. Run the following commands as root:
- mknod /dev/ipl c 59 0
- mknod /dev/ipnat c 59 1
- mknod /dev/ipstate c 59 2
- mknod /dev/ipauth c 59 3
-
- 4. Reboot using the new kernel
-
-Darren Reed
-darrenr@pobox.com
diff --git a/contrib/ipfilter/LICENCE b/contrib/ipfilter/LICENCE
deleted file mode 100644
index f4cc8ee76bfa..000000000000
--- a/contrib/ipfilter/LICENCE
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) 1993-2000 by Darren Reed.
- *
- * The author accepts no responsibility for the use of this software and
- * provides it on an ``as is'' basis without express or implied warranty.
- *
- * Redistribution and use in source and binary forms are permitted
- * provided that this notice is preserved and due credit is given
- * to the original author and the contributors.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
- *
- * I hate legaleese, don't you ?
- */
diff --git a/contrib/ipfilter/QNX_OCL.txt b/contrib/ipfilter/QNX_OCL.txt
deleted file mode 100644
index 6aa33eaf6b06..000000000000
--- a/contrib/ipfilter/QNX_OCL.txt
+++ /dev/null
@@ -1,275 +0,0 @@
- End User License Certificate (EULA) End User License Certificate
- (EULA)
- Support Support
- QNX Source Licenses QNX Source Licenses
- License of the month
- Confidential Source License
- Version 1.0
-
-QNX Open Community License Version 1.0
-
- THIS QNX OPEN COMMUNITY LICENSE ( "THE OCL", OR "THIS AGREEMENT")
- APPLIES TO PROGRAMS THAT QNX SOFTWARE SYSTEMS LTD. ("QSS") EXPRESSLY
- ELECTS TO LICENSE UNDER THE OCL TERMS. IT ALSO APPLIES TO DERIVATIVE
- WORKS CREATED UNDER THIS AGREEMENT THAT CREATORS ELECT TO LICENSE TO
- OTHERS IN SOURCE CODE FORM. ANY USE, REPRODUCTION, MODIFICATION OR
- DISTRIBUTION OF SUCH PROGRAMS CONSTITUTES RECIPIENT'S ACCEPTANCE OF
- THE OCL. THE LICENSE RIGHTS GRANTED BELOW ARE CONDITIONAL UPON
- RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT AND THE FORMATION OF A
- BINDING CONTRACT. NOTHING ELSE GRANTS PERMISSION TO USE, REPRODUCE,
- MODIFY OR DISTRIBUTE SUCH PROGRAMS OR THEIR DERIVATIVE WORKS. THESE
- ACTIONS ARE OTHERWISE PROHIBITED. CONTACT QSS IF OTHER STEPS ARE
- REQUIRED LOCALLY TO CREATE A BINDING CONTRACT.
-
- The OCL is intended to promote the development, use and distribution
- of derivative works created from QSS source code. This includes
- commercial distribution of object code versions under the terms of
- Recipient's own license agreement and, at Recipient's option, sharing
- of source code modifications within the QNX developer's community. The
- license granted under the OCL is royalty free. Recipient is entitled
- to charge royalties for object code versions of derivative works that
- originate with Recipient. If Recipient elects to license source code
- for its derivative works to others, then it must be licensed under the
- OCL. The terms of the OCL are as follows:
-
-1. DEFINITIONS
-
- "Contribution" means:
-
- a. in the case of QSS: (i) the Original Program, where the Original
- Program originates from QSS, (ii) changes and/or additions to
- Unrestricted Open Source, where the Original Program originates
- from Unrestricted Open Source and where such changes and/or
- additions originate from QSS, and (iii) changes and/or additions
- to the Program where such changes and/or additions originate from
- QSS.
- b. in the case of each Contributor, changes and/or additions to the
- Program, where such changes and/or additions originate from and
- are distributed by that particular Contributor.
-
- A Contribution 'originates' from a Contributor if it was added to the
- Program by such Contributor itself or anyone acting on such
- Contributor's behalf. Contributions do not include additions to the
- Program which: (i) are separate modules of software distributed in
- conjunction with the Program under their own license agreement, and
- (ii) are not derivative works of the Program.
-
- "Contributor" means QSS and any other entity that distributes the
- Program.
-
- "Licensed Patents " mean patent claims licensable by Contributor to
- others, which are necessarily infringed by the use or sale of its
- Contribution alone or when combined with the Program.
-
- "Unrestricted Open Source" means published source code that is
- licensed for free use and distribution under an unrestricted licensing
- and distribution model, such as the Berkley Software Design ("BSD")
- and "BSD-like" licenses. It specifically excludes any source code
- licensed under any version of the GNU General Public License (GPL) or
- the GNU Lesser/Library GPL. All "Unrestricted Open Source" license
- terms appear or are clearly identified in the header of any affected
- source code for the Original Program.
-
- "Original Program" means the original version of the software
- accompanying this Agreement as released by QSS, including source code,
- object code and documentation, if any.
-
- "Program" means the Original Program and Contributions.
-
- "Recipient" means anyone who receives the Program under this
- Agreement, including all Contributors.
-
-2. GRANT OF RIGHTS
-
- a. Subject to the terms of this Agreement, each Contributor hereby
- grants Recipient a non-exclusive, worldwide, royalty-free
- copyright license to reproduce, prepare derivative works of,
- publicly display, publicly perform, and directly and indirectly
- sublicense and distribute the Contribution of such Contributor, if
- any, and such derivative works, in source code and object code
- form.
- b. Subject to the terms of this Agreement, each Contributor hereby
- grants Recipient a non-exclusive, worldwide, royalty-free patent
- license under Licensed Patents to make, use, sell, offer to sell,
- import and otherwise transfer the Contribution of such
- Contributor, if any, in source code and object code form. This
- patent license shall apply to the combination of the Contribution
- and the Program if, at the time the Contribution is added by the
- Contributor, such addition of the Contribution causes such
- combination to be covered by the Licensed Patents. The patent
- license shall not apply to any other combinations which include
- the Contribution.
- c. Recipient understands that although each Contributor grants the
- licenses to its Contributions set forth herein, no assurances are
- provided by any Contributor that the Program does not infringe the
- patent or other intellectual property rights of any other entity.
- Each Contributor disclaims any liability to Recipient for claims
- brought by any other entity based on infringement of intellectual
- property rights or otherwise. As a condition to exercising the
- rights and licenses granted hereunder, each Recipient hereby
- assumes sole responsibility to secure any other intellectual
- property rights needed, if any. For example, if a third party
- patent license is required to allow Recipient to distribute the
- Program, it is Recipient's responsibility to acquire that license
- before distributing the Program.
- d. Each Contributor represents that to its knowledge it has
- sufficient copyright rights in its Contribution, if any, to grant
- the copyright license set forth in this Agreement.
-
- 3. REQUIREMENTS
-
- A Contributor may choose to distribute the Program in object code form
- under its own license agreement, provided that:
-
- a. it complies with the terms and conditions of this Agreement; and
- b. its license agreement:
- i. effectively disclaims on behalf of all Contributors all
- warranties and conditions, express and implied, including
- warranties or conditions of title and non-infringement, and
- implied warranties or conditions of merchantability and
- fitness for a particular purpose;
- ii. effectively excludes on behalf of all Contributors all
- liability for damages, including direct, indirect, special,
- incidental and consequential damages, such as lost profits;
- and
- iii. states that any provisions which differ from this Agreement
- are offered by that Contributor alone and not by any other
- party.
-
- If the Program is made available in source code form:
-
- a. it must be made available under this Agreement; and
- b. a copy of this Agreement must be included with each copy of the
- Program. Each Contributor must include the following in a
- conspicuous location in the Program along with any other copyright
- or attribution statements required by the terms of any applicable
- Unrestricted Open Source license:
- Copyright {date here}, QNX Software Systems Ltd. and others. All
- Rights Reserved.
-
- In addition, each Contributor must identify itself as the originator
- of its Contribution, if any, in a manner that reasonably allows
- subsequent Recipients to identify the originator of the Contribution.
-
- 4. COMMERCIAL DISTRIBUTION
-
- Commercial distributors of software may accept certain
- responsibilities with respect to end users, business partners and the
- like. While this license is intended to facilitate the commercial use
- of the Program, the Contributor who includes the Program in a
- commercial product offering should do so in a manner which does not
- create potential liability for other Contributors. Therefore, if a
- Contributor includes the Program in a commercial product offering,
- such Contributor ("Commercial Contributor") hereby agrees to defend
- and indemnify every other Contributor ("Indemnified Contributor")
- against any losses, damages and costs (collectively "Losses") arising
- from claims, lawsuits and other legal actions brought by a third party
- against the Indemnified Contributor to the extent caused by the acts
- or omissions of such Commercial Contributor in connection with its
- distribution of the Program in a commercial product offering. The
- obligations in this section do not apply to any claims or Losses
- relating to any actual or alleged intellectual property infringement.
- In order to qualify, an Indemnified Contributor must: a) promptly
- notify the Commercial Contributor in writing of such claim, and b)
- allow the Commercial Contributor to control, and cooperate with the
- Commercial Contributor in, the defense and any related settlement
- negotiations. The Indemnified Contributor may participate in any such
- claim at its own expense.
-
- For example, a Contributor might include the Program in a commercial
- product offering, Product X. That Contributor is then a Commercial
- Contributor. If that Commercial Contributor then makes performance
- claims, or offers warranties related to Product X, those performance
- claims and warranties are such Commercial Contributor's responsibility
- alone. Under this section, the Commercial Contributor would have to
- defend claims against the other Contributors related to those
- performance claims and warranties, and if a court requires any other
- Contributor to pay any damages as a result, the Commercial Contributor
- must pay those damages.
-
- 5. NO WARRANTY
-
- Recipient acknowledges that there may be errors or bugs in the Program
- and that it is imperative that Recipient conduct thorough testing to
- identify and correct any problems prior to the productive use or
- commercial release of any products that use the Program, and prior to
- the release of any modifications, updates or enhancements thereto.
-
- EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS
- PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY
- WARRANTIES OR CONDITIONS OF TITLE, NON- INFRINGEMENT, MERCHANTABILITY
- OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely
- responsible for determining the appropriateness of using and
- distributing the Program and assumes all risks associated with its
- exercise of rights under this Agreement, including but not limited to
- the risks and costs of program errors, compliance with applicable
- laws, damage to or loss of data, programs or equipment, and
- unavailability or interruption of operations.
-
- 6. DISCLAIMER OF LIABILITY
-
- EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR
- ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT,
- INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING
- WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
- LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR
- DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
- HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
- 7. GENERAL
-
- If any provision of this Agreement is invalid or unenforceable under
- applicable law, it shall not affect the validity or enforceability of
- the remainder of the terms of this Agreement, and without further
- action by the parties hereto, such provision shall be reformed to the
- minimum extent necessary to make such provision valid and enforceable.
-
- If Recipient institutes patent litigation against a Contributor with
- respect to a patent applicable to software (including a cross-claim or
- counterclaim in a lawsuit), then any patent licenses granted by that
- Contributor to such recipient under this Agreement shall terminate as
- of the date such litigation is filed. In addition, If Recipient
- institutes patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Program
- itself (excluding combinations of the Program with other software or
- hardware) infringes such Recipient's patent(s), then such Recipient's
- rights granted under Section 2(b) shall terminate as of the date such
- litigation is filed.
-
- All Recipient's rights under this Agreement shall terminate if it
- fails to comply with any of the material terms or conditions of this
- Agreement and does not cure such failure in a reasonable period of
- time after becoming aware of such noncompliance. If all Recipient's
- rights under this Agreement terminate, Recipient agrees to cease use
- and distribution of the Program as soon as reasonably practicable.
- However, Recipient's obligations under this Agreement and any licenses
- granted by Recipient relating to the Program shall continue and
- survive.
-
- QSS may publish new versions (including revisions) of this Agreement
- from time to time. Each new version of the Agreement will be given a
- distinguishing version number. The Program (including Contributions)
- may always be distributed subject to the version of the Agreement
- under which it was received. In addition, after a new version of the
- Agreement is published, Contributor may elect to distribute the
- Program (including its Contributions) under the new version. No one
- other than QSS has the right to modify this Agreement. Except as
- expressly stated in Sections 2(a) and 2(b) above, Recipient receives
- no rights or licenses to the intellectual property of any Contributor
- under this Agreement, whether expressly, by implication, estoppel or
- otherwise. All rights in the Program not expressly granted under this
- Agreement are reserved.
-
- This Agreement is governed by the laws in force in the Province of
- Ontario, Canada without regard to the conflict of law provisions
- therein. The parties expressly disclaim the provisions of the United
- Nations Convention on Contracts for the International Sale of Goods.
- No party to this Agreement will bring a legal action under this
- Agreement more than one year after the cause of action arose. Each
- party waives its rights to a jury trial in any resulting litigation.
-
- * QNX is a registered trademark of QNX Software Systems Ltd.
-
- Document Version: ocl1_00
diff --git a/contrib/ipfilter/UPGRADE_NOTICE b/contrib/ipfilter/UPGRADE_NOTICE
deleted file mode 100644
index 8b4476072b27..000000000000
--- a/contrib/ipfilter/UPGRADE_NOTICE
+++ /dev/null
@@ -1,10 +0,0 @@
-
-NOTE: To all those upgrading from versions prior to 3.2.11 who used NAT
- AND setup ACL's to allow untranslated address through from outside,
-
- THIS HAS BEEN FIXED
-
- so your ACL's will now be `broken'. Please correct your ACL's to
- match the the untranslated addresses (the way it was meant to work).
-
-Darren
diff --git a/contrib/ipfilter/bpf.h b/contrib/ipfilter/bpf.h
deleted file mode 100644
index 715c79a8d173..000000000000
--- a/contrib/ipfilter/bpf.h
+++ /dev/null
@@ -1,450 +0,0 @@
-/*-
- * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
- * The Regents of the University of California. All rights reserved.
- *
- * This code is derived from the Stanford/CMU enet packet filter,
- * (net/enet.c) distributed as part of 4.3BSD, and code contributed
- * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
- * Berkeley Laboratory.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- * must display the following acknowledgement:
- * This product includes software developed by the University of
- * California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- * may be used to endorse or promote products derived from this software
- * without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * @(#)bpf.h 7.1 (Berkeley) 5/7/91
- *
- * @(#) $Header: /devel/CVS/IP-Filter/Attic/bpf.h,v 1.1.2.1 2002/11/07 13:18:35 darrenr Exp $ (LBL)
- */
-
-#ifndef BPF_MAJOR_VERSION
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* BSD style release date */
-#define BPF_RELEASE 199606
-
-typedef int bpf_int32;
-typedef u_int bpf_u_int32;
-
-/*
- * Alignment macros. BPF_WORDALIGN rounds up to the next
- * even multiple of BPF_ALIGNMENT.
- */
-#ifndef __NetBSD__
-#define BPF_ALIGNMENT sizeof(bpf_int32)
-#else
-#define BPF_ALIGNMENT sizeof(long)
-#endif
-#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
-
-#define BPF_MAXINSNS 512
-#define BPF_MAXBUFSIZE 0x8000
-#define BPF_MINBUFSIZE 32
-
-/*
- * Structure for BIOCSETF.
- */
-struct bpf_program {
- u_int bf_len;
- struct bpf_insn *bf_insns;
-};
-
-/*
- * Struct returned by BIOCGSTATS.
- */
-struct bpf_stat {
- u_int bs_recv; /* number of packets received */
- u_int bs_drop; /* number of packets dropped */
-};
-
-/*
- * Struct return by BIOCVERSION. This represents the version number of
- * the filter language described by the instruction encodings below.
- * bpf understands a program iff kernel_major == filter_major &&
- * kernel_minor >= filter_minor, that is, if the value returned by the
- * running kernel has the same major number and a minor number equal
- * equal to or less than the filter being downloaded. Otherwise, the
- * results are undefined, meaning an error may be returned or packets
- * may be accepted haphazardly.
- * It has nothing to do with the source code version.
- */
-struct bpf_version {
- u_short bv_major;
- u_short bv_minor;
-};
-/* Current version number of filter architecture. */
-#define BPF_MAJOR_VERSION 1
-#define BPF_MINOR_VERSION 1
-
-/*
- * BPF ioctls
- *
- * The first set is for compatibility with Sun's pcc style
- * header files. If your using gcc, we assume that you
- * have run fixincludes so the latter set should work.
- */
-#if (defined(sun) || defined(ibm032)) && !defined(__GNUC__)
-#define BIOCGBLEN _IOR(B,102, u_int)
-#define BIOCSBLEN _IOWR(B,102, u_int)
-#define BIOCSETF _IOW(B,103, struct bpf_program)
-#define BIOCFLUSH _IO(B,104)
-#define BIOCPROMISC _IO(B,105)
-#define BIOCGDLT _IOR(B,106, u_int)
-#define BIOCGETIF _IOR(B,107, struct ifreq)
-#define BIOCSETIF _IOW(B,108, struct ifreq)
-#define BIOCSRTIMEOUT _IOW(B,109, struct timeval)
-#define BIOCGRTIMEOUT _IOR(B,110, struct timeval)
-#define BIOCGSTATS _IOR(B,111, struct bpf_stat)
-#define BIOCIMMEDIATE _IOW(B,112, u_int)
-#define BIOCVERSION _IOR(B,113, struct bpf_version)
-#define BIOCSTCPF _IOW(B,114, struct bpf_program)
-#define BIOCSUDPF _IOW(B,115, struct bpf_program)
-#else
-#define BIOCGBLEN _IOR('B',102, u_int)
-#define BIOCSBLEN _IOWR('B',102, u_int)
-#define BIOCSETF _IOW('B',103, struct bpf_program)
-#define BIOCFLUSH _IO('B',104)
-#define BIOCPROMISC _IO('B',105)
-#define BIOCGDLT _IOR('B',106, u_int)
-#define BIOCGETIF _IOR('B',107, struct ifreq)
-#define BIOCSETIF _IOW('B',108, struct ifreq)
-#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)
-#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)
-#define BIOCGSTATS _IOR('B',111, struct bpf_stat)
-#define BIOCIMMEDIATE _IOW('B',112, u_int)
-#define BIOCVERSION _IOR('B',113, struct bpf_version)
-#define BIOCSTCPF _IOW('B',114, struct bpf_program)
-#define BIOCSUDPF _IOW('B',115, struct bpf_program)
-#endif
-
-/*
- * Structure prepended to each packet.
- */
-struct bpf_hdr {
- struct timeval bh_tstamp; /* time stamp */
- bpf_u_int32 bh_caplen; /* length of captured portion */
- bpf_u_int32 bh_datalen; /* original length of packet */
- u_short bh_hdrlen; /* length of bpf header (this struct
- plus alignment padding) */
-};
-/*
- * Because the structure above is not a multiple of 4 bytes, some compilers
- * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
- * Only the kernel needs to know about it; applications use bh_hdrlen.
- */
-#if defined(KERNEL) || defined(_KERNEL)
-#define SIZEOF_BPF_HDR 18
-#endif
-
-/*
- * Data-link level type codes.
- */
-
-/*
- * These are the types that are the same on all platforms; on other
- * platforms, a <net/bpf.h> should be supplied that defines the additional
- * DLT_* codes appropriately for that platform (the BSDs, for example,
- * should not just pick up this version of "bpf.h"; they should also define
- * the additional DLT_* codes used by their kernels, as well as the values
- * defined here - and, if the values they use for particular DLT_ types
- * differ from those here, they should use their values, not the ones
- * here).
- */
-#define DLT_NULL 0 /* no link-layer encapsulation */
-#define DLT_EN10MB 1 /* Ethernet (10Mb) */
-#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
-#define DLT_AX25 3 /* Amateur Radio AX.25 */
-#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
-#define DLT_CHAOS 5 /* Chaos */
-#define DLT_IEEE802 6 /* IEEE 802 Networks */
-#define DLT_ARCNET 7 /* ARCNET */
-#define DLT_SLIP 8 /* Serial Line IP */
-#define DLT_PPP 9 /* Point-to-point Protocol */
-#define DLT_FDDI 10 /* FDDI */
-
-/*
- * These are values from the traditional libpcap "bpf.h".
- * Ports of this to particular platforms should replace these definitions
- * with the ones appropriate to that platform, if the values are
- * different on that platform.
- */
-#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */
-#define DLT_RAW 12 /* raw IP */
-
-/*
- * These are values from BSD/OS's "bpf.h".
- * These are not the same as the values from the traditional libpcap
- * "bpf.h"; however, these values shouldn't be generated by any
- * OS other than BSD/OS, so the correct values to use here are the
- * BSD/OS values.
- *
- * Platforms that have already assigned these values to other
- * DLT_ codes, however, should give these codes the values
- * from that platform, so that programs that use these codes will
- * continue to compile - even though they won't correctly read
- * files of these types.
- */
-#ifdef __NetBSD__
-#ifndef DLT_SLIP_BSDOS
-#define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */
-#define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */
-#endif
-#else
-#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
-#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
-#endif
-
-#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
-
-/*
- * These values are defined by NetBSD; other platforms should refrain from
- * using them for other purposes, so that NetBSD savefiles with link
- * types of 50 or 51 can be read as this type on all platforms.
- */
-#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
-#define DLT_PPP_ETHER 51 /* PPP over Ethernet */
-
-/*
- * Values between 100 and 103 are used in capture file headers as
- * link-layer types corresponding to DLT_ types that differ
- * between platforms; don't use those values for new DLT_ new types.
- */
-
-/*
- * This value was defined by libpcap 0.5; platforms that have defined
- * it with a different value should define it here with that value -
- * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
- * whatever value that happens to be, so programs will correctly
- * handle files with that link type regardless of the value of
- * DLT_C_HDLC.
- *
- * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
- * compatibility with programs written for BSD/OS.
- *
- * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
- * for source compatibility with programs written for libpcap 0.5.
- */
-#define DLT_C_HDLC 104 /* Cisco HDLC */
-#define DLT_CHDLC DLT_C_HDLC
-
-#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
-
-/*
- * Values between 106 and 107 are used in capture file headers as
- * link-layer types corresponding to DLT_ types that might differ
- * between platforms; don't use those values for new DLT_ new types.
- */
-
-/*
- * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
- * that the AF_ type in the link-layer header is in network byte order.
- *
- * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
- * define it as 108 here. If OpenBSD picks up this file, it should
- * define DLT_LOOP as 12 in its version, as per the comment above -
- * and should not use 108 as a DLT_ value.
- */
-#define DLT_LOOP 108
-
-/*
- * Values between 109 and 112 are used in capture file headers as
- * link-layer types corresponding to DLT_ types that might differ
- * between platforms; don't use those values for new DLT_ types
- * other than the corresponding DLT_ types.
- */
-
-/*
- * This is for Linux cooked sockets.
- */
-#define DLT_LINUX_SLL 113
-
-/*
- * Apple LocalTalk hardware.
- */
-#define DLT_LTALK 114
-
-/*
- * Acorn Econet.
- */
-#define DLT_ECONET 115
-
-/*
- * Reserved for use with OpenBSD ipfilter.
- */
-#define DLT_IPFILTER 116
-
-/*
- * Reserved for use in capture-file headers as a link-layer type
- * corresponding to OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD,
- * but that's DLT_LANE8023 in SuSE 6.3, so we can't use 17 for it
- * in capture-file headers.
- */
-#define DLT_PFLOG 117
-
-/*
- * Registered for Cisco-internal use.
- */
-#define DLT_CISCO_IOS 118
-
-/*
- * Reserved for 802.11 cards using the Prism II chips, with a link-layer
- * header including Prism monitor mode information plus an 802.11
- * header.
- */
-#define DLT_PRISM_HEADER 119
-
-/*
- * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
- * (see Doug Ambrisko's FreeBSD patches).
- */
-#define DLT_AIRONET_HEADER 120
-
-/*
- * Reserved for Siemens HiPath HDLC.
- */
-#define DLT_HHDLC 121
-
-/*
- * Reserved for RFC 2625 IP-over-Fibre Channel, as per a request from
- * Don Lee <donlee@cray.com>.
- *
- * This is not for use with raw Fibre Channel, where the link-layer
- * header starts with a Fibre Channel frame header; it's for IP-over-FC,
- * where the link-layer header starts with an RFC 2625 Network_Header
- * field.
- */
-#define DLT_IP_OVER_FC 122
-
-/*
- * The instruction encodings.
- */
-/* instruction classes */
-#define BPF_CLASS(code) ((code) & 0x07)
-#define BPF_LD 0x00
-#define BPF_LDX 0x01
-#define BPF_ST 0x02
-#define BPF_STX 0x03
-#define BPF_ALU 0x04
-#define BPF_JMP 0x05
-#define BPF_RET 0x06
-#define BPF_MISC 0x07
-
-/* ld/ldx fields */
-#define BPF_SIZE(code) ((code) & 0x18)
-#define BPF_W 0x00
-#define BPF_H 0x08
-#define BPF_B 0x10
-#define BPF_MODE(code) ((code) & 0xe0)
-#define BPF_IMM 0x00
-#define BPF_ABS 0x20
-#define BPF_IND 0x40
-#define BPF_MEM 0x60
-#define BPF_LEN 0x80
-#define BPF_MSH 0xa0
-
-/* alu/jmp fields */
-#define BPF_OP(code) ((code) & 0xf0)
-#define BPF_ADD 0x00
-#define BPF_SUB 0x10
-#define BPF_MUL 0x20
-#define BPF_DIV 0x30
-#define BPF_OR 0x40
-#define BPF_AND 0x50
-#define BPF_LSH 0x60
-#define BPF_RSH 0x70
-#define BPF_NEG 0x80
-#define BPF_JA 0x00
-#define BPF_JEQ 0x10
-#define BPF_JGT 0x20
-#define BPF_JGE 0x30
-#define BPF_JSET 0x40
-#define BPF_SRC(code) ((code) & 0x08)
-#define BPF_K 0x00
-#define BPF_X 0x08
-
-/* ret - BPF_K and BPF_X also apply */
-#define BPF_RVAL(code) ((code) & 0x18)
-#define BPF_A 0x10
-
-/* misc */
-#define BPF_MISCOP(code) ((code) & 0xf8)
-#define BPF_TAX 0x00
-#define BPF_TXA 0x80
-
-/*
- * The instruction data structure.
- */
-struct bpf_insn {
- u_short code;
- u_char jt;
- u_char jf;
- bpf_int32 k;
-};
-
-/*
- * Macros for insn array initializers.
- */
-#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
-#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
-
-#if defined(BSD) && (defined(KERNEL) || defined(_KERNEL))
-/*
- * Systems based on non-BSD kernels don't have ifnet's (or they don't mean
- * anything if it is in <net/if.h>) and won't work like this.
- */
-# if __STDC__
-extern void bpf_tap(struct ifnet *, u_char *, u_int);
-extern void bpf_mtap(struct ifnet *, struct mbuf *);
-extern void bpfattach(struct ifnet *, u_int, u_int);
-extern void bpfilterattach(int);
-# else
-extern void bpf_tap();
-extern void bpf_mtap();
-extern void bpfattach();
-extern void bpfilterattach();
-# endif /* __STDC__ */
-#endif /* BSD && (_KERNEL || KERNEL) */
-#if __STDC__ || defined(__cplusplus)
-extern int bpf_validate(struct bpf_insn *, int);
-extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
-#else
-extern int bpf_validate();
-extern u_int bpf_filter();
-#endif
-
-/*
- * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
- */
-#define BPF_MEMWORDS 16
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/contrib/ipfilter/buildlinux b/contrib/ipfilter/buildlinux
deleted file mode 100755
index 7ce043fc6e6a..000000000000
--- a/contrib/ipfilter/buildlinux
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/sh
-LINUX=`uname -r | perl -e '$_=<>;@F=split(/\./);printf "%02d%02d\n",$F[0],$F[1];';`
-
-case ${LINUX} in
- 0200)
- make linuxrev "LINUXK=-DLINUX=${LINUX}"
- ;;
- 0201)
- make linuxrev "LINUXK=-DLINUX=${LINUX}"
- ;;
- *)
- echo "invalid linux version $LINUX"
- exit 1;
- ;;
-esac
-exit 0
diff --git a/contrib/ipfilter/buildsunos b/contrib/ipfilter/buildsunos
deleted file mode 100755
index 5e857e77953c..000000000000
--- a/contrib/ipfilter/buildsunos
+++ /dev/null
@@ -1,168 +0,0 @@
-#! /bin/sh
-if [ ! -f netinet/done ] ; then
- echo "Do NOT run this script directly, do 'make solaris'!"
- exit 1
-fi
-# Id: buildsunos,v 2.20 2004/02/07 18:08:46 darrenr Exp
-:
-rev=`uname -r | sed -e 's/^\([^\.]*\)\..*/\1/'`
-if [ -d /usr/ccs/bin ] ; then
- PATH=/usr/ccs/bin:${PATH}
- export PATH
-fi
-
-if [ $rev = 5 ] ; then
- if [ ! -d ../pfil ] ; then
- cat << __EOF__
-pfil directory in .. missing, please download pfil package and extract that
-into the parent directory.
-
-See INSTALL.Sol2 for more instructions.
-__EOF__
- exit 1
- fi
- #
- # /usr/ucb/cc will not work
- #
- PATH=`echo $PATH | sed -e s:/usr/ucb::g -e s/::/:/g`
- export PATH
-
- cpu=`uname -p`
- cpudir=${cpu}-`uname -r`
- solrev=`uname -r | sh -c 'IFS=. read j n x; echo $n'`
- if [ ! -d SunOS5/${cpudir} -a ! -h SunOS5/${cpudir} ] ; then
- mkdir -p SunOS5/${cpudir}
- fi
- /bin/rm -f SunOS5/${cpudir}/Makefile
- /bin/rm -f SunOS5/${cpudir}/Makefile.ipsend
- ln -s `pwd`/SunOS5/Makefile SunOS5/${cpudir}/Makefile
- ln -s `pwd`/SunOS5/Makefile.ipsend SunOS5/${cpudir}/Makefile.ipsend
-
- #
- # Default C compiler is "cc", override on make commandline
- #
- if [ "x$CC" = "x" ] ; then
- if echo '' | cc -E - >/dev/null 2>&1 ; then
- CC=cc
- else
- if echo '' | gcc -E - >/dev/null 2>&1 ; then
- CC=gcc
- else
- echo "No working compiler found"
- exit 1
- fi
- fi
- fi
- v=`echo '__GNUC__' | 2>&1 ${CC} -E - | 2>&1 sed -ne '/^[0-9]* *$/p'`
- if [ x$v != x ] ; then
- CC=gcc
- fi
-
- case "$CC" in
- *gcc*) # gcc
- XARCH32=""
- XARCH64="-m64 -mcmodel=medlow"
- ;;
- *) # Sun C
- XARCH32="-Xa -xildoff"
- XARCH64="$XARCH32 -xarch=v9 -xchip=ultra -dalign -xcode=abs32"
- ;;
- esac
-
- export CC
-
- ISABITS=32
-
- OBJ32=sparcv7
- ARCHINC32=
- OBJ64=sparcv9
- ARCHINC64="-I/usr/include/v9"
-
- if [ $solrev -ge 7 ] && /bin/optisa sparcv8plus > /dev/null
- then
- # We run Solaris 7+ on 64 bit capable hardware.
- BUILDBOTH=true
- else
- BUILDBOTH=false
- OBJ32=.
- fi
-
- if $BUILDBOTH
- then
- echo Testing compiler $CC for 64 bit object file generation.
- t=conftest$$.c
- trap 'rm -f $t 32.out 64.out; exit 1' 0 1 2 3 15
- cat > $t <<-EOF
- #include <stdio.h>
- int main(void)
- {
- printf("%ld\n", (long) sizeof(long));
- exit(0);
- }
- EOF
-
- # Is it perhaps a 64 bit only compiler?
- if $CC $XARCH32 $t -o 32.out >/dev/null 2>&1 &&
- [ "`./32.out`" = 4 ]
- then :; else
- echo $CC $XARCH32 cannot create 32 bit executables. 1>&2
- exit 1
- fi
- if $CC $XARCH64 $t -o 64.out >/dev/null 2>&1 &&
- { out64=`./64.out 2>/dev/null` ;
- [ "$out64" = 8 -o "`isainfo -b`" = 32 -a "$out64" = "" ]
- }
- then
- echo "found 32/64 bit compiler" 1>&2
- CC64=true
- else
- CC64=false
- fi
- rm -f $t 32.out 64.out
- trap 0 1 2 3 15
- fi
-
- # If we're running 64 bit, we *must* build 64 bit.
- if ([ "`isainfo -b`" = 64 ]) 2>/dev/null ; then
- if $CC64 ; then :; else
- echo "No 64 bit capable compiler was found" 1>&2
- exit 1
- fi
- ISABITS="32 64"
- elif $BUILDBOTH && $CC64
- then
- ISABITS="32 64"
- else
- OBJ32=.
- fi
-else
- cpu=`uname -m`
- cpudir=${cpu}-`uname -r`
-fi
-
-# Default $MAKE to make
-: ${MAKE:=make}
-
-if [ $cpu = i386 ] ; then
- if [ -n "$BPFILTER" ] ; then
- BPF="BPFILTER=./$BPFILTER"
- fi
- $MAKE $MAKEFLAGS ${1+"$@"} sunos5x86 SOLARIS2="-DSOLARIS2=$solrev" CPU= CPUDIR=${cpudir} CC="$CC $XARCH32" XARCH="$XARCH32" ARCHINC="$ARCHINC32" BITS=32 OBJ=. $BPF
- exit $?
-fi
-if [ x$solrev = x ] ; then
- make ${1+"$@"} sunos$rev "TOP=.." "ARCH=`uname -m`"
- exit $?
-fi
-for b in $ISABITS
-do
- echo build $b bit binaries.
- for v in OBJ ARCHINC XARCH
- do
- eval $v=\"\$$v$b\"
- done
- if [ -n "$BPFILTER" ] ; then
- BPF="BPFILTER=$OBJ/$BPFILTER"
- fi
- $MAKE $MAKEFLAGS ${1+"$@"} sunos$rev SOLARIS2="-DSOLARIS2=$solrev" CPU= CPUDIR=${cpudir} CC="$CC $XARCH" XARCH="$XARCH" ARCHINC="$ARCHINC" BITS=$b OBJ=$OBJ $BPF || exit $?
-done
diff --git a/contrib/ipfilter/common.c b/contrib/ipfilter/common.c
deleted file mode 100644
index fa21fc97b574..000000000000
--- a/contrib/ipfilter/common.c
+++ /dev/null
@@ -1,610 +0,0 @@
-/*
- * Copyright (C) 1993-2001 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#if defined(__sgi) && (IRIX > 602)
-# include <sys/ptimers.h>
-#endif
-#include <sys/types.h>
-#if !defined(__SVR4) && !defined(__svr4__)
-#include <strings.h>
-#else
-#include <sys/byteorder.h>
-#endif
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-#include <net/if.h>
-#if __FreeBSD_version >= 300000
-# include <net/if_var.h>
-#endif
-#include <stdio.h>
-#include <string.h>
-#include <limits.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stddef.h>
-#include <netdb.h>
-#include <arpa/nameser.h>
-#include <arpa/inet.h>
-#include <resolv.h>
-#include <ctype.h>
-#include <syslog.h>
-#include "ip_compat.h"
-#include "ip_fil.h"
-#include "ipf.h"
-#include "facpri.h"
-
-#if !defined(lint)
-static const char sccsid[] = "@(#)parse.c 1.44 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$IPFilter: parse.c,v 2.8 1999/12/28 10:49:46 darrenr Exp $";
-#endif
-
-extern struct ipopt_names ionames[], secclass[];
-extern int opts;
-extern int use_inet6;
-
-
-char *proto = NULL;
-char flagset[] = "FSRPAUEC";
-u_char flags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, TH_ACK, TH_URG,
- TH_ECN, TH_CWR };
-
-void fill6bits __P((int, u_32_t *));
-int count6bits __P((u_32_t *));
-
-static char thishost[MAXHOSTNAMELEN];
-
-
-void initparse()
-{
- gethostname(thishost, sizeof(thishost));
- thishost[sizeof(thishost) - 1] = '\0';
-}
-
-
-int genmask(msk, mskp)
-char *msk;
-u_32_t *mskp;
-{
- char *endptr = NULL;
-#ifdef USE_INET6
- u_32_t addr;
-#endif
- int bits;
-
- if (index(msk, '.') || index(msk, 'x') || index(msk, ':')) {
- /* possibly of the form xxx.xxx.xxx.xxx
- * or 0xYYYYYYYY */
-#ifdef USE_INET6
- if (use_inet6) {
- if (inet_pton(AF_INET6, msk, &addr) != 1)
- return -1;
- } else
-#endif
- if (inet_aton(msk, (struct in_addr *)mskp) == 0)
- return -1;
- } else {
- /*
- * set x most significant bits
- */
- bits = (int)strtol(msk, &endptr, 0);
- if ((*endptr != '\0') ||
- ((bits > 32) && !use_inet6) || (bits < 0) ||
- ((bits > 128) && use_inet6))
- return -1;
- if (use_inet6)
- fill6bits(bits, mskp);
- else {
- if (bits == 0)
- *mskp = 0;
- else
- *mskp = htonl(0xffffffff << (32 - bits));
- }
- }
- return 0;
-}
-
-
-
-void fill6bits(bits, msk)
-int bits;
-u_32_t *msk;
-{
- int i;
-
- for (i = 0; bits >= 32 && i < 4 ; ++i, bits -= 32)
- msk[i] = 0xffffffff;
-
- if (bits > 0 && i < 4)
- msk[i++] = htonl(0xffffffff << (32 - bits));
-
- while (i < 4)
- msk[i++] = 0;
-}
-
-
-/*
- * returns -1 if neither "hostmask/num" or "hostmask mask addr" are
- * found in the line segments, there is an error processing this information,
- * or there is an error processing ports information.
- */
-int hostmask(seg, sa, msk, pp, cp, tp, linenum)
-char ***seg;
-u_32_t *sa, *msk;
-u_short *pp, *tp;
-int *cp;
-int linenum;
-{
- struct in_addr maskaddr;
- char *s;
-
- /*
- * is it possibly hostname/num ?
- */
- if ((s = index(**seg, '/')) ||
- ((s = index(**seg, ':')) && !index(s + 1, ':'))) {
- *s++ = '\0';
- if (genmask(s, msk) == -1) {
- fprintf(stderr, "%d: bad mask (%s)\n", linenum, s);
- return -1;
- }
- if (hostnum(sa, **seg, linenum) == -1) {
- fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
- return -1;
- }
- *sa &= *msk;
- (*seg)++;
- return ports(seg, pp, cp, tp, linenum);
- }
-
- /*
- * look for extra segments if "mask" found in right spot
- */
- if (*(*seg+1) && *(*seg+2) && !strcasecmp(*(*seg+1), "mask")) {
- if (hostnum(sa, **seg, linenum) == -1) {
- fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
- return -1;
- }
- (*seg)++;
- (*seg)++;
- if (inet_aton(**seg, &maskaddr) == 0) {
- fprintf(stderr, "%d: bad mask (%s)\n", linenum, **seg);
- return -1;
- }
- *msk = maskaddr.s_addr;
- (*seg)++;
- *sa &= *msk;
- return ports(seg, pp, cp, tp, linenum);
- }
-
- if (**seg) {
- if (hostnum(sa, **seg, linenum) == -1) {
- fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
- return -1;
- }
- (*seg)++;
- if (use_inet6) {
- u_32_t k = 0;
- if (sa[0] || sa[1] || sa[2] || sa[3])
- k = 0xffffffff;
- msk[0] = msk[1] = msk[2] = msk[3] = k;
- }
- else
- *msk = *sa ? 0xffffffff : 0;
- return ports(seg, pp, cp, tp, linenum);
- }
- fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
- return -1;
-}
-
-/*
- * returns an ip address as a long var as a result of either a DNS lookup or
- * straight inet_addr() call
- */
-int hostnum(ipa, host, linenum)
-u_32_t *ipa;
-char *host;
-int linenum;
-{
- struct hostent *hp;
- struct netent *np;
- struct in_addr ip;
-
- if (!strcasecmp("any", host))
- return 0;
-#ifdef USE_INET6
- if (use_inet6) {
- if (inet_pton(AF_INET6, host, ipa) == 1)
- return 0;
- else
- return -1;
- }
-#endif
- if (isdigit(*host) && inet_aton(host, &ip)) {
- *ipa = ip.s_addr;
- return 0;
- }
-
- if (!strcasecmp("<thishost>", host))
- host = thishost;
-
- if (!(hp = gethostbyname(host))) {
- if (!(np = getnetbyname(host))) {
- fprintf(stderr, "%d: can't resolve hostname: %s\n",
- linenum, host);
- return -1;
- }
- *ipa = htonl(np->n_net);
- return 0;
- }
- *ipa = *(u_32_t *)hp->h_addr;
- return 0;
-}
-
-
-/*
- * check for possible presence of the port fields in the line
- */
-int ports(seg, pp, cp, tp, linenum)
-char ***seg;
-u_short *pp, *tp;
-int *cp;
-int linenum;
-{
- int comp = -1;
-
- if (!*seg || !**seg || !***seg)
- return 0;
- if (!strcasecmp(**seg, "port") && *(*seg + 1) && *(*seg + 2)) {
- (*seg)++;
- if (!strcmp(**seg, "=") || !strcasecmp(**seg, "eq"))
- comp = FR_EQUAL;
- else if (!strcmp(**seg, "!=") || !strcasecmp(**seg, "ne"))
- comp = FR_NEQUAL;
- else if (!strcmp(**seg, "<") || !strcasecmp(**seg, "lt"))
- comp = FR_LESST;
- else if (!strcmp(**seg, ">") || !strcasecmp(**seg, "gt"))
- comp = FR_GREATERT;
- else if (!strcmp(**seg, "<=") || !strcasecmp(**seg, "le"))
- comp = FR_LESSTE;
- else if (!strcmp(**seg, ">=") || !strcasecmp(**seg, "ge"))
- comp = FR_GREATERTE;
- else if (isalnum(***seg) && *(*seg + 2)) {
- if (portnum(**seg, pp, linenum) == 0)
- return -1;
- (*seg)++;
- if (!strcmp(**seg, "<>"))
- comp = FR_OUTRANGE;
- else if (!strcmp(**seg, "><"))
- comp = FR_INRANGE;
- else {
- fprintf(stderr,
- "%d: unknown range operator (%s)\n",
- linenum, **seg);
- return -1;
- }
- (*seg)++;
- if (**seg == NULL) {
- fprintf(stderr, "%d: missing 2nd port value\n",
- linenum);
- return -1;
- }
- if (portnum(**seg, tp, linenum) == 0)
- return -1;
- } else {
- fprintf(stderr, "%d: unknown comparator (%s)\n",
- linenum, **seg);
- return -1;
- }
- if (comp != FR_OUTRANGE && comp != FR_INRANGE) {
- (*seg)++;
- if (portnum(**seg, pp, linenum) == 0)
- return -1;
- }
- *cp = comp;
- (*seg)++;
- }
- return 0;
-}
-
-
-/*
- * find the port number given by the name, either from getservbyname() or
- * straight atoi(). Return 1 on success, 0 on failure
- */
-int portnum(name, port, linenum)
-char *name;
-u_short *port;
-int linenum;
-{
- struct servent *sp, *sp2;
- u_short p1 = 0;
- int i;
-
- if (isdigit(*name)) {
- if (ratoi(name, &i, 0, USHRT_MAX)) {
- *port = (u_short)i;
- return 1;
- }
- fprintf(stderr, "%d: unknown port \"%s\"\n", linenum, name);
- return 0;
- }
- if (proto != NULL && strcasecmp(proto, "tcp/udp") != 0) {
- sp = getservbyname(name, proto);
- if (sp) {
- *port = ntohs(sp->s_port);
- return 1;
- }
- fprintf(stderr, "%d: unknown service \"%s\".\n", linenum, name);
- return 0;
- }
- sp = getservbyname(name, "tcp");
- if (sp)
- p1 = sp->s_port;
- sp2 = getservbyname(name, "udp");
- if (!sp || !sp2) {
- fprintf(stderr, "%d: unknown tcp/udp service \"%s\".\n",
- linenum, name);
- return 0;
- }
- if (p1 != sp2->s_port) {
- fprintf(stderr, "%d: %s %d/tcp is a different port to ",
- linenum, name, p1);
- fprintf(stderr, "%d: %s %d/udp\n", linenum, name, sp->s_port);
- return 0;
- }
- *port = ntohs(p1);
- return 1;
-}
-
-
-u_char tcp_flags(flgs, mask, linenum)
-char *flgs;
-u_char *mask;
-int linenum;
-{
- u_char tcpf = 0, tcpfm = 0, *fp = &tcpf;
- char *s, *t;
-
- if (*flgs == '0') {
- s = strchr(flgs, '/');
- if (s)
- *s++ = '\0';
- tcpf = strtol(flgs, NULL, 0);
- fp = &tcpfm;
- } else
- s = flgs;
-
- for (; *s; s++) {
- if (*s == '/' && fp == &tcpf) {
- fp = &tcpfm;
- if (*(s + 1) == '0')
- break;
- continue;
- }
- if (!(t = index(flagset, *s))) {
- fprintf(stderr, "%d: unknown flag (%c)\n", linenum, *s);
- return 0;
- }
- *fp |= flags[t - flagset];
- }
-
- if (s && *s == '0')
- tcpfm = strtol(s, NULL, 0);
-
- if (!tcpfm) {
- if (tcpf == TH_SYN)
- tcpfm = 0xff & ~(TH_ECN|TH_CWR);
- else
- tcpfm = 0xff & ~(TH_ECN);
- }
- *mask = tcpfm;
- return tcpf;
-}
-
-
-/*
- * count consecutive 1's in bit mask. If the mask generated by counting
- * consecutive 1's is different to that passed, return -1, else return #
- * of bits.
- */
-int countbits(ip)
-u_32_t ip;
-{
- u_32_t ipn;
- int cnt = 0, i, j;
-
- ip = ipn = ntohl(ip);
- for (i = 32; i; i--, ipn *= 2)
- if (ipn & 0x80000000)
- cnt++;
- else
- break;
- ipn = 0;
- for (i = 32, j = cnt; i; i--, j--) {
- ipn *= 2;
- if (j > 0)
- ipn++;
- }
- if (ipn == ip)
- return cnt;
- return -1;
-}
-
-
-int count6bits(msk)
-u_32_t *msk;
-{
- int i = 0, k;
- u_32_t j;
-
- for (k = 3; k >= 0; k--)
- if (msk[k] == 0xffffffff)
- i += 32;
- else {
- for (j = msk[k]; j; j <<= 1)
- if (j & 0x80000000)
- i++;
- }
- return i;
-}
-
-
-char *portname(pr, port)
-int pr, port;
-{
- static char buf[32];
- struct protoent *p = NULL;
- struct servent *sv = NULL, *sv1 = NULL;
-
- if (pr == -1) {
- if ((sv = getservbyport(htons(port), "tcp"))) {
- strncpy(buf, sv->s_name, sizeof(buf)-1);
- buf[sizeof(buf)-1] = '\0';
- sv1 = getservbyport(htons(port), "udp");
- sv = strncasecmp(buf, sv->s_name, strlen(buf)) ?
- NULL : sv1;
- }
- if (sv)
- return buf;
- } else if (pr && (p = getprotobynumber(pr))) {
- if ((sv = getservbyport(htons(port), p->p_name))) {
- strncpy(buf, sv->s_name, sizeof(buf)-1);
- buf[sizeof(buf)-1] = '\0';
- return buf;
- }
- }
-
- (void) sprintf(buf, "%d", port);
- return buf;
-}
-
-
-int ratoi(ps, pi, min, max)
-char *ps;
-int *pi, min, max;
-{
- int i;
- char *pe;
-
- i = (int)strtol(ps, &pe, 0);
- if (*pe != '\0' || i < min || i > max)
- return 0;
- *pi = i;
- return 1;
-}
-
-
-int ratoui(ps, pi, min, max)
-char *ps;
-u_int *pi, min, max;
-{
- u_int i;
- char *pe;
-
- i = (u_int)strtol(ps, &pe, 0);
- if (*pe != '\0' || i < min || i > max)
- return 0;
- *pi = i;
- return 1;
-}
-
-
-void printhostmask(v, addr, mask)
-int v;
-u_32_t *addr, *mask;
-{
- struct in_addr ipa;
- int ones;
-
-#ifdef USE_INET6
- if (v == 6) {
- ones = count6bits(mask);
- if (ones == 0 && !addr[0] && !addr[1] && !addr[2] && !addr[3])
- printf("any");
- else {
- char ipbuf[64];
- printf("%s/%d",
- inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf)),
- ones);
- }
- }
- else
-#endif
- if (!*addr && !*mask)
- printf("any");
- else {
- ipa.s_addr = *addr;
- printf("%s", inet_ntoa(ipa));
- if ((ones = countbits(*mask)) == -1) {
- ipa.s_addr = *mask;
- printf("/%s", inet_ntoa(ipa));
- } else
- printf("/%d", ones);
- }
-}
-
-
-void printportcmp(pr, frp)
-int pr;
-frpcmp_t *frp;
-{
- static char *pcmp1[] = { "*", "=", "!=", "<", ">", "<=", ">=",
- "<>", "><"};
-
- if (frp->frp_cmp == FR_INRANGE || frp->frp_cmp == FR_OUTRANGE)
- printf(" port %d %s %d", frp->frp_port,
- pcmp1[frp->frp_cmp], frp->frp_top);
- else
- printf(" port %s %s", pcmp1[frp->frp_cmp],
- portname(pr, frp->frp_port));
-}
-
-
-void printbuf(buf, len, zend)
-char *buf;
-int len, zend;
-{
- char *s, c;
- int i;
-
- for (s = buf, i = len; i; i--) {
- c = *s++;
- if (isprint(c))
- putchar(c);
- else
- printf("\\%03o", c);
- if ((c == '\0') && zend)
- break;
- }
-}
-
-
-
-char *hostname(v, ip)
-int v;
-void *ip;
-{
-#ifdef USE_INET6
- static char hostbuf[MAXHOSTNAMELEN+1];
-#endif
- struct in_addr ipa;
-
- if (v == 4) {
- ipa.s_addr = *(u_32_t *)ip;
- return inet_ntoa(ipa);
- }
-#ifdef USE_INET6
- (void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1);
- hostbuf[MAXHOSTNAMELEN] = '\0';
- return hostbuf;
-#else
- return "IPv6";
-#endif
-}
diff --git a/contrib/ipfilter/etc/etc.sed b/contrib/ipfilter/etc/etc.sed
deleted file mode 100644
index b14fc74851d7..000000000000
--- a/contrib/ipfilter/etc/etc.sed
+++ /dev/null
@@ -1,2 +0,0 @@
- . ..'! CVS
- protocols
diff --git a/contrib/ipfilter/facpri.c b/contrib/ipfilter/facpri.c
deleted file mode 100644
index 79afdd214729..000000000000
--- a/contrib/ipfilter/facpri.c
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Copyright (C) 1993-2001 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#include <stdio.h>
-#include <string.h>
-#include <limits.h>
-#include <sys/types.h>
-#if !defined(__SVR4) && !defined(__svr4__)
-#include <strings.h>
-#endif
-#include <stdlib.h>
-#include <unistd.h>
-#include <stddef.h>
-#include <syslog.h>
-#include "facpri.h"
-
-#ifndef __STDC__
-# define const
-#endif
-
-#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3.2.4 2001/07/15 22:06:12 darrenr Exp $";
-#endif
-
-typedef struct table {
- char *name;
- int value;
-} table_t;
-
-table_t facs[] = {
- { "kern", LOG_KERN }, { "user", LOG_USER },
- { "mail", LOG_MAIL }, { "daemon", LOG_DAEMON },
- { "auth", LOG_AUTH }, { "syslog", LOG_SYSLOG },
- { "lpr", LOG_LPR }, { "news", LOG_NEWS },
- { "uucp", LOG_UUCP },
-#if LOG_CRON == LOG_CRON2
- { "cron2", LOG_CRON1 },
-#else
- { "cron", LOG_CRON1 },
-#endif
-#ifdef LOG_FTP
- { "ftp", LOG_FTP },
-#endif
-#ifdef LOG_AUTHPRIV
- { "authpriv", LOG_AUTHPRIV },
-#endif
-#ifdef LOG_AUDIT
- { "audit", LOG_AUDIT },
-#endif
-#ifdef LOG_LFMT
- { "logalert", LOG_LFMT },
-#endif
-#if LOG_CRON == LOG_CRON1
- { "cron", LOG_CRON2 },
-#else
- { "cron2", LOG_CRON2 },
-#endif
-#ifdef LOG_SECURITY
- { "security", LOG_SECURITY },
-#endif
- { "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 },
- { "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 },
- { "local4", LOG_LOCAL4 }, { "local5", LOG_LOCAL5 },
- { "local6", LOG_LOCAL6 }, { "local7", LOG_LOCAL7 },
- { NULL, 0 }
-};
-
-
-/*
- * map a facility number to its name
- */
-char *
-fac_toname(facpri)
- int facpri;
-{
- int i, j, fac;
-
- fac = facpri & LOG_FACMASK;
- j = fac >> 3;
- if (j < 24) {
- if (facs[j].value == fac)
- return facs[j].name;
- for (i = 0; facs[i].name; i++)
- if (fac == facs[i].value)
- return facs[i].name;
- }
-
- return NULL;
-}
-
-
-/*
- * map a facility name to its number
- */
-int
-fac_findname(name)
- char *name;
-{
- int i;
-
- for (i = 0; facs[i].name; i++)
- if (!strcmp(facs[i].name, name))
- return facs[i].value;
- return -1;
-}
-
-
-table_t pris[] = {
- { "emerg", LOG_EMERG }, { "alert", LOG_ALERT },
- { "crit", LOG_CRIT }, { "err", LOG_ERR },
- { "warn", LOG_WARNING }, { "notice", LOG_NOTICE },
- { "info", LOG_INFO }, { "debug", LOG_DEBUG },
- { NULL, 0 }
-};
-
-
-/*
- * map a priority name to its number
- */
-int
-pri_findname(name)
- char *name;
-{
- int i;
-
- for (i = 0; pris[i].name; i++)
- if (!strcmp(pris[i].name, name))
- return pris[i].value;
- return -1;
-}
-
-
-/*
- * map a priority number to its name
- */
-char *
-pri_toname(facpri)
- int facpri;
-{
- int i, pri;
-
- pri = facpri & LOG_PRIMASK;
- if (pris[pri].value == pri)
- return pris[pri].name;
- for (i = 0; pris[i].name; i++)
- if (pri == pris[i].value)
- return pris[i].name;
- return NULL;
-}
diff --git a/contrib/ipfilter/facpri.h b/contrib/ipfilter/facpri.h
deleted file mode 100644
index 7b80377d112e..000000000000
--- a/contrib/ipfilter/facpri.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) 1999-2001 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- * $Id: facpri.h,v 1.3.2.1 2001/06/26 10:43:11 darrenr Exp $
- */
-
-#ifndef __FACPRI_H__
-#define __FACPRI_H__
-
-#ifndef __P
-# define P_DEF
-# ifdef __STDC__
-# define __P(x) x
-# else
-# define __P(x) ()
-# endif
-#endif
-
-extern char *fac_toname __P((int));
-extern int fac_findname __P((char *));
-
-extern char *pri_toname __P((int));
-extern int pri_findname __P((char *));
-
-#ifdef P_DEF
-# undef __P
-# undef P_DEF
-#endif
-
-#if LOG_CRON == (9<<3)
-# define LOG_CRON1 LOG_CRON
-# define LOG_CRON2 (15<<3)
-#endif
-#if LOG_CRON == (15<<3)
-# define LOG_CRON1 (9<<3)
-# define LOG_CRON2 LOG_CRON
-#endif
-
-#endif /* __FACPRI_H__ */
diff --git a/contrib/ipfilter/fil.c b/contrib/ipfilter/fil.c
deleted file mode 100644
index 6f3a13d57889..000000000000
--- a/contrib/ipfilter/fil.c
+++ /dev/null
@@ -1,6209 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2003 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#if defined(KERNEL) || defined(_KERNEL)
-# undef KERNEL
-# undef _KERNEL
-# define KERNEL 1
-# define _KERNEL 1
-#endif
-#include <sys/errno.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#if defined(__NetBSD__)
-# if (NetBSD >= 199905) && !defined(IPFILTER_LKM) && defined(_KERNEL)
-# include "opt_ipfilter_log.h"
-# endif
-#endif
-#if defined(_KERNEL) && defined(__FreeBSD_version) && \
- (__FreeBSD_version >= 220000)
-# if (__FreeBSD_version >= 400000)
-# if !defined(IPFILTER_LKM)
-# include "opt_inet6.h"
-# endif
-# if (__FreeBSD_version == 400019)
-# define CSUM_DELAY_DATA
-# endif
-# endif
-# include <sys/filio.h>
-#else
-# include <sys/ioctl.h>
-#endif
-#include <sys/fcntl.h>
-#if defined(_KERNEL)
-# include <sys/systm.h>
-# include <sys/file.h>
-#else
-# include <stdio.h>
-# include <string.h>
-# include <stdlib.h>
-# include <stddef.h>
-# include <sys/file.h>
-# define _KERNEL
-# ifdef __OpenBSD__
-struct file;
-# endif
-# include <sys/uio.h>
-# undef _KERNEL
-#endif
-#if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \
- !defined(linux)
-# include <sys/mbuf.h>
-#else
-# if !defined(linux)
-# include <sys/byteorder.h>
-# endif
-# if (SOLARIS2 < 5) && defined(sun)
-# include <sys/dditypes.h>
-# endif
-#endif
-#ifdef __hpux
-# define _NET_ROUTE_INCLUDED
-#endif
-#if !defined(linux)
-# include <sys/protosw.h>
-#endif
-#include <sys/socket.h>
-#include <net/if.h>
-#ifdef sun
-# include <net/af.h>
-#endif
-#if !defined(_KERNEL) && defined(__FreeBSD__)
-# include "radix_ipf.h"
-#endif
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#if !defined(linux)
-# include <netinet/ip_var.h>
-#endif
-#if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
-# include <sys/hashing.h>
-# include <netinet/in_var.h>
-#endif
-#include <netinet/tcp.h>
-#if !defined(__sgi) || defined(_KERNEL)
-# include <netinet/udp.h>
-# include <netinet/ip_icmp.h>
-#endif
-#ifdef __hpux
-# undef _NET_ROUTE_INCLUDED
-#endif
-#include "netinet/ip_compat.h"
-#ifdef USE_INET6
-# include <netinet/icmp6.h>
-# if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux)
-# include <netinet6/in6_var.h>
-# endif
-#endif
-#include <netinet/tcpip.h>
-#include "netinet/ip_fil.h"
-#include "netinet/ip_nat.h"
-#include "netinet/ip_frag.h"
-#include "netinet/ip_state.h"
-#include "netinet/ip_proxy.h"
-#include "netinet/ip_auth.h"
-#ifdef IPFILTER_SCAN
-# include "netinet/ip_scan.h"
-#endif
-#ifdef IPFILTER_SYNC
-# include "netinet/ip_sync.h"
-#endif
-#include "netinet/ip_pool.h"
-#include "netinet/ip_htable.h"
-#ifdef IPFILTER_COMPILED
-# include "netinet/ip_rules.h"
-#endif
-#if defined(IPFILTER_BPF) && defined(_KERNEL)
-# include <net/bpf.h>
-#endif
-#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
-# include <sys/malloc.h>
-# if defined(_KERNEL) && !defined(IPFILTER_LKM)
-# include "opt_ipfilter.h"
-# endif
-#endif
-#include "netinet/ipl.h"
-/* END OF INCLUDES */
-
-#if !defined(lint)
-static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)Id: fil.c,v 2.243.2.57 2005/03/28 10:47:50 darrenr Exp";
-#endif
-
-#ifndef _KERNEL
-# include "ipf.h"
-# include "ipt.h"
-# include "bpf-ipf.h"
-extern int opts;
-
-# define FR_VERBOSE(verb_pr) verbose verb_pr
-# define FR_DEBUG(verb_pr) debug verb_pr
-#else /* #ifndef _KERNEL */
-# define FR_VERBOSE(verb_pr)
-# define FR_DEBUG(verb_pr)
-#endif /* _KERNEL */
-
-
-fr_info_t frcache[2][8];
-struct filterstats frstats[2] = { { 0, 0, 0, 0, 0 }, { 0, 0, 0, 0, 0 } };
-struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
- *ipfilter6[2][2] = { { NULL, NULL }, { NULL, NULL } },
- *ipacct6[2][2] = { { NULL, NULL }, { NULL, NULL } },
- *ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } },
- *ipnatrules[2][2] = { { NULL, NULL }, { NULL, NULL } };
-struct frgroup *ipfgroups[IPL_LOGSIZE][2];
-char ipfilter_version[] = IPL_VERSION;
-int fr_refcnt = 0;
-/*
- * For fr_running:
- * 0 == loading, 1 = running, -1 = disabled, -2 = unloading
- */
-int fr_running = 0;
-int fr_flags = IPF_LOGGING;
-int fr_active = 0;
-int fr_control_forwarding = 0;
-int fr_update_ipid = 0;
-u_short fr_ip_id = 0;
-int fr_chksrc = 0; /* causes a system crash if enabled */
-int fr_minttl = 4;
-u_long fr_frouteok[2] = {0, 0};
-u_long fr_userifqs = 0;
-u_long fr_badcoalesces[2] = {0, 0};
-u_char ipf_iss_secret[32];
-#if defined(IPFILTER_DEFAULT_BLOCK)
-int fr_pass = FR_BLOCK|FR_NOMATCH;
-#else
-int fr_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH;
-#endif
-int fr_features = 0
-#ifdef IPFILTER_LKM
- | IPF_FEAT_LKM
-#endif
-#ifdef IPFILTER_LOG
- | IPF_FEAT_LOG
-#endif
-#ifdef IPFILTER_LOOKUP
- | IPF_FEAT_LOOKUP
-#endif
-#ifdef IPFILTER_BPF
- | IPF_FEAT_BPF
-#endif
-#ifdef IPFILTER_COMPILED
- | IPF_FEAT_COMPILED
-#endif
-#ifdef IPFILTER_CKSUM
- | IPF_FEAT_CKSUM
-#endif
-#ifdef IPFILTER_SYNC
- | IPF_FEAT_SYNC
-#endif
-#ifdef IPFILTER_SCAN
- | IPF_FEAT_SCAN
-#endif
-#ifdef USE_INET6
- | IPF_FEAT_IPV6
-#endif
- ;
-
-static INLINE int fr_ipfcheck __P((fr_info_t *, frentry_t *, int));
-static int fr_portcheck __P((frpcmp_t *, u_short *));
-static int frflushlist __P((int, minor_t, int *, frentry_t **));
-static ipfunc_t fr_findfunc __P((ipfunc_t));
-static frentry_t *fr_firewall __P((fr_info_t *, u_32_t *));
-static int fr_funcinit __P((frentry_t *fr));
-static INLINE void frpr_esp __P((fr_info_t *));
-static INLINE void frpr_gre __P((fr_info_t *));
-static INLINE void frpr_udp __P((fr_info_t *));
-static INLINE void frpr_tcp __P((fr_info_t *));
-static INLINE void frpr_icmp __P((fr_info_t *));
-static INLINE void frpr_ipv4hdr __P((fr_info_t *));
-static INLINE int frpr_pullup __P((fr_info_t *, int));
-static INLINE void frpr_short __P((fr_info_t *, int));
-static INLINE void frpr_tcpcommon __P((fr_info_t *));
-static INLINE void frpr_udpcommon __P((fr_info_t *));
-static INLINE int fr_updateipid __P((fr_info_t *));
-#ifdef IPFILTER_LOOKUP
-static int fr_grpmapinit __P((frentry_t *fr));
-static INLINE void *fr_resolvelookup __P((u_int, u_int, lookupfunc_t *));
-#endif
-static void frsynclist __P((frentry_t *, void *));
-static ipftuneable_t *fr_findtunebyname __P((char *));
-static ipftuneable_t *fr_findtunebycookie __P((void *, void **));
-
-
-/*
- * bit values for identifying presence of individual IP options
- * All of these tables should be ordered by increasing key value on the left
- * hand side to allow for binary searching of the array and include a trailer
- * with a 0 for the bitmask for linear searches to easily find the end with.
- */
-const struct optlist ipopts[20] = {
- { IPOPT_NOP, 0x000001 },
- { IPOPT_RR, 0x000002 },
- { IPOPT_ZSU, 0x000004 },
- { IPOPT_MTUP, 0x000008 },
- { IPOPT_MTUR, 0x000010 },
- { IPOPT_ENCODE, 0x000020 },
- { IPOPT_TS, 0x000040 },
- { IPOPT_TR, 0x000080 },
- { IPOPT_SECURITY, 0x000100 },
- { IPOPT_LSRR, 0x000200 },
- { IPOPT_E_SEC, 0x000400 },
- { IPOPT_CIPSO, 0x000800 },
- { IPOPT_SATID, 0x001000 },
- { IPOPT_SSRR, 0x002000 },
- { IPOPT_ADDEXT, 0x004000 },
- { IPOPT_VISA, 0x008000 },
- { IPOPT_IMITD, 0x010000 },
- { IPOPT_EIP, 0x020000 },
- { IPOPT_FINN, 0x040000 },
- { 0, 0x000000 }
-};
-
-#ifdef USE_INET6
-struct optlist ip6exthdr[] = {
- { IPPROTO_HOPOPTS, 0x000001 },
- { IPPROTO_IPV6, 0x000002 },
- { IPPROTO_ROUTING, 0x000004 },
- { IPPROTO_FRAGMENT, 0x000008 },
- { IPPROTO_ESP, 0x000010 },
- { IPPROTO_AH, 0x000020 },
- { IPPROTO_NONE, 0x000040 },
- { IPPROTO_DSTOPTS, 0x000080 },
- { 0, 0 }
-};
-#endif
-
-struct optlist tcpopts[] = {
- { TCPOPT_NOP, 0x000001 },
- { TCPOPT_MAXSEG, 0x000002 },
- { TCPOPT_WINDOW, 0x000004 },
- { TCPOPT_SACK_PERMITTED, 0x000008 },
- { TCPOPT_SACK, 0x000010 },
- { TCPOPT_TIMESTAMP, 0x000020 },
- { 0, 0x000000 }
-};
-
-/*
- * bit values for identifying presence of individual IP security options
- */
-const struct optlist secopt[8] = {
- { IPSO_CLASS_RES4, 0x01 },
- { IPSO_CLASS_TOPS, 0x02 },
- { IPSO_CLASS_SECR, 0x04 },
- { IPSO_CLASS_RES3, 0x08 },
- { IPSO_CLASS_CONF, 0x10 },
- { IPSO_CLASS_UNCL, 0x20 },
- { IPSO_CLASS_RES2, 0x40 },
- { IPSO_CLASS_RES1, 0x80 }
-};
-
-
-/*
- * Table of functions available for use with call rules.
- */
-static ipfunc_resolve_t fr_availfuncs[] = {
-#ifdef IPFILTER_LOOKUP
- { "fr_srcgrpmap", fr_srcgrpmap, fr_grpmapinit },
- { "fr_dstgrpmap", fr_dstgrpmap, fr_grpmapinit },
-#endif
- { "", NULL }
-};
-
-
-/*
- * The next section of code is a a collection of small routines that set
- * fields in the fr_info_t structure passed based on properties of the
- * current packet. There are different routines for the same protocol
- * for each of IPv4 and IPv6. Adding a new protocol, for which there
- * will "special" inspection for setup, is now more easily done by adding
- * a new routine and expanding the frpr_ipinit*() function rather than by
- * adding more code to a growing switch statement.
- */
-#ifdef USE_INET6
-static INLINE void frpr_udp6 __P((fr_info_t *));
-static INLINE void frpr_tcp6 __P((fr_info_t *));
-static INLINE void frpr_icmp6 __P((fr_info_t *));
-static INLINE void frpr_ipv6hdr __P((fr_info_t *));
-static INLINE void frpr_short6 __P((fr_info_t *, int));
-static INLINE int frpr_hopopts6 __P((fr_info_t *));
-static INLINE int frpr_routing6 __P((fr_info_t *));
-static INLINE int frpr_dstopts6 __P((fr_info_t *));
-static INLINE int frpr_fragment6 __P((fr_info_t *));
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_short6 */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* This is function enforces the 'is a packet too short to be legit' rule */
-/* for IPv6 and marks the packet with FI_SHORT if so. See function comment */
-/* for frpr_short() for more details. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_short6(fin, min)
-fr_info_t *fin;
-int min;
-{
- fr_ip_t *fi = &fin->fin_fi;
- int off;
-
- off = fin->fin_off;
- if (off == 0) {
- if (fin->fin_plen < fin->fin_hlen + min)
- fi->fi_flx |= FI_SHORT;
- } else if (off < min) {
- fi->fi_flx |= FI_SHORT;
- }
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_ipv6hdr */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* Copy values from the IPv6 header into the fr_info_t struct and call the */
-/* per-protocol analyzer if it exists. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_ipv6hdr(fin)
-fr_info_t *fin;
-{
- int p, go = 1, i, hdrcount, coalesced;
- ip6_t *ip6 = (ip6_t *)fin->fin_ip;
- fr_ip_t *fi = &fin->fin_fi;
-
- fin->fin_off = 0;
-
- fi->fi_tos = 0;
- fi->fi_optmsk = 0;
- fi->fi_secmsk = 0;
- fi->fi_auth = 0;
-
- coalesced = (fin->fin_flx & FI_COALESCE) ? 1 : 0;
- p = ip6->ip6_nxt;
- fi->fi_ttl = ip6->ip6_hlim;
- fi->fi_src.in6 = ip6->ip6_src;
- fi->fi_dst.in6 = ip6->ip6_dst;
- fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
-
- hdrcount = 0;
- while (go && !(fin->fin_flx & (FI_BAD|FI_SHORT))) {
- switch (p)
- {
- case IPPROTO_UDP :
- frpr_udp6(fin);
- go = 0;
- break;
-
- case IPPROTO_TCP :
- frpr_tcp6(fin);
- go = 0;
- break;
-
- case IPPROTO_ICMPV6 :
- frpr_icmp6(fin);
- go = 0;
- break;
-
- case IPPROTO_GRE :
- frpr_gre(fin);
- go = 0;
- break;
-
- case IPPROTO_HOPOPTS :
- /*
- * Actually, hop by hop header is only allowed right
- * after IPv6 header!
- */
- if (hdrcount != 0)
- fin->fin_flx |= FI_BAD;
-
- if (coalesced == 0) {
- coalesced = fr_coalesce(fin);
- if (coalesced != 1)
- return;
- }
- p = frpr_hopopts6(fin);
- break;
-
- case IPPROTO_DSTOPTS :
- if (coalesced == 0) {
- coalesced = fr_coalesce(fin);
- if (coalesced != 1)
- return;
- }
- p = frpr_dstopts6(fin);
- break;
-
- case IPPROTO_ROUTING :
- if (coalesced == 0) {
- coalesced = fr_coalesce(fin);
- if (coalesced != 1)
- return;
- }
- p = frpr_routing6(fin);
- break;
-
- case IPPROTO_ESP :
- frpr_esp(fin);
- /*FALLTHROUGH*/
- case IPPROTO_AH :
- case IPPROTO_IPV6 :
- for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
- if (ip6exthdr[i].ol_val == p) {
- fin->fin_flx |= ip6exthdr[i].ol_bit;
- break;
- }
- go = 0;
- break;
-
- case IPPROTO_NONE :
- go = 0;
- break;
-
- case IPPROTO_FRAGMENT :
- if (coalesced == 0) {
- coalesced = fr_coalesce(fin);
- if (coalesced != 1)
- return;
- }
- p = frpr_fragment6(fin);
- break;
-
- default :
- go = 0;
- break;
- }
- hdrcount++;
-
- /*
- * It is important to note that at this point, for the
- * extension headers (go != 0), the entire header may not have
- * been pulled up when the code gets to this point. This is
- * only done for "go != 0" because the other header handlers
- * will all pullup their complete header and the other
- * indicator of an incomplete header is that this eas just an
- * extension header.
- */
- if ((go != 0) && (p != IPPROTO_NONE) &&
- (frpr_pullup(fin, 0) == -1)) {
- p = IPPROTO_NONE;
- go = 0;
- }
- }
- fi->fi_p = p;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_hopopts6 */
-/* Returns: int - value of the next header or IPPROTO_NONE if error */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* This is function checks pending hop by hop options extension header */
-/* ------------------------------------------------------------------------ */
-static INLINE int frpr_hopopts6(fin)
-fr_info_t *fin;
-{
- struct ip6_ext *hdr;
- u_short shift;
- int i;
-
- fin->fin_flx |= FI_V6EXTHDR;
-
- /* 8 is default length of extension hdr */
- if ((fin->fin_dlen - 8) < 0) {
- fin->fin_flx |= FI_SHORT;
- return IPPROTO_NONE;
- }
-
- if (frpr_pullup(fin, 8) == -1)
- return IPPROTO_NONE;
-
- hdr = fin->fin_dp;
- shift = 8 + (hdr->ip6e_len << 3);
- if (shift > fin->fin_dlen) { /* Nasty extension header length? */
- fin->fin_flx |= FI_BAD;
- return IPPROTO_NONE;
- }
-
- for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
- if (ip6exthdr[i].ol_val == IPPROTO_HOPOPTS) {
- fin->fin_optmsk |= ip6exthdr[i].ol_bit;
- break;
- }
-
- fin->fin_dp = (char *)fin->fin_dp + shift;
- fin->fin_dlen -= shift;
-
- return hdr->ip6e_nxt;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_routing6 */
-/* Returns: int - value of the next header or IPPROTO_NONE if error */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* This is function checks pending routing extension header */
-/* ------------------------------------------------------------------------ */
-static INLINE int frpr_routing6(fin)
-fr_info_t *fin;
-{
- struct ip6_ext *hdr;
- u_short shift;
- int i;
-
- fin->fin_flx |= FI_V6EXTHDR;
-
- /* 8 is default length of extension hdr */
- if ((fin->fin_dlen - 8) < 0) {
- fin->fin_flx |= FI_SHORT;
- return IPPROTO_NONE;
- }
-
- if (frpr_pullup(fin, 8) == -1)
- return IPPROTO_NONE;
- hdr = fin->fin_dp;
-
- shift = 8 + (hdr->ip6e_len << 3);
- /*
- * Nasty extension header length?
- */
- if ((shift > fin->fin_dlen) || (shift < sizeof(struct ip6_hdr)) ||
- ((shift - sizeof(struct ip6_hdr)) & 15)) {
- fin->fin_flx |= FI_BAD;
- return IPPROTO_NONE;
- }
-
- for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
- if (ip6exthdr[i].ol_val == IPPROTO_ROUTING) {
- fin->fin_optmsk |= ip6exthdr[i].ol_bit;
- break;
- }
-
- fin->fin_dp = (char *)fin->fin_dp + shift;
- fin->fin_dlen -= shift;
-
- return hdr->ip6e_nxt;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_fragment6 */
-/* Returns: int - value of the next header or IPPROTO_NONE if error */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* Examine the IPv6 fragment header and extract fragment offset information.*/
-/* ------------------------------------------------------------------------ */
-static INLINE int frpr_fragment6(fin)
-fr_info_t *fin;
-{
- struct ip6_frag *frag;
- struct ip6_ext *hdr;
- int i;
-
- fin->fin_flx |= (FI_FRAG|FI_V6EXTHDR);
-
- /* 8 is default length of extension hdr */
- if ((fin->fin_dlen - 8) < 0) {
- fin->fin_flx |= FI_SHORT;
- return IPPROTO_NONE;
- }
-
- /*
- * Only one frgament header is allowed per IPv6 packet but it need
- * not be the first nor last (not possible in some cases.)
- */
- for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
- if (ip6exthdr[i].ol_val == IPPROTO_FRAGMENT)
- break;
-
- if (fin->fin_optmsk & ip6exthdr[i].ol_bit) {
- fin->fin_flx |= FI_BAD;
- return IPPROTO_NONE;
- }
-
- fin->fin_optmsk |= ip6exthdr[i].ol_bit;
-
- if (frpr_pullup(fin, sizeof(*frag)) == -1)
- return IPPROTO_NONE;
- hdr = fin->fin_dp;
-
- /*
- * Length must be zero, i.e. it has no length.
- */
- if (hdr->ip6e_len != 0) {
- fin->fin_flx |= FI_BAD;
- return IPPROTO_NONE;
- }
-
- if ((int)(fin->fin_dlen - sizeof(*frag)) < 0) {
- fin->fin_flx |= FI_SHORT;
- return IPPROTO_NONE;
- }
-
- frag = fin->fin_dp;
- fin->fin_off = frag->ip6f_offlg & IP6F_OFF_MASK;
- fin->fin_off <<= 3;
- if (fin->fin_off != 0)
- fin->fin_flx |= FI_FRAGBODY;
-
- fin->fin_dp = (char *)fin->fin_dp + sizeof(*frag);
- fin->fin_dlen -= sizeof(*frag);
-
- return frag->ip6f_nxt;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_dstopts6 */
-/* Returns: int - value of the next header or IPPROTO_NONE if error */
-/* Parameters: fin(I) - pointer to packet information */
-/* nextheader(I) - stores next header value */
-/* */
-/* IPv6 Only */
-/* This is function checks pending destination options extension header */
-/* ------------------------------------------------------------------------ */
-static INLINE int frpr_dstopts6(fin)
-fr_info_t *fin;
-{
- struct ip6_ext *hdr;
- u_short shift;
- int i;
-
- /* 8 is default length of extension hdr */
- if ((fin->fin_dlen - 8) < 0) {
- fin->fin_flx |= FI_SHORT;
- return IPPROTO_NONE;
- }
-
- if (frpr_pullup(fin, 8) == -1)
- return IPPROTO_NONE;
- hdr = fin->fin_dp;
-
- shift = 8 + (hdr->ip6e_len << 3);
- if (shift > fin->fin_dlen) { /* Nasty extension header length? */
- fin->fin_flx |= FI_BAD;
- return IPPROTO_NONE;
- }
-
- for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
- if (ip6exthdr[i].ol_val == IPPROTO_DSTOPTS)
- break;
- fin->fin_optmsk |= ip6exthdr[i].ol_bit;
- fin->fin_dp = (char *)fin->fin_dp + shift;
- fin->fin_dlen -= shift;
-
- return hdr->ip6e_nxt;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_icmp6 */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* This routine is mainly concerned with determining the minimum valid size */
-/* for an ICMPv6 packet. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_icmp6(fin)
-fr_info_t *fin;
-{
- int minicmpsz = sizeof(struct icmp6_hdr);
- struct icmp6_hdr *icmp6;
-
- if (frpr_pullup(fin, ICMP6ERR_MINPKTLEN + 8 - sizeof(ip6_t)) == -1)
- return;
-
- if (fin->fin_dlen > 1) {
- icmp6 = fin->fin_dp;
-
- fin->fin_data[0] = *(u_short *)icmp6;
-
- switch (icmp6->icmp6_type)
- {
- case ICMP6_ECHO_REPLY :
- case ICMP6_ECHO_REQUEST :
- minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t);
- break;
- case ICMP6_DST_UNREACH :
- case ICMP6_PACKET_TOO_BIG :
- case ICMP6_TIME_EXCEEDED :
- case ICMP6_PARAM_PROB :
- if ((fin->fin_m != NULL) &&
- (M_LEN(fin->fin_m) < fin->fin_plen)) {
- if (fr_coalesce(fin) != 1)
- return;
- }
- fin->fin_flx |= FI_ICMPERR;
- minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t);
- break;
- default :
- break;
- }
- }
-
- frpr_short(fin, minicmpsz);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_udp6 */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* Analyse the packet for IPv6/UDP properties. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_udp6(fin)
-fr_info_t *fin;
-{
-
- fr_checkv6sum(fin);
-
- frpr_short(fin, sizeof(struct udphdr));
-
- frpr_udpcommon(fin);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_tcp6 */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv6 Only */
-/* Analyse the packet for IPv6/TCP properties. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_tcp6(fin)
-fr_info_t *fin;
-{
-
- fr_checkv6sum(fin);
-
- frpr_short(fin, sizeof(struct tcphdr));
-
- frpr_tcpcommon(fin);
-}
-#endif /* USE_INET6 */
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_pullup */
-/* Returns: int - 0 == pullup succeeded, -1 == failure */
-/* Parameters: fin(I) - pointer to packet information */
-/* plen(I) - length (excluding L3 header) to pullup */
-/* */
-/* Short inline function to cut down on code duplication to perform a call */
-/* to fr_pullup to ensure there is the required amount of data, */
-/* consecutively in the packet buffer. */
-/* ------------------------------------------------------------------------ */
-static INLINE int frpr_pullup(fin, plen)
-fr_info_t *fin;
-int plen;
-{
-#if defined(_KERNEL)
- if (fin->fin_m != NULL) {
- if (fin->fin_dp != NULL)
- plen += (char *)fin->fin_dp -
- ((char *)fin->fin_ip + fin->fin_hlen);
- plen += fin->fin_hlen;
- if (M_LEN(fin->fin_m) < plen) {
- if (fr_pullup(fin->fin_m, fin, plen) == NULL)
- return -1;
- }
- }
-#endif
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_short */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* min(I) - minimum header size */
-/* */
-/* Check if a packet is "short" as defined by min. The rule we are */
-/* applying here is that the packet must not be fragmented within the layer */
-/* 4 header. That is, it must not be a fragment that has its offset set to */
-/* start within the layer 4 header (hdrmin) or if it is at offset 0, the */
-/* entire layer 4 header must be present (min). */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_short(fin, min)
-fr_info_t *fin;
-int min;
-{
- fr_ip_t *fi = &fin->fin_fi;
- int off;
-
- off = fin->fin_off;
- if (off == 0) {
- if (fin->fin_plen < fin->fin_hlen + min)
- fi->fi_flx |= FI_SHORT;
- } else if (off < min) {
- fi->fi_flx |= FI_SHORT;
- }
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_icmp */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv4 Only */
-/* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */
-/* except extrememly bad packets, both type and code will be present. */
-/* The expected minimum size of an ICMP packet is very much dependant on */
-/* the type of it. */
-/* */
-/* XXX - other ICMP sanity checks? */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_icmp(fin)
-fr_info_t *fin;
-{
- int minicmpsz = sizeof(struct icmp);
- icmphdr_t *icmp;
-
- if (frpr_pullup(fin, ICMPERR_ICMPHLEN) == -1)
- return;
-
- fr_checkv4sum(fin);
-
- if (!fin->fin_off && (fin->fin_dlen > 1)) {
- icmp = fin->fin_dp;
-
- fin->fin_data[0] = *(u_short *)icmp;
-
- switch (icmp->icmp_type)
- {
- case ICMP_ECHOREPLY :
- case ICMP_ECHO :
- /* Router discovery messaes - RFC 1256 */
- case ICMP_ROUTERADVERT :
- case ICMP_ROUTERSOLICIT :
- minicmpsz = ICMP_MINLEN;
- break;
- /*
- * type(1) + code(1) + cksum(2) + id(2) seq(2) +
- * 3 * timestamp(3 * 4)
- */
- case ICMP_TSTAMP :
- case ICMP_TSTAMPREPLY :
- minicmpsz = 20;
- break;
- /*
- * type(1) + code(1) + cksum(2) + id(2) seq(2) +
- * mask(4)
- */
- case ICMP_MASKREQ :
- case ICMP_MASKREPLY :
- minicmpsz = 12;
- break;
- /*
- * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+)
- */
- case ICMP_UNREACH :
- case ICMP_SOURCEQUENCH :
- case ICMP_REDIRECT :
- case ICMP_TIMXCEED :
- case ICMP_PARAMPROB :
- if (fr_coalesce(fin) != 1)
- return;
- fin->fin_flx |= FI_ICMPERR;
- break;
- default :
- break;
- }
-
- if (fin->fin_dlen >= 6) /* ID field */
- fin->fin_data[1] = icmp->icmp_id;
- }
-
- frpr_short(fin, minicmpsz);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_tcpcommon */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* TCP header sanity checking. Look for bad combinations of TCP flags, */
-/* and make some checks with how they interact with other fields. */
-/* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */
-/* valid and mark the packet as bad if not. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_tcpcommon(fin)
-fr_info_t *fin;
-{
- int flags, tlen;
- tcphdr_t *tcp;
- fr_ip_t *fi;
-
- fi = &fin->fin_fi;
- fi->fi_flx |= FI_TCPUDP;
- if (fin->fin_off != 0)
- return;
-
- if (frpr_pullup(fin, sizeof(*tcp)) == -1)
- return;
- tcp = fin->fin_dp;
-
- if (fin->fin_dlen > 3) {
- fin->fin_sport = ntohs(tcp->th_sport);
- fin->fin_dport = ntohs(tcp->th_dport);
- }
-
- if ((fi->fi_flx & FI_SHORT) != 0)
- return;
-
- /*
- * Use of the TCP data offset *must* result in a value that is at
- * least the same size as the TCP header.
- */
- tlen = TCP_OFF(tcp) << 2;
- if (tlen < sizeof(tcphdr_t)) {
- fin->fin_flx |= FI_BAD;
- return;
- }
-
- flags = tcp->th_flags;
- fin->fin_tcpf = tcp->th_flags;
-
- /*
- * If the urgent flag is set, then the urgent pointer must
- * also be set and vice versa. Good TCP packets do not have
- * just one of these set.
- */
- if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) {
- fin->fin_flx |= FI_BAD;
- } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) {
- /* Ignore this case, it shows up in "real" traffic with */
- /* bogus values in the urgent pointer field. */
- ;
- } else if (((flags & (TH_SYN|TH_FIN)) != 0) &&
- ((flags & (TH_RST|TH_ACK)) == TH_RST)) {
- /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */
- fin->fin_flx |= FI_BAD;
- } else if (!(flags & TH_ACK)) {
- /*
- * If the ack bit isn't set, then either the SYN or
- * RST bit must be set. If the SYN bit is set, then
- * we expect the ACK field to be 0. If the ACK is
- * not set and if URG, PSH or FIN are set, consdier
- * that to indicate a bad TCP packet.
- */
- if ((flags == TH_SYN) && (tcp->th_ack != 0)) {
- /*
- * Cisco PIX sets the ACK field to a random value.
- * In light of this, do not set FI_BAD until a patch
- * is available from Cisco to ensure that
- * interoperability between existing systems is
- * achieved.
- */
- /*fin->fin_flx |= FI_BAD*/;
- } else if (!(flags & (TH_RST|TH_SYN))) {
- fin->fin_flx |= FI_BAD;
- } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) {
- fin->fin_flx |= FI_BAD;
- }
- }
-
- /*
- * At this point, it's not exactly clear what is to be gained by
- * marking up which TCP options are and are not present. The one we
- * are most interested in is the TCP window scale. This is only in
- * a SYN packet [RFC1323] so we don't need this here...?
- * Now if we were to analyse the header for passive fingerprinting,
- * then that might add some weight to adding this...
- */
- if (tlen == sizeof(tcphdr_t))
- return;
-
- if (frpr_pullup(fin, tlen) == -1)
- return;
-
-#if 0
- ip = fin->fin_ip;
- s = (u_char *)(tcp + 1);
- off = IP_HL(ip) << 2;
-# ifdef _KERNEL
- if (fin->fin_mp != NULL) {
- mb_t *m = *fin->fin_mp;
-
- if (off + tlen > M_LEN(m))
- return;
- }
-# endif
- for (tlen -= (int)sizeof(*tcp); tlen > 0; ) {
- opt = *s;
- if (opt == '\0')
- break;
- else if (opt == TCPOPT_NOP)
- ol = 1;
- else {
- if (tlen < 2)
- break;
- ol = (int)*(s + 1);
- if (ol < 2 || ol > tlen)
- break;
- }
-
- for (i = 9, mv = 4; mv >= 0; ) {
- op = ipopts + i;
- if (opt == (u_char)op->ol_val) {
- optmsk |= op->ol_bit;
- break;
- }
- }
- tlen -= ol;
- s += ol;
- }
-#endif /* 0 */
-}
-
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_udpcommon */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Extract the UDP source and destination ports, if present. If compiled */
-/* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_udpcommon(fin)
-fr_info_t *fin;
-{
- udphdr_t *udp;
- fr_ip_t *fi;
-
- fi = &fin->fin_fi;
- fi->fi_flx |= FI_TCPUDP;
-
- if (!fin->fin_off && (fin->fin_dlen > 3)) {
- if (frpr_pullup(fin, sizeof(*udp)) == -1) {
- fi->fi_flx |= FI_SHORT;
- return;
- }
-
- udp = fin->fin_dp;
-
- fin->fin_sport = ntohs(udp->uh_sport);
- fin->fin_dport = ntohs(udp->uh_dport);
- }
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_tcp */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv4 Only */
-/* Analyse the packet for IPv4/TCP properties. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_tcp(fin)
-fr_info_t *fin;
-{
-
- fr_checkv4sum(fin);
-
- frpr_short(fin, sizeof(tcphdr_t));
-
- frpr_tcpcommon(fin);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_udp */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv4 Only */
-/* Analyse the packet for IPv4/UDP properties. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_udp(fin)
-fr_info_t *fin;
-{
-
- fr_checkv4sum(fin);
-
- frpr_short(fin, sizeof(udphdr_t));
-
- frpr_udpcommon(fin);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_esp */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Analyse the packet for ESP properties. */
-/* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */
-/* even though the newer ESP packets must also have a sequence number that */
-/* is 32bits as well, it is not possible(?) to determine the version from a */
-/* simple packet header. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_esp(fin)
-fr_info_t *fin;
-{
- if (frpr_pullup(fin, 8) == -1)
- return;
-
- if (fin->fin_v == 4)
- frpr_short(fin, 8);
-#ifdef USE_INET6
- else if (fin->fin_v == 6)
- frpr_short6(fin, sizeof(grehdr_t));
-#endif
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_gre */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Analyse the packet for GRE properties. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_gre(fin)
-fr_info_t *fin;
-{
- grehdr_t *gre;
-
- if (frpr_pullup(fin, sizeof(grehdr_t)) == -1)
- return;
-
- if (fin->fin_v == 4)
- frpr_short(fin, sizeof(grehdr_t));
-#ifdef USE_INET6
- else if (fin->fin_v == 6)
- frpr_short6(fin, sizeof(grehdr_t));
-#endif
- gre = fin->fin_dp;
- if (GRE_REV(gre->gr_flags) == 1)
- fin->fin_data[0] = gre->gr_call;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frpr_ipv4hdr */
-/* Returns: void */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* IPv4 Only */
-/* Analyze the IPv4 header and set fields in the fr_info_t structure. */
-/* Check all options present and flag their presence if any exist. */
-/* ------------------------------------------------------------------------ */
-static INLINE void frpr_ipv4hdr(fin)
-fr_info_t *fin;
-{
- u_short optmsk = 0, secmsk = 0, auth = 0;
- int hlen, ol, mv, p, i;
- const struct optlist *op;
- u_char *s, opt;
- u_short off;
- fr_ip_t *fi;
- ip_t *ip;
-
- fi = &fin->fin_fi;
- hlen = fin->fin_hlen;
-
- ip = fin->fin_ip;
- p = ip->ip_p;
- fi->fi_p = p;
- fi->fi_tos = ip->ip_tos;
- fin->fin_id = ip->ip_id;
- off = ip->ip_off;
-
- /* Get both TTL and protocol */
- fi->fi_p = ip->ip_p;
- fi->fi_ttl = ip->ip_ttl;
-#if 0
- (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
-#endif
-
- /* Zero out bits not used in IPv6 address */
- fi->fi_src.i6[1] = 0;
- fi->fi_src.i6[2] = 0;
- fi->fi_src.i6[3] = 0;
- fi->fi_dst.i6[1] = 0;
- fi->fi_dst.i6[2] = 0;
- fi->fi_dst.i6[3] = 0;
-
- fi->fi_saddr = ip->ip_src.s_addr;
- fi->fi_daddr = ip->ip_dst.s_addr;
-
- /*
- * set packet attribute flags based on the offset and
- * calculate the byte offset that it represents.
- */
- if ((off & IP_MF) != 0) {
- fi->fi_flx |= FI_FRAG;
- if (fin->fin_dlen == 0)
- fi->fi_flx |= FI_BAD;
- }
-
- off &= IP_MF|IP_OFFMASK;
- if (off != 0) {
- fi->fi_flx |= FI_FRAG;
- off &= IP_OFFMASK;
- if (off != 0) {
- fin->fin_flx |= FI_FRAGBODY;
- off <<= 3;
- if (off + fin->fin_dlen > 0xffff) {
- fi->fi_flx |= FI_BAD;
- }
- }
- }
- fin->fin_off = off;
-
- /*
- * Call per-protocol setup and checking
- */
- switch (p)
- {
- case IPPROTO_UDP :
- frpr_udp(fin);
- break;
- case IPPROTO_TCP :
- frpr_tcp(fin);
- break;
- case IPPROTO_ICMP :
- frpr_icmp(fin);
- break;
- case IPPROTO_ESP :
- frpr_esp(fin);
- break;
- case IPPROTO_GRE :
- frpr_gre(fin);
- break;
- }
-
- ip = fin->fin_ip;
- if (ip == NULL)
- return;
-
- /*
- * If it is a standard IP header (no options), set the flag fields
- * which relate to options to 0.
- */
- if (hlen == sizeof(*ip)) {
- fi->fi_optmsk = 0;
- fi->fi_secmsk = 0;
- fi->fi_auth = 0;
- return;
- }
-
- /*
- * So the IP header has some IP options attached. Walk the entire
- * list of options present with this packet and set flags to indicate
- * which ones are here and which ones are not. For the somewhat out
- * of date and obscure security classification options, set a flag to
- * represent which classification is present.
- */
- fi->fi_flx |= FI_OPTIONS;
-
- for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
- opt = *s;
- if (opt == '\0')
- break;
- else if (opt == IPOPT_NOP)
- ol = 1;
- else {
- if (hlen < 2)
- break;
- ol = (int)*(s + 1);
- if (ol < 2 || ol > hlen)
- break;
- }
- for (i = 9, mv = 4; mv >= 0; ) {
- op = ipopts + i;
- if ((opt == (u_char)op->ol_val) && (ol > 4)) {
- optmsk |= op->ol_bit;
- if (opt == IPOPT_SECURITY) {
- const struct optlist *sp;
- u_char sec;
- int j, m;
-
- sec = *(s + 2); /* classification */
- for (j = 3, m = 2; m >= 0; ) {
- sp = secopt + j;
- if (sec == sp->ol_val) {
- secmsk |= sp->ol_bit;
- auth = *(s + 3);
- auth *= 256;
- auth += *(s + 4);
- break;
- }
- if (sec < sp->ol_val)
- j -= m;
- else
- j += m;
- m--;
- }
- }
- break;
- }
- if (opt < op->ol_val)
- i -= mv;
- else
- i += mv;
- mv--;
- }
- hlen -= ol;
- s += ol;
- }
-
- /*
- *
- */
- if (auth && !(auth & 0x0100))
- auth &= 0xff00;
- fi->fi_optmsk = optmsk;
- fi->fi_secmsk = secmsk;
- fi->fi_auth = auth;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_makefrip */
-/* Returns: void */
-/* Parameters: hlen(I) - length of IP packet header */
-/* ip(I) - pointer to the IP header */
-/* fin(IO) - pointer to packet information */
-/* */
-/* Compact the IP header into a structure which contains just the info. */
-/* which is useful for comparing IP headers with and store this information */
-/* in the fr_info_t structure pointer to by fin. At present, it is assumed */
-/* this function will be called with either an IPv4 or IPv6 packet. */
-/* ------------------------------------------------------------------------ */
-int fr_makefrip(hlen, ip, fin)
-int hlen;
-ip_t *ip;
-fr_info_t *fin;
-{
- int v;
-
- fin->fin_nat = NULL;
- fin->fin_state = NULL;
- fin->fin_depth = 0;
- fin->fin_hlen = (u_short)hlen;
- fin->fin_ip = ip;
- fin->fin_rule = 0xffffffff;
- fin->fin_group[0] = -1;
- fin->fin_group[1] = '\0';
- fin->fin_dlen = fin->fin_plen - hlen;
- fin->fin_dp = (char *)ip + hlen;
-
- v = fin->fin_v;
- if (v == 4)
- frpr_ipv4hdr(fin);
-#ifdef USE_INET6
- else if (v == 6)
- frpr_ipv6hdr(fin);
-#endif
- if (fin->fin_ip == NULL)
- return -1;
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_portcheck */
-/* Returns: int - 1 == port matched, 0 == port match failed */
-/* Parameters: frp(I) - pointer to port check `expression' */
-/* pop(I) - pointer to port number to evaluate */
-/* */
-/* Perform a comparison of a port number against some other(s), using a */
-/* structure with compare information stored in it. */
-/* ------------------------------------------------------------------------ */
-static INLINE int fr_portcheck(frp, pop)
-frpcmp_t *frp;
-u_short *pop;
-{
- u_short tup, po;
- int err = 1;
-
- tup = *pop;
- po = frp->frp_port;
-
- /*
- * Do opposite test to that required and continue if that succeeds.
- */
- switch (frp->frp_cmp)
- {
- case FR_EQUAL :
- if (tup != po) /* EQUAL */
- err = 0;
- break;
- case FR_NEQUAL :
- if (tup == po) /* NOTEQUAL */
- err = 0;
- break;
- case FR_LESST :
- if (tup >= po) /* LESSTHAN */
- err = 0;
- break;
- case FR_GREATERT :
- if (tup <= po) /* GREATERTHAN */
- err = 0;
- break;
- case FR_LESSTE :
- if (tup > po) /* LT or EQ */
- err = 0;
- break;
- case FR_GREATERTE :
- if (tup < po) /* GT or EQ */
- err = 0;
- break;
- case FR_OUTRANGE :
- if (tup >= po && tup <= frp->frp_top) /* Out of range */
- err = 0;
- break;
- case FR_INRANGE :
- if (tup <= po || tup >= frp->frp_top) /* In range */
- err = 0;
- break;
- case FR_INCRANGE :
- if (tup < po || tup > frp->frp_top) /* Inclusive range */
- err = 0;
- break;
- default :
- break;
- }
- return err;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_tcpudpchk */
-/* Returns: int - 1 == protocol matched, 0 == check failed */
-/* Parameters: fin(I) - pointer to packet information */
-/* ft(I) - pointer to structure with comparison data */
-/* */
-/* Compares the current pcket (assuming it is TCP/UDP) information with a */
-/* structure containing information that we want to match against. */
-/* ------------------------------------------------------------------------ */
-int fr_tcpudpchk(fin, ft)
-fr_info_t *fin;
-frtuc_t *ft;
-{
- int err = 1;
-
- /*
- * Both ports should *always* be in the first fragment.
- * So far, I cannot find any cases where they can not be.
- *
- * compare destination ports
- */
- if (ft->ftu_dcmp)
- err = fr_portcheck(&ft->ftu_dst, &fin->fin_dport);
-
- /*
- * compare source ports
- */
- if (err && ft->ftu_scmp)
- err = fr_portcheck(&ft->ftu_src, &fin->fin_sport);
-
- /*
- * If we don't have all the TCP/UDP header, then how can we
- * expect to do any sort of match on it ? If we were looking for
- * TCP flags, then NO match. If not, then match (which should
- * satisfy the "short" class too).
- */
- if (err && (fin->fin_p == IPPROTO_TCP)) {
- if (fin->fin_flx & FI_SHORT)
- return !(ft->ftu_tcpf | ft->ftu_tcpfm);
- /*
- * Match the flags ? If not, abort this match.
- */
- if (ft->ftu_tcpfm &&
- ft->ftu_tcpf != (fin->fin_tcpf & ft->ftu_tcpfm)) {
- FR_DEBUG(("f. %#x & %#x != %#x\n", fin->fin_tcpf,
- ft->ftu_tcpfm, ft->ftu_tcpf));
- err = 0;
- }
- }
- return err;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ipfcheck */
-/* Returns: int - 0 == match, 1 == no match */
-/* Parameters: fin(I) - pointer to packet information */
-/* fr(I) - pointer to filter rule */
-/* portcmp(I) - flag indicating whether to attempt matching on */
-/* TCP/UDP port data. */
-/* */
-/* Check to see if a packet matches an IPFilter rule. Checks of addresses, */
-/* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */
-/* this function. */
-/* ------------------------------------------------------------------------ */
-static INLINE int fr_ipfcheck(fin, fr, portcmp)
-fr_info_t *fin;
-frentry_t *fr;
-int portcmp;
-{
- u_32_t *ld, *lm, *lip;
- fripf_t *fri;
- fr_ip_t *fi;
- int i;
-
- fi = &fin->fin_fi;
- fri = fr->fr_ipf;
- lip = (u_32_t *)fi;
- lm = (u_32_t *)&fri->fri_mip;
- ld = (u_32_t *)&fri->fri_ip;
-
- /*
- * first 32 bits to check coversion:
- * IP version, TOS, TTL, protocol
- */
- i = ((*lip & *lm) != *ld);
- FR_DEBUG(("0. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- if (i)
- return 1;
-
- /*
- * Next 32 bits is a constructed bitmask indicating which IP options
- * are present (if any) in this packet.
- */
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("1. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- if (i)
- return 1;
-
- lip++, lm++, ld++;
- /*
- * Unrolled loops (4 each, for 32 bits) for address checks.
- */
- /*
- * Check the source address.
- */
-#ifdef IPFILTER_LOOKUP
- if (fr->fr_satype == FRI_LOOKUP) {
- i = (*fr->fr_srcfunc)(fr->fr_srcptr, fi->fi_v, lip);
- if (i == -1)
- return 1;
- lip += 3;
- lm += 3;
- ld += 3;
- } else {
-#endif
- i = ((*lip & *lm) != *ld);
- FR_DEBUG(("2a. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- if (fi->fi_v == 6) {
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("2b. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("2c. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("2d. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- } else {
- lip += 3;
- lm += 3;
- ld += 3;
- }
-#ifdef IPFILTER_LOOKUP
- }
-#endif
- i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6;
- if (i)
- return 1;
-
- /*
- * Check the destination address.
- */
- lip++, lm++, ld++;
-#ifdef IPFILTER_LOOKUP
- if (fr->fr_datype == FRI_LOOKUP) {
- i = (*fr->fr_dstfunc)(fr->fr_dstptr, fi->fi_v, lip);
- if (i == -1)
- return 1;
- lip += 3;
- lm += 3;
- ld += 3;
- } else {
-#endif
- i = ((*lip & *lm) != *ld);
- FR_DEBUG(("3a. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- if (fi->fi_v == 6) {
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("3b. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("3c. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("3d. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
- } else {
- lip += 3;
- lm += 3;
- ld += 3;
- }
-#ifdef IPFILTER_LOOKUP
- }
-#endif
- i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7;
- if (i)
- return 1;
- /*
- * IP addresses matched. The next 32bits contains:
- * mast of old IP header security & authentication bits.
- */
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("4. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
-
- /*
- * Next we have 32 bits of packet flags.
- */
- lip++, lm++, ld++;
- i |= ((*lip & *lm) != *ld);
- FR_DEBUG(("5. %#08x & %#08x != %#08x\n",
- *lip, *lm, *ld));
-
- if (i == 0) {
- /*
- * If a fragment, then only the first has what we're
- * looking for here...
- */
- if (portcmp) {
- if (!fr_tcpudpchk(fin, &fr->fr_tuc))
- i = 1;
- } else {
- if (fr->fr_dcmp || fr->fr_scmp ||
- fr->fr_tcpf || fr->fr_tcpfm)
- i = 1;
- if (fr->fr_icmpm || fr->fr_icmp) {
- if (((fi->fi_p != IPPROTO_ICMP) &&
- (fi->fi_p != IPPROTO_ICMPV6)) ||
- fin->fin_off || (fin->fin_dlen < 2))
- i = 1;
- else if ((fin->fin_data[0] & fr->fr_icmpm) !=
- fr->fr_icmp) {
- FR_DEBUG(("i. %#x & %#x != %#x\n",
- fin->fin_data[0],
- fr->fr_icmpm, fr->fr_icmp));
- i = 1;
- }
- }
- }
- }
- return i;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_scanlist */
-/* Returns: int - result flags of scanning filter list */
-/* Parameters: fin(I) - pointer to packet information */
-/* pass(I) - default result to return for filtering */
-/* */
-/* Check the input/output list of rules for a match to the current packet. */
-/* If a match is found, the value of fr_flags from the rule becomes the */
-/* return value and fin->fin_fr points to the matched rule. */
-/* */
-/* This function may be called recusively upto 16 times (limit inbuilt.) */
-/* When unwinding, it should finish up with fin_depth as 0. */
-/* */
-/* Could be per interface, but this gets real nasty when you don't have, */
-/* or can't easily change, the kernel source code to . */
-/* ------------------------------------------------------------------------ */
-int fr_scanlist(fin, pass)
-fr_info_t *fin;
-u_32_t pass;
-{
- int rulen, portcmp, off, logged, skip;
- struct frentry *fr, *fnext;
- u_32_t passt;
-
- /*
- * Do not allow nesting deeper than 16 levels.
- */
- if (fin->fin_depth >= 16)
- return pass;
-
- fr = fin->fin_fr;
-
- /*
- * If there are no rules in this list, return now.
- */
- if (fr == NULL)
- return pass;
-
- skip = 0;
- logged = 0;
- portcmp = 0;
- fin->fin_depth++;
- fin->fin_fr = NULL;
- off = fin->fin_off;
-
- if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
- portcmp = 1;
-
- for (rulen = 0; fr; fr = fnext, rulen++) {
- fnext = fr->fr_next;
- if (skip != 0) {
- FR_VERBOSE(("%d (%#x)\n", skip, fr->fr_flags));
- skip--;
- continue;
- }
-
- /*
- * In all checks below, a null (zero) value in the
- * filter struture is taken to mean a wildcard.
- *
- * check that we are working for the right interface
- */
-#ifdef _KERNEL
- if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
- continue;
-#else
- if (opts & (OPT_VERBOSE|OPT_DEBUG))
- printf("\n");
- FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' :
- FR_ISPASS(pass) ? 'p' :
- FR_ISACCOUNT(pass) ? 'A' :
- FR_ISAUTH(pass) ? 'a' :
- (pass & FR_NOMATCH) ? 'n' :'b'));
- if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
- continue;
- FR_VERBOSE((":i"));
-#endif
-
- switch (fr->fr_type)
- {
- case FR_T_IPF :
- case FR_T_IPF|FR_T_BUILTIN :
- if (fr_ipfcheck(fin, fr, portcmp))
- continue;
- break;
-#if defined(IPFILTER_BPF)
- case FR_T_BPFOPC :
- case FR_T_BPFOPC|FR_T_BUILTIN :
- {
- u_char *mc;
- int wlen;
-
- if (*fin->fin_mp == NULL)
- continue;
- if (fin->fin_v != fr->fr_v)
- continue;
- mc = (u_char *)fin->fin_m;
- wlen = fin->fin_dlen + fin->fin_hlen;
- if (!bpf_filter(fr->fr_data, mc, wlen, 0))
- continue;
- break;
- }
-#endif
- case FR_T_CALLFUNC|FR_T_BUILTIN :
- {
- frentry_t *f;
-
- f = (*fr->fr_func)(fin, &pass);
- if (f != NULL)
- fr = f;
- else
- continue;
- break;
- }
- default :
- break;
- }
-
- if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
- if (fin->fin_nattag == NULL)
- continue;
- if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0)
- continue;
- }
- FR_VERBOSE(("=%s.%d *", fr->fr_group, rulen));
-
- passt = fr->fr_flags;
-
- /*
- * Allowing a rule with the "keep state" flag set to match
- * packets that have been tagged "out of window" by the TCP
- * state tracking is foolish as the attempt to add a new
- * state entry to the table will fail.
- */
- if ((passt & FR_KEEPSTATE) && (fin->fin_flx & FI_OOW))
- continue;
-
- /*
- * If the rule is a "call now" rule, then call the function
- * in the rule, if it exists and use the results from that.
- * If the function pointer is bad, just make like we ignore
- * it, except for increasing the hit counter.
- */
- if ((passt & FR_CALLNOW) != 0) {
- ATOMIC_INC64(fr->fr_hits);
- if ((fr->fr_func != NULL) &&
- (fr->fr_func != (ipfunc_t)-1)) {
- frentry_t *frs;
-
- frs = fin->fin_fr;
- fin->fin_fr = fr;
- fr = (*fr->fr_func)(fin, &passt);
- if (fr == NULL) {
- fin->fin_fr = frs;
- continue;
- }
- passt = fr->fr_flags;
- fin->fin_fr = fr;
- }
- } else {
- fin->fin_fr = fr;
- }
-
-#ifdef IPFILTER_LOG
- /*
- * Just log this packet...
- */
- if ((passt & FR_LOGMASK) == FR_LOG) {
- if (ipflog(fin, passt) == -1) {
- if (passt & FR_LOGORBLOCK) {
- passt &= ~FR_CMDMASK;
- passt |= FR_BLOCK|FR_QUICK;
- }
- ATOMIC_INCL(frstats[fin->fin_out].fr_skip);
- }
- ATOMIC_INCL(frstats[fin->fin_out].fr_pkl);
- logged = 1;
- }
-#endif /* IPFILTER_LOG */
- fr->fr_bytes += (U_QUAD_T)fin->fin_plen;
- if (FR_ISSKIP(passt))
- skip = fr->fr_arg;
- else if ((passt & FR_LOGMASK) != FR_LOG)
- pass = passt;
- if (passt & (FR_RETICMP|FR_FAKEICMP))
- fin->fin_icode = fr->fr_icode;
- FR_DEBUG(("pass %#x\n", pass));
- ATOMIC_INC64(fr->fr_hits);
- fin->fin_rule = rulen;
- (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN);
- if (fr->fr_grp != NULL) {
- fin->fin_fr = *fr->fr_grp;
- pass = fr_scanlist(fin, pass);
- if (fin->fin_fr == NULL) {
- fin->fin_rule = rulen;
- (void) strncpy(fin->fin_group, fr->fr_group,
- FR_GROUPLEN);
- fin->fin_fr = fr;
- }
- if (fin->fin_flx & FI_DONTCACHE)
- logged = 1;
- }
- if (pass & FR_QUICK)
- break;
- }
- if (logged)
- fin->fin_flx |= FI_DONTCACHE;
- fin->fin_depth--;
- return pass;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_acctpkt */
-/* Returns: frentry_t* - always returns NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(IO) - pointer to current/new filter decision (unused) */
-/* */
-/* Checks a packet against accounting rules, if there are any for the given */
-/* IP protocol version. */
-/* */
-/* N.B.: this function returns NULL to match the prototype used by other */
-/* functions called from the IPFilter "mainline" in fr_check(). */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_acctpkt(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- char group[FR_GROUPLEN];
- frentry_t *fr, *frsave;
- u_32_t pass, rulen;
-
- passp = passp;
-#ifdef USE_INET6
- if (fin->fin_v == 6)
- fr = ipacct6[fin->fin_out][fr_active];
- else
-#endif
- fr = ipacct[fin->fin_out][fr_active];
-
- if (fr != NULL) {
- frsave = fin->fin_fr;
- bcopy(fin->fin_group, group, FR_GROUPLEN);
- rulen = fin->fin_rule;
- fin->fin_fr = fr;
- pass = fr_scanlist(fin, FR_NOMATCH);
- if (FR_ISACCOUNT(pass)) {
- ATOMIC_INCL(frstats[0].fr_acct);
- }
- fin->fin_fr = frsave;
- bcopy(group, fin->fin_group, FR_GROUPLEN);
- fin->fin_rule = rulen;
- }
- return NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_firewall */
-/* Returns: frentry_t* - returns pointer to matched rule, if no matches */
-/* were found, returns NULL. */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(IO) - pointer to current/new filter decision (unused) */
-/* */
-/* Applies an appropriate set of firewall rules to the packet, to see if */
-/* there are any matches. The first check is to see if a match can be seen */
-/* in the cache. If not, then search an appropriate list of rules. Once a */
-/* matching rule is found, take any appropriate actions as defined by the */
-/* rule - except logging. */
-/* ------------------------------------------------------------------------ */
-static frentry_t *fr_firewall(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- frentry_t *fr;
- fr_info_t *fc;
- u_32_t pass;
- int out;
-
- out = fin->fin_out;
- pass = *passp;
-
- /*
- * If a packet is found in the auth table, then skip checking
- * the access lists for permission but we do need to consider
- * the result as if it were from the ACL's.
- */
- fc = &frcache[out][CACHE_HASH(fin)];
- if (!bcmp((char *)fin, (char *)fc, FI_CSIZE)) {
- /*
- * copy cached data so we can unlock the mutex
- * earlier.
- */
- bcopy((char *)fc, (char *)fin, FI_COPYSIZE);
- ATOMIC_INCL(frstats[out].fr_chit);
- if ((fr = fin->fin_fr) != NULL) {
- ATOMIC_INC64(fr->fr_hits);
- pass = fr->fr_flags;
- }
- } else {
-#ifdef USE_INET6
- if (fin->fin_v == 6)
- fin->fin_fr = ipfilter6[out][fr_active];
- else
-#endif
- fin->fin_fr = ipfilter[out][fr_active];
- if (fin->fin_fr != NULL)
- pass = fr_scanlist(fin, fr_pass);
- if (((pass & FR_KEEPSTATE) == 0) &&
- ((fin->fin_flx & FI_DONTCACHE) == 0))
- bcopy((char *)fin, (char *)fc, FI_COPYSIZE);
- if ((pass & FR_NOMATCH)) {
- ATOMIC_INCL(frstats[out].fr_nom);
- }
- fr = fin->fin_fr;
- }
-
- /*
- * Apply packets per second rate-limiting to a rule as required.
- */
- if ((fr != NULL) && (fr->fr_pps != 0) &&
- !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) {
- pass &= ~(FR_CMDMASK|FR_DUP|FR_RETICMP|FR_RETRST);
- pass |= FR_BLOCK;
- ATOMIC_INCL(frstats[out].fr_ppshit);
- }
-
- /*
- * If we fail to add a packet to the authorization queue, then we
- * drop the packet later. However, if it was added then pretend
- * we've dropped it already.
- */
- if (FR_ISAUTH(pass)) {
- if (fr_newauth(fin->fin_m, fin) != 0) {
-#ifdef _KERNEL
- fin->fin_m = *fin->fin_mp = NULL;
-#else
- ;
-#endif
- fin->fin_error = 0;
- } else
- fin->fin_error = ENOSPC;
- }
-
- if ((fr != NULL) && (fr->fr_func != NULL) &&
- (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW))
- (void) (*fr->fr_func)(fin, &pass);
-
- /*
- * If a rule is a pre-auth rule, check again in the list of rules
- * loaded for authenticated use. It does not particulary matter
- * if this search fails because a "preauth" result, from a rule,
- * is treated as "not a pass", hence the packet is blocked.
- */
- if (FR_ISPREAUTH(pass)) {
- if ((fin->fin_fr = ipauth) != NULL)
- pass = fr_scanlist(fin, fr_pass);
- }
-
- /*
- * If the rule has "keep frag" and the packet is actually a fragment,
- * then create a fragment state entry.
- */
- if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
- if (fin->fin_flx & FI_FRAG) {
- if (fr_newfrag(fin, pass) == -1) {
- ATOMIC_INCL(frstats[out].fr_bnfr);
- } else {
- ATOMIC_INCL(frstats[out].fr_nfr);
- }
- } else {
- ATOMIC_INCL(frstats[out].fr_cfr);
- }
- }
-
- /*
- * Finally, if we've asked to track state for this packet, set it up.
- */
- if ((pass & FR_KEEPSTATE) && !(fin->fin_flx & FI_STATE)) {
- if (fr_addstate(fin, NULL, 0) != NULL) {
- ATOMIC_INCL(frstats[out].fr_ads);
- } else {
- ATOMIC_INCL(frstats[out].fr_bads);
- if (FR_ISPASS(pass)) {
- pass &= ~FR_CMDMASK;
- pass |= FR_BLOCK;
- }
- }
- }
-
- fr = fin->fin_fr;
-
- if (passp != NULL)
- *passp = pass;
-
- return fr;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_check */
-/* Returns: int - 0 == packet allowed through, */
-/* User space: */
-/* -1 == packet blocked */
-/* 1 == packet not matched */
-/* -2 == requires authantication */
-/* Kernel: */
-/* > 0 == filter error # for packet */
-/* Parameters: ip(I) - pointer to start of IPv4/6 packet */
-/* hlen(I) - length of header */
-/* ifp(I) - pointer to interface this packet is on */
-/* out(I) - 0 == packet going in, 1 == packet going out */
-/* mp(IO) - pointer to caller's buffer pointer that holds this */
-/* IP packet. */
-/* Solaris & HP-UX ONLY : */
-/* qpi(I) - pointer to STREAMS queue information for this */
-/* interface & direction. */
-/* */
-/* fr_check() is the master function for all IPFilter packet processing. */
-/* It orchestrates: Network Address Translation (NAT), checking for packet */
-/* authorisation (or pre-authorisation), presence of related state info., */
-/* generating log entries, IP packet accounting, routing of packets as */
-/* directed by firewall rules and of course whether or not to allow the */
-/* packet to be further processed by the kernel. */
-/* */
-/* For packets blocked, the contents of "mp" will be NULL'd and the buffer */
-/* freed. Packets passed may be returned with the pointer pointed to by */
-/* by "mp" changed to a new buffer. */
-/* ------------------------------------------------------------------------ */
-int fr_check(ip, hlen, ifp, out
-#if defined(_KERNEL) && defined(MENTAT)
-, qif, mp)
-void *qif;
-#else
-, mp)
-#endif
-mb_t **mp;
-ip_t *ip;
-int hlen;
-void *ifp;
-int out;
-{
- /*
- * The above really sucks, but short of writing a diff
- */
- fr_info_t frinfo;
- fr_info_t *fin = &frinfo;
- u_32_t pass = fr_pass;
- frentry_t *fr = NULL;
- int v = IP_V(ip);
- mb_t *mc = NULL;
- mb_t *m;
-#ifdef USE_INET6
- ip6_t *ip6;
-#endif
-
- /*
- * The first part of fr_check() deals with making sure that what goes
- * into the filtering engine makes some sense. Information about the
- * the packet is distilled, collected into a fr_info_t structure and
- * the an attempt to ensure the buffer the packet is in is big enough
- * to hold all the required packet headers.
- */
-#ifdef _KERNEL
-# ifdef MENTAT
- qpktinfo_t *qpi = qif;
-
- if ((u_int)ip & 0x3)
- return 2;
-# endif
-
- READ_ENTER(&ipf_global);
-
- if (fr_running <= 0) {
- RWLOCK_EXIT(&ipf_global);
- return 0;
- }
-
- bzero((char *)fin, sizeof(*fin));
-
-# ifdef MENTAT
- if (qpi->qpi_flags & QF_GROUP)
- fin->fin_flx |= FI_MBCAST;
- m = qpi->qpi_m;
- fin->fin_qfm = m;
- fin->fin_qpi = qpi;
-# else /* MENTAT */
-
- m = *mp;
-
-# if defined(M_MCAST)
- if ((m->m_flags & M_MCAST) != 0)
- fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
-# endif
-# if defined(M_BCAST)
- if ((m->m_flags & M_BCAST) != 0)
- fin->fin_flx |= FI_MBCAST|FI_BROADCAST;
-# endif
-# ifdef M_CANFASTFWD
- /*
- * XXX For now, IP Filter and fast-forwarding of cached flows
- * XXX are mutually exclusive. Eventually, IP Filter should
- * XXX get a "can-fast-forward" filter rule.
- */
- m->m_flags &= ~M_CANFASTFWD;
-# endif /* M_CANFASTFWD */
-# ifdef CSUM_DELAY_DATA
- /*
- * disable delayed checksums.
- */
- if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
- in_delayed_cksum(m);
- m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
- }
-# endif /* CSUM_DELAY_DATA */
-# endif /* MENTAT */
-#else
- READ_ENTER(&ipf_global);
-
- bzero((char *)fin, sizeof(*fin));
- m = *mp;
-#endif /* _KERNEL */
-
- fin->fin_v = v;
- fin->fin_m = m;
- fin->fin_ip = ip;
- fin->fin_mp = mp;
- fin->fin_out = out;
- fin->fin_ifp = ifp;
- fin->fin_error = ENETUNREACH;
- fin->fin_hlen = (u_short )hlen;
- fin->fin_dp = (char *)ip + hlen;
-
- fin->fin_ipoff = (char *)ip - MTOD(m, char *);
-
-#ifdef USE_INET6
- if (v == 6) {
- ATOMIC_INCL(frstats[out].fr_ipv6);
- /*
- * Jumbo grams are quite likely too big for internal buffer
- * structures to handle comfortably, for now, so just drop
- * them.
- */
- ip6 = (ip6_t *)ip;
- fin->fin_plen = ntohs(ip6->ip6_plen);
- if (fin->fin_plen == 0) {
- pass = FR_BLOCK|FR_NOMATCH;
- goto filtered;
- }
- fin->fin_plen += sizeof(ip6_t);
- } else
-#endif
- {
-#if (OpenBSD >= 200311) && defined(_KERNEL)
- ip->ip_len = ntohs(ip->ip_len);
- ip->ip_off = ntohs(ip->ip_off);
-#endif
- fin->fin_plen = ip->ip_len;
- }
-
- if (fr_makefrip(hlen, ip, fin) == -1)
- goto finished;
-
- /*
- * For at least IPv6 packets, if a m_pullup() fails then this pointer
- * becomes NULL and so we have no packet to free.
- */
- if (*fin->fin_mp == NULL)
- goto finished;
-
- if (!out) {
- if (v == 4) {
-#ifdef _KERNEL
- if (fr_chksrc && !fr_verifysrc(fin)) {
- ATOMIC_INCL(frstats[0].fr_badsrc);
- fin->fin_flx |= FI_BADSRC;
- }
-#endif
- if (fin->fin_ip->ip_ttl < fr_minttl) {
- ATOMIC_INCL(frstats[0].fr_badttl);
- fin->fin_flx |= FI_LOWTTL;
- }
- }
-#ifdef USE_INET6
- else if (v == 6) {
- ip6 = (ip6_t *)ip;
- if (ip6->ip6_hlim < fr_minttl) {
- ATOMIC_INCL(frstats[0].fr_badttl);
- fin->fin_flx |= FI_LOWTTL;
- }
- }
-#endif
- }
-
- if (fin->fin_flx & FI_SHORT) {
- ATOMIC_INCL(frstats[out].fr_short);
- }
-
- READ_ENTER(&ipf_mutex);
-
- /*
- * Check auth now. This, combined with the check below to see if apass
- * is 0 is to ensure that we don't count the packet twice, which can
- * otherwise occur when we reprocess it. As it is, we only count it
- * after it has no auth. table matchup. This also stops NAT from
- * occuring until after the packet has been auth'd.
- */
- fr = fr_checkauth(fin, &pass);
- if (!out) {
- if (fr_checknatin(fin, &pass) == -1) {
- RWLOCK_EXIT(&ipf_mutex);
- goto finished;
- }
- }
- if (!out)
- (void) fr_acctpkt(fin, NULL);
-
- if (fr == NULL)
- if ((fin->fin_flx & (FI_FRAG|FI_BAD)) == FI_FRAG)
- fr = fr_knownfrag(fin, &pass);
- if (fr == NULL)
- fr = fr_checkstate(fin, &pass);
-
- if ((pass & FR_NOMATCH) || (fr == NULL))
- fr = fr_firewall(fin, &pass);
-
- fin->fin_fr = fr;
-
- /*
- * Only count/translate packets which will be passed on, out the
- * interface.
- */
- if (out && FR_ISPASS(pass)) {
- (void) fr_acctpkt(fin, NULL);
-
- if (fr_checknatout(fin, &pass) == -1) {
- RWLOCK_EXIT(&ipf_mutex);
- goto finished;
- } else if ((fr_update_ipid != 0) && (v == 4)) {
- if (fr_updateipid(fin) == -1) {
- ATOMIC_INCL(frstats[1].fr_ipud);
- pass &= ~FR_CMDMASK;
- pass |= FR_BLOCK;
- } else {
- ATOMIC_INCL(frstats[0].fr_ipud);
- }
- }
- }
-
-#ifdef IPFILTER_LOG
- if ((fr_flags & FF_LOGGING) || (pass & FR_LOGMASK)) {
- (void) fr_dolog(fin, &pass);
- }
-#endif
-
- if (fin->fin_state != NULL)
- fr_statederef(fin, (ipstate_t **)&fin->fin_state);
-
- if (fin->fin_nat != NULL)
- fr_natderef((nat_t **)&fin->fin_nat);
-
- /*
- * Only allow FR_DUP to work if a rule matched - it makes no sense to
- * set FR_DUP as a "default" as there are no instructions about where
- * to send the packet. Use fin_m here because it may have changed
- * (without an update of 'm') in prior processing.
- */
- if ((fr != NULL) && (pass & FR_DUP)) {
- mc = M_DUPLICATE(fin->fin_m);
- }
-
- if (pass & (FR_RETRST|FR_RETICMP)) {
- /*
- * Should we return an ICMP packet to indicate error
- * status passing through the packet filter ?
- * WARNING: ICMP error packets AND TCP RST packets should
- * ONLY be sent in repsonse to incoming packets. Sending them
- * in response to outbound packets can result in a panic on
- * some operating systems.
- */
- if (!out) {
- if (pass & FR_RETICMP) {
- int dst;
-
- if ((pass & FR_RETMASK) == FR_FAKEICMP)
- dst = 1;
- else
- dst = 0;
- (void) fr_send_icmp_err(ICMP_UNREACH, fin, dst);
- ATOMIC_INCL(frstats[0].fr_ret);
- } else if (((pass & FR_RETMASK) == FR_RETRST) &&
- !(fin->fin_flx & FI_SHORT)) {
- if (fr_send_reset(fin) == 0) {
- ATOMIC_INCL(frstats[1].fr_ret);
- }
- }
- } else {
- if (pass & FR_RETRST)
- fin->fin_error = ECONNRESET;
- }
- }
-
- /*
- * If we didn't drop off the bottom of the list of rules (and thus
- * the 'current' rule fr is not NULL), then we may have some extra
- * instructions about what to do with a packet.
- * Once we're finished return to our caller, freeing the packet if
- * we are dropping it (* BSD ONLY *).
- * Reassign m from fin_m as we may have a new buffer, now.
- */
-#if defined(USE_INET6) || (defined(__sgi) && defined(_KERNEL))
-filtered:
-#endif
- m = fin->fin_m;
-
- if (fr != NULL) {
- frdest_t *fdp;
-
- fdp = &fr->fr_tifs[fin->fin_rev];
-
- if (!out && (pass & FR_FASTROUTE)) {
- /*
- * For fastroute rule, no destioation interface defined
- * so pass NULL as the frdest_t parameter
- */
- (void) fr_fastroute(m, mp, fin, NULL);
- m = *mp = NULL;
- } else if ((fdp->fd_ifp != NULL) &&
- (fdp->fd_ifp != (struct ifnet *)-1)) {
- /* this is for to rules: */
- (void) fr_fastroute(m, mp, fin, fdp);
- m = *mp = NULL;
- }
-
- /*
- * Generate a duplicated packet.
- */
- if (mc != NULL)
- (void) fr_fastroute(mc, &mc, fin, &fr->fr_dif);
- }
-
- /*
- * This late because the likes of fr_fastroute() use fin_fr.
- */
- RWLOCK_EXIT(&ipf_mutex);
-
-finished:
- if (!FR_ISPASS(pass)) {
- ATOMIC_INCL(frstats[out].fr_block);
- if (*mp != NULL) {
- FREE_MB_T(*mp);
- m = *mp = NULL;
- }
- } else {
- ATOMIC_INCL(frstats[out].fr_pass);
-#if defined(_KERNEL) && defined(__sgi)
- if ((fin->fin_hbuf != NULL) &&
- (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) {
- COPYBACK(m, 0, fin->fin_plen, fin->fin_hbuf);
- }
-#endif
- }
-
- RWLOCK_EXIT(&ipf_global);
-#ifdef _KERNEL
-# if OpenBSD >= 200311
- if (FR_ISPASS(pass) && (v == 4)) {
- ip = fin->fin_ip;
- ip->ip_len = ntohs(ip->ip_len);
- ip->ip_off = ntohs(ip->ip_off);
- }
-# endif
- return (FR_ISPASS(pass)) ? 0 : fin->fin_error;
-#else /* _KERNEL */
- FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass));
- if ((pass & FR_NOMATCH) != 0)
- return 1;
-
- if ((pass & FR_RETMASK) != 0)
- switch (pass & FR_RETMASK)
- {
- case FR_RETRST :
- return 3;
- case FR_RETICMP :
- return 4;
- case FR_FAKEICMP :
- return 5;
- }
-
- switch (pass & FR_CMDMASK)
- {
- case FR_PASS :
- return 0;
- case FR_BLOCK :
- return -1;
- case FR_AUTH :
- return -2;
- case FR_ACCOUNT :
- return -3;
- case FR_PREAUTH :
- return -4;
- }
- return 2;
-#endif /* _KERNEL */
-}
-
-
-#ifdef IPFILTER_LOG
-/* ------------------------------------------------------------------------ */
-/* Function: fr_dolog */
-/* Returns: frentry_t* - returns contents of fin_fr (no change made) */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(IO) - pointer to current/new filter decision (unused) */
-/* */
-/* Checks flags set to see how a packet should be logged, if it is to be */
-/* logged. Adjust statistics based on its success or not. */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_dolog(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- u_32_t pass;
- int out;
-
- out = fin->fin_out;
- pass = *passp;
-
- if ((fr_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
- pass |= FF_LOGNOMATCH;
- ATOMIC_INCL(frstats[out].fr_npkl);
- goto logit;
- } else if (((pass & FR_LOGMASK) == FR_LOGP) ||
- (FR_ISPASS(pass) && (fr_flags & FF_LOGPASS))) {
- if ((pass & FR_LOGMASK) != FR_LOGP)
- pass |= FF_LOGPASS;
- ATOMIC_INCL(frstats[out].fr_ppkl);
- goto logit;
- } else if (((pass & FR_LOGMASK) == FR_LOGB) ||
- (FR_ISBLOCK(pass) && (fr_flags & FF_LOGBLOCK))) {
- if ((pass & FR_LOGMASK) != FR_LOGB)
- pass |= FF_LOGBLOCK;
- ATOMIC_INCL(frstats[out].fr_bpkl);
-logit:
- if (ipflog(fin, pass) == -1) {
- ATOMIC_INCL(frstats[out].fr_skip);
-
- /*
- * If the "or-block" option has been used then
- * block the packet if we failed to log it.
- */
- if ((pass & FR_LOGORBLOCK) &&
- FR_ISPASS(pass)) {
- pass &= ~FR_CMDMASK;
- pass |= FR_BLOCK;
- }
- }
- *passp = pass;
- }
-
- return fin->fin_fr;
-}
-#endif /* IPFILTER_LOG */
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: ipf_cksum */
-/* Returns: u_short - IP header checksum */
-/* Parameters: addr(I) - pointer to start of buffer to checksum */
-/* len(I) - length of buffer in bytes */
-/* */
-/* Calculate the two's complement 16 bit checksum of the buffer passed. */
-/* */
-/* N.B.: addr should be 16bit aligned. */
-/* ------------------------------------------------------------------------ */
-u_short ipf_cksum(addr, len)
-u_short *addr;
-int len;
-{
- u_32_t sum = 0;
-
- for (sum = 0; len > 1; len -= 2)
- sum += *addr++;
-
- /* mop up an odd byte, if necessary */
- if (len == 1)
- sum += *(u_char *)addr;
-
- /*
- * add back carry outs from top 16 bits to low 16 bits
- */
- sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
- sum += (sum >> 16); /* add carry */
- return (u_short)(~sum);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_cksum */
-/* Returns: u_short - layer 4 checksum */
-/* Parameters: m(I ) - pointer to buffer holding packet */
-/* ip(I) - pointer to IP header */
-/* l4proto(I) - protocol to caclulate checksum for */
-/* l4hdr(I) - pointer to layer 4 header */
-/* */
-/* Calculates the TCP checksum for the packet held in "m", using the data */
-/* in the IP header "ip" to seed it. */
-/* */
-/* NB: This function assumes we've pullup'd enough for all of the IP header */
-/* and the TCP header. We also assume that data blocks aren't allocated in */
-/* odd sizes. */
-/* */
-/* Expects ip_len to be in host byte order when called. */
-/* ------------------------------------------------------------------------ */
-u_short fr_cksum(m, ip, l4proto, l4hdr)
-mb_t *m;
-ip_t *ip;
-int l4proto;
-void *l4hdr;
-{
- u_short *sp, slen, sumsave, l4hlen, *csump;
- u_int sum, sum2;
- int hlen;
-#ifdef USE_INET6
- ip6_t *ip6;
-#endif
-
- csump = NULL;
- sumsave = 0;
- l4hlen = 0;
- sp = NULL;
- slen = 0;
- hlen = 0;
- sum = 0;
-
- /*
- * Add up IP Header portion
- */
-#ifdef USE_INET6
- if (IP_V(ip) == 4) {
-#endif
- hlen = IP_HL(ip) << 2;
- slen = ip->ip_len - hlen;
- sum = htons((u_short)l4proto);
- sum += htons(slen);
- sp = (u_short *)&ip->ip_src;
- sum += *sp++; /* ip_src */
- sum += *sp++;
- sum += *sp++; /* ip_dst */
- sum += *sp++;
-#ifdef USE_INET6
- } else if (IP_V(ip) == 6) {
- ip6 = (ip6_t *)ip;
- hlen = sizeof(*ip6);
- slen = ntohs(ip6->ip6_plen);
- sum = htons((u_short)l4proto);
- sum += htons(slen);
- sp = (u_short *)&ip6->ip6_src;
- sum += *sp++; /* ip6_src */
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++; /* ip6_dst */
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- }
-#endif
-
- switch (l4proto)
- {
- case IPPROTO_UDP :
- csump = &((udphdr_t *)l4hdr)->uh_sum;
- l4hlen = sizeof(udphdr_t);
- break;
-
- case IPPROTO_TCP :
- csump = &((tcphdr_t *)l4hdr)->th_sum;
- l4hlen = sizeof(tcphdr_t);
- break;
- case IPPROTO_ICMP :
- csump = &((icmphdr_t *)l4hdr)->icmp_cksum;
- l4hlen = 4;
- sum = 0;
- break;
- default :
- break;
- }
-
- if (csump != NULL) {
- sumsave = *csump;
- *csump = 0;
- }
-
- l4hlen = l4hlen; /* LINT */
-
-#ifdef _KERNEL
-# ifdef MENTAT
- {
- void *rp = m->b_rptr;
-
- if ((unsigned char *)ip > m->b_rptr && (unsigned char *)ip < m->b_wptr)
- m->b_rptr = (u_char *)ip;
- sum2 = ip_cksum(m, hlen, sum); /* hlen == offset */
- m->b_rptr = rp;
- sum2 = (u_short)(~sum2 & 0xffff);
- }
-# else /* MENTAT */
-# if defined(BSD) || defined(sun)
-# if BSD >= 199103
- m->m_data += hlen;
-# else
- m->m_off += hlen;
-# endif
- m->m_len -= hlen;
- sum2 = in_cksum(m, slen);
- m->m_len += hlen;
-# if BSD >= 199103
- m->m_data -= hlen;
-# else
- m->m_off -= hlen;
-# endif
- /*
- * Both sum and sum2 are partial sums, so combine them together.
- */
- sum += ~sum2 & 0xffff;
- while (sum > 0xffff)
- sum = (sum & 0xffff) + (sum >> 16);
- sum2 = ~sum & 0xffff;
-# else /* defined(BSD) || defined(sun) */
-{
- union {
- u_char c[2];
- u_short s;
- } bytes;
- u_short len = ip->ip_len;
-# if defined(__sgi)
- int add;
-# endif
-
- /*
- * Add up IP Header portion
- */
- if (sp != (u_short *)l4hdr)
- sp = (u_short *)l4hdr;
-
- switch (l4proto)
- {
- case IPPROTO_UDP :
- sum += *sp++; /* sport */
- sum += *sp++; /* dport */
- sum += *sp++; /* udp length */
- sum += *sp++; /* checksum */
- break;
-
- case IPPROTO_TCP :
- sum += *sp++; /* sport */
- sum += *sp++; /* dport */
- sum += *sp++; /* seq */
- sum += *sp++;
- sum += *sp++; /* ack */
- sum += *sp++;
- sum += *sp++; /* off */
- sum += *sp++; /* win */
- sum += *sp++; /* checksum */
- sum += *sp++; /* urp */
- break;
- case IPPROTO_ICMP :
- sum = *sp++; /* type/code */
- sum += *sp++; /* checksum */
- break;
- }
-
-# ifdef __sgi
- /*
- * In case we had to copy the IP & TCP header out of mbufs,
- * skip over the mbuf bits which are the header
- */
- if ((caddr_t)ip != mtod(m, caddr_t)) {
- hlen = (caddr_t)sp - (caddr_t)ip;
- while (hlen) {
- add = MIN(hlen, m->m_len);
- sp = (u_short *)(mtod(m, caddr_t) + add);
- hlen -= add;
- if (add == m->m_len) {
- m = m->m_next;
- if (!hlen) {
- if (!m)
- break;
- sp = mtod(m, u_short *);
- }
- PANIC((!m),("fr_cksum(1): not enough data"));
- }
- }
- }
-# endif
-
- len -= (l4hlen + hlen);
- if (len <= 0)
- goto nodata;
-
- while (len > 1) {
- if (((caddr_t)sp - mtod(m, caddr_t)) >= m->m_len) {
- m = m->m_next;
- PANIC((!m),("fr_cksum(2): not enough data"));
- sp = mtod(m, u_short *);
- }
- if (((caddr_t)(sp + 1) - mtod(m, caddr_t)) > m->m_len) {
- bytes.c[0] = *(u_char *)sp;
- m = m->m_next;
- PANIC((!m),("fr_cksum(3): not enough data"));
- sp = mtod(m, u_short *);
- bytes.c[1] = *(u_char *)sp;
- sum += bytes.s;
- sp = (u_short *)((u_char *)sp + 1);
- }
- if ((u_long)sp & 1) {
- bcopy((char *)sp++, (char *)&bytes.s, sizeof(bytes.s));
- sum += bytes.s;
- } else
- sum += *sp++;
- len -= 2;
- }
-
- if (len != 0)
- sum += ntohs(*(u_char *)sp << 8);
-nodata:
- while (sum > 0xffff)
- sum = (sum & 0xffff) + (sum >> 16);
- sum2 = (u_short)(~sum & 0xffff);
-}
-# endif /* defined(BSD) || defined(sun) */
-# endif /* MENTAT */
-#else /* _KERNEL */
- for (; slen > 1; slen -= 2)
- sum += *sp++;
- if (slen)
- sum += ntohs(*(u_char *)sp << 8);
- while (sum > 0xffff)
- sum = (sum & 0xffff) + (sum >> 16);
- sum2 = (u_short)(~sum & 0xffff);
-#endif /* _KERNEL */
- if (csump != NULL)
- *csump = sumsave;
- return sum2;
-}
-
-
-#if defined(_KERNEL) && ( ((BSD < 199103) && !defined(MENTAT)) || \
- defined(__sgi) ) && !defined(linux)
-/*
- * Copyright (c) 1982, 1986, 1988, 1991, 1993
- * The Regents of the University of California. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- * may be used to endorse or promote products derived from this software
- * without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * Id: fil.c,v 2.243.2.57 2005/03/28 10:47:50 darrenr Exp
- */
-/*
- * Copy data from an mbuf chain starting "off" bytes from the beginning,
- * continuing for "len" bytes, into the indicated buffer.
- */
-void
-m_copydata(m, off, len, cp)
- mb_t *m;
- int off;
- int len;
- caddr_t cp;
-{
- unsigned count;
-
- if (off < 0 || len < 0)
- panic("m_copydata");
- while (off > 0) {
- if (m == 0)
- panic("m_copydata");
- if (off < m->m_len)
- break;
- off -= m->m_len;
- m = m->m_next;
- }
- while (len > 0) {
- if (m == 0)
- panic("m_copydata");
- count = MIN(m->m_len - off, len);
- bcopy(mtod(m, caddr_t) + off, cp, count);
- len -= count;
- cp += count;
- off = 0;
- m = m->m_next;
- }
-}
-
-
-/*
- * Copy data from a buffer back into the indicated mbuf chain,
- * starting "off" bytes from the beginning, extending the mbuf
- * chain if necessary.
- */
-void
-m_copyback(m0, off, len, cp)
- struct mbuf *m0;
- int off;
- int len;
- caddr_t cp;
-{
- int mlen;
- struct mbuf *m = m0, *n;
- int totlen = 0;
-
- if (m0 == 0)
- return;
- while (off > (mlen = m->m_len)) {
- off -= mlen;
- totlen += mlen;
- if (m->m_next == 0) {
- n = m_getclr(M_DONTWAIT, m->m_type);
- if (n == 0)
- goto out;
- n->m_len = min(MLEN, len + off);
- m->m_next = n;
- }
- m = m->m_next;
- }
- while (len > 0) {
- mlen = min (m->m_len - off, len);
- bcopy(cp, off + mtod(m, caddr_t), (unsigned)mlen);
- cp += mlen;
- len -= mlen;
- mlen += off;
- off = 0;
- totlen += mlen;
- if (len == 0)
- break;
- if (m->m_next == 0) {
- n = m_get(M_DONTWAIT, m->m_type);
- if (n == 0)
- break;
- n->m_len = min(MLEN, len);
- m->m_next = n;
- }
- m = m->m_next;
- }
-out:
-#if 0
- if (((m = m0)->m_flags & M_PKTHDR) && (m->m_pkthdr.len < totlen))
- m->m_pkthdr.len = totlen;
-#endif
- return;
-}
-#endif /* (_KERNEL) && ( ((BSD < 199103) && !MENTAT) || __sgi) */
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_findgroup */
-/* Returns: frgroup_t * - NULL = group not found, else pointer to group */
-/* Parameters: group(I) - group name to search for */
-/* unit(I) - device to which this group belongs */
-/* set(I) - which set of rules (inactive/inactive) this is */
-/* fgpp(O) - pointer to place to store pointer to the pointer */
-/* to where to add the next (last) group or where */
-/* to delete group from. */
-/* */
-/* Search amongst the defined groups for a particular group number. */
-/* ------------------------------------------------------------------------ */
-frgroup_t *fr_findgroup(group, unit, set, fgpp)
-char *group;
-minor_t unit;
-int set;
-frgroup_t ***fgpp;
-{
- frgroup_t *fg, **fgp;
-
- /*
- * Which list of groups to search in is dependant on which list of
- * rules are being operated on.
- */
- fgp = &ipfgroups[unit][set];
-
- while ((fg = *fgp) != NULL) {
- if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0)
- break;
- else
- fgp = &fg->fg_next;
- }
- if (fgpp != NULL)
- *fgpp = fgp;
- return fg;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_addgroup */
-/* Returns: frgroup_t * - NULL == did not create group, */
-/* != NULL == pointer to the group */
-/* Parameters: num(I) - group number to add */
-/* head(I) - rule pointer that is using this as the head */
-/* flags(I) - rule flags which describe the type of rule it is */
-/* unit(I) - device to which this group will belong to */
-/* set(I) - which set of rules (inactive/inactive) this is */
-/* Write Locks: ipf_mutex */
-/* */
-/* Add a new group head, or if it already exists, increase the reference */
-/* count to it. */
-/* ------------------------------------------------------------------------ */
-frgroup_t *fr_addgroup(group, head, flags, unit, set)
-char *group;
-void *head;
-u_32_t flags;
-minor_t unit;
-int set;
-{
- frgroup_t *fg, **fgp;
- u_32_t gflags;
-
- if (group == NULL)
- return NULL;
-
- if (unit == IPL_LOGIPF && *group == '\0')
- return NULL;
-
- fgp = NULL;
- gflags = flags & FR_INOUT;
-
- fg = fr_findgroup(group, unit, set, &fgp);
- if (fg != NULL) {
- if (fg->fg_flags == 0)
- fg->fg_flags = gflags;
- else if (gflags != fg->fg_flags)
- return NULL;
- fg->fg_ref++;
- return fg;
- }
- KMALLOC(fg, frgroup_t *);
- if (fg != NULL) {
- fg->fg_head = head;
- fg->fg_start = NULL;
- fg->fg_next = *fgp;
- bcopy(group, fg->fg_name, FR_GROUPLEN);
- fg->fg_flags = gflags;
- fg->fg_ref = 1;
- *fgp = fg;
- }
- return fg;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_delgroup */
-/* Returns: Nil */
-/* Parameters: group(I) - group name to delete */
-/* unit(I) - device to which this group belongs */
-/* set(I) - which set of rules (inactive/inactive) this is */
-/* Write Locks: ipf_mutex */
-/* */
-/* Attempt to delete a group head. */
-/* Only do this when its reference count reaches 0. */
-/* ------------------------------------------------------------------------ */
-void fr_delgroup(group, unit, set)
-char *group;
-minor_t unit;
-int set;
-{
- frgroup_t *fg, **fgp;
-
- fg = fr_findgroup(group, unit, set, &fgp);
- if (fg == NULL)
- return;
-
- fg->fg_ref--;
- if (fg->fg_ref == 0) {
- *fgp = fg->fg_next;
- KFREE(fg);
- }
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_getrulen */
-/* Returns: frentry_t * - NULL == not found, else pointer to rule n */
-/* Parameters: unit(I) - device for which to count the rule's number */
-/* flags(I) - which set of rules to find the rule in */
-/* group(I) - group name */
-/* n(I) - rule number to find */
-/* */
-/* Find rule # n in group # g and return a pointer to it. Return NULl if */
-/* group # g doesn't exist or there are less than n rules in the group. */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_getrulen(unit, group, n)
-int unit;
-char *group;
-u_32_t n;
-{
- frentry_t *fr;
- frgroup_t *fg;
-
- fg = fr_findgroup(group, unit, fr_active, NULL);
- if (fg == NULL)
- return NULL;
- for (fr = fg->fg_head; fr && n; fr = fr->fr_next, n--)
- ;
- if (n != 0)
- return NULL;
- return fr;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_rulen */
-/* Returns: int - >= 0 - rule number, -1 == search failed */
-/* Parameters: unit(I) - device for which to count the rule's number */
-/* fr(I) - pointer to rule to match */
-/* */
-/* Return the number for a rule on a specific filtering device. */
-/* ------------------------------------------------------------------------ */
-int fr_rulen(unit, fr)
-int unit;
-frentry_t *fr;
-{
- frentry_t *fh;
- frgroup_t *fg;
- u_32_t n = 0;
-
- if (fr == NULL)
- return -1;
- fg = fr_findgroup(fr->fr_group, unit, fr_active, NULL);
- if (fg == NULL)
- return -1;
- for (fh = fg->fg_head; fh; n++, fh = fh->fr_next)
- if (fh == fr)
- break;
- if (fh == NULL)
- return -1;
- return n;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frflushlist */
-/* Returns: int - >= 0 - number of flushed rules */
-/* Parameters: set(I) - which set of rules (inactive/inactive) this is */
-/* unit(I) - device for which to flush rules */
-/* flags(I) - which set of rules to flush */
-/* nfreedp(O) - pointer to int where flush count is stored */
-/* listp(I) - pointer to list to flush pointer */
-/* Write Locks: ipf_mutex */
-/* */
-/* Recursively flush rules from the list, descending groups as they are */
-/* encountered. if a rule is the head of a group and it has lost all its */
-/* group members, then also delete the group reference. nfreedp is needed */
-/* to store the accumulating count of rules removed, whereas the returned */
-/* value is just the number removed from the current list. The latter is */
-/* needed to correctly adjust reference counts on rules that define groups. */
-/* */
-/* NOTE: Rules not loaded from user space cannot be flushed. */
-/* ------------------------------------------------------------------------ */
-static int frflushlist(set, unit, nfreedp, listp)
-int set;
-minor_t unit;
-int *nfreedp;
-frentry_t **listp;
-{
- int freed = 0, i;
- frentry_t *fp;
-
- while ((fp = *listp) != NULL) {
- if ((fp->fr_type & FR_T_BUILTIN) ||
- !(fp->fr_flags & FR_COPIED)) {
- listp = &fp->fr_next;
- continue;
- }
- *listp = fp->fr_next;
- if (fp->fr_grp != NULL) {
- i = frflushlist(set, unit, nfreedp, fp->fr_grp);
- fp->fr_ref -= i;
- }
-
- if (fp->fr_grhead != NULL) {
- fr_delgroup(fp->fr_grhead, unit, set);
- *fp->fr_grhead = '\0';
- }
-
- ASSERT(fp->fr_ref > 0);
- fp->fr_next = NULL;
- if (fr_derefrule(&fp) == 0)
- freed++;
- }
- *nfreedp += freed;
- return freed;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frflush */
-/* Returns: int - >= 0 - number of flushed rules */
-/* Parameters: unit(I) - device for which to flush rules */
-/* flags(I) - which set of rules to flush */
-/* */
-/* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */
-/* and IPv6) as defined by the value of flags. */
-/* ------------------------------------------------------------------------ */
-int frflush(unit, proto, flags)
-minor_t unit;
-int proto, flags;
-{
- int flushed = 0, set;
-
- WRITE_ENTER(&ipf_mutex);
- bzero((char *)frcache, sizeof(frcache));
-
- set = fr_active;
- if ((flags & FR_INACTIVE) == FR_INACTIVE)
- set = 1 - set;
-
- if (flags & FR_OUTQUE) {
- if (proto == 0 || proto == 6) {
- (void) frflushlist(set, unit,
- &flushed, &ipfilter6[1][set]);
- (void) frflushlist(set, unit,
- &flushed, &ipacct6[1][set]);
- }
- if (proto == 0 || proto == 4) {
- (void) frflushlist(set, unit,
- &flushed, &ipfilter[1][set]);
- (void) frflushlist(set, unit,
- &flushed, &ipacct[1][set]);
- }
- }
- if (flags & FR_INQUE) {
- if (proto == 0 || proto == 6) {
- (void) frflushlist(set, unit,
- &flushed, &ipfilter6[0][set]);
- (void) frflushlist(set, unit,
- &flushed, &ipacct6[0][set]);
- }
- if (proto == 0 || proto == 4) {
- (void) frflushlist(set, unit,
- &flushed, &ipfilter[0][set]);
- (void) frflushlist(set, unit,
- &flushed, &ipacct[0][set]);
- }
- }
- RWLOCK_EXIT(&ipf_mutex);
-
- if (unit == IPL_LOGIPF) {
- int tmp;
-
- tmp = frflush(IPL_LOGCOUNT, proto, flags);
- if (tmp >= 0)
- flushed += tmp;
- }
- return flushed;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: memstr */
-/* Returns: char * - NULL if failed, != NULL pointer to matching bytes */
-/* Parameters: src(I) - pointer to byte sequence to match */
-/* dst(I) - pointer to byte sequence to search */
-/* slen(I) - match length */
-/* dlen(I) - length available to search in */
-/* */
-/* Search dst for a sequence of bytes matching those at src and extend for */
-/* slen bytes. */
-/* ------------------------------------------------------------------------ */
-char *memstr(src, dst, slen, dlen)
-char *src, *dst;
-int slen, dlen;
-{
- char *s = NULL;
-
- while (dlen >= slen) {
- if (bcmp(src, dst, slen) == 0) {
- s = dst;
- break;
- }
- dst++;
- dlen--;
- }
- return s;
-}
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fixskip */
-/* Returns: Nil */
-/* Parameters: listp(IO) - pointer to start of list with skip rule */
-/* rp(I) - rule added/removed with skip in it. */
-/* addremove(I) - adjustment (-1/+1) to make to skip count, */
-/* depending on whether a rule was just added */
-/* or removed. */
-/* */
-/* Adjust all the rules in a list which would have skip'd past the position */
-/* where we are inserting to skip to the right place given the change. */
-/* ------------------------------------------------------------------------ */
-void fr_fixskip(listp, rp, addremove)
-frentry_t **listp, *rp;
-int addremove;
-{
- int rules, rn;
- frentry_t *fp;
-
- rules = 0;
- for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next)
- rules++;
-
- if (!fp)
- return;
-
- for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++)
- if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules))
- fp->fr_arg += addremove;
-}
-
-
-#ifdef _KERNEL
-/* ------------------------------------------------------------------------ */
-/* Function: count4bits */
-/* Returns: int - >= 0 - number of consecutive bits in input */
-/* Parameters: ip(I) - 32bit IP address */
-/* */
-/* IPv4 ONLY */
-/* count consecutive 1's in bit mask. If the mask generated by counting */
-/* consecutive 1's is different to that passed, return -1, else return # */
-/* of bits. */
-/* ------------------------------------------------------------------------ */
-int count4bits(ip)
-u_32_t ip;
-{
- u_32_t ipn;
- int cnt = 0, i, j;
-
- ip = ipn = ntohl(ip);
- for (i = 32; i; i--, ipn *= 2)
- if (ipn & 0x80000000)
- cnt++;
- else
- break;
- ipn = 0;
- for (i = 32, j = cnt; i; i--, j--) {
- ipn *= 2;
- if (j > 0)
- ipn++;
- }
- if (ipn == ip)
- return cnt;
- return -1;
-}
-
-
-# if 0
-/* ------------------------------------------------------------------------ */
-/* Function: count6bits */
-/* Returns: int - >= 0 - number of consecutive bits in input */
-/* Parameters: msk(I) - pointer to start of IPv6 bitmask */
-/* */
-/* IPv6 ONLY */
-/* count consecutive 1's in bit mask. */
-/* ------------------------------------------------------------------------ */
-int count6bits(msk)
-u_32_t *msk;
-{
- int i = 0, k;
- u_32_t j;
-
- for (k = 3; k >= 0; k--)
- if (msk[k] == 0xffffffff)
- i += 32;
- else {
- for (j = msk[k]; j; j <<= 1)
- if (j & 0x80000000)
- i++;
- }
- return i;
-}
-# endif
-#endif /* _KERNEL */
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frsynclist */
-/* Returns: void */
-/* Parameters: fr(I) - start of filter list to sync interface names for */
-/* ifp(I) - interface pointer for limiting sync lookups */
-/* Write Locks: ipf_mutex */
-/* */
-/* Walk through a list of filter rules and resolve any interface names into */
-/* pointers. Where dynamic addresses are used, also update the IP address */
-/* used in the rule. The interface pointer is used to limit the lookups to */
-/* a specific set of matching names if it is non-NULL. */
-/* ------------------------------------------------------------------------ */
-static void frsynclist(fr, ifp)
-frentry_t *fr;
-void *ifp;
-{
- frdest_t *fdp;
- int v, i;
-
- for (; fr; fr = fr->fr_next) {
- v = fr->fr_v;
-
- /*
- * Lookup all the interface names that are part of the rule.
- */
- for (i = 0; i < 4; i++) {
- if ((ifp != NULL) && (fr->fr_ifas[i] != ifp))
- continue;
- fr->fr_ifas[i] = fr_resolvenic(fr->fr_ifnames[i], v);
- }
-
- if (fr->fr_type == FR_T_IPF) {
- if (fr->fr_satype != FRI_NORMAL &&
- fr->fr_satype != FRI_LOOKUP) {
- (void)fr_ifpaddr(v, fr->fr_satype,
- fr->fr_ifas[fr->fr_sifpidx],
- &fr->fr_src, &fr->fr_smsk);
- }
- if (fr->fr_datype != FRI_NORMAL &&
- fr->fr_datype != FRI_LOOKUP) {
- (void)fr_ifpaddr(v, fr->fr_datype,
- fr->fr_ifas[fr->fr_difpidx],
- &fr->fr_dst, &fr->fr_dmsk);
- }
- }
-
- fdp = &fr->fr_tifs[0];
- if ((ifp == NULL) || (fdp->fd_ifp == ifp))
- fr_resolvedest(fdp, v);
-
- fdp = &fr->fr_tifs[1];
- if ((ifp == NULL) || (fdp->fd_ifp == ifp))
- fr_resolvedest(fdp, v);
-
- fdp = &fr->fr_dif;
- if ((ifp == NULL) || (fdp->fd_ifp == ifp)) {
- fr_resolvedest(fdp, v);
-
- fr->fr_flags &= ~FR_DUP;
- if ((fdp->fd_ifp != (void *)-1) &&
- (fdp->fd_ifp != NULL))
- fr->fr_flags |= FR_DUP;
- }
-
-#ifdef IPFILTER_LOOKUP
- if (fr->fr_type == FR_T_IPF && fr->fr_satype == FRI_LOOKUP &&
- fr->fr_srcptr == NULL) {
- fr->fr_srcptr = fr_resolvelookup(fr->fr_srctype,
- fr->fr_srcnum,
- &fr->fr_srcfunc);
- }
- if (fr->fr_type == FR_T_IPF && fr->fr_datype == FRI_LOOKUP &&
- fr->fr_dstptr == NULL) {
- fr->fr_dstptr = fr_resolvelookup(fr->fr_dsttype,
- fr->fr_dstnum,
- &fr->fr_dstfunc);
- }
-#endif
- }
-}
-
-
-#ifdef _KERNEL
-/* ------------------------------------------------------------------------ */
-/* Function: frsync */
-/* Returns: void */
-/* Parameters: Nil */
-/* */
-/* frsync() is called when we suspect that the interface list or */
-/* information about interfaces (like IP#) has changed. Go through all */
-/* filter rules, NAT entries and the state table and check if anything */
-/* needs to be changed/updated. */
-/* ------------------------------------------------------------------------ */
-void frsync(ifp)
-void *ifp;
-{
- int i;
-
-# if !SOLARIS
- fr_natsync(ifp);
- fr_statesync(ifp);
-# endif
-
- WRITE_ENTER(&ipf_mutex);
- frsynclist(ipacct[0][fr_active], ifp);
- frsynclist(ipacct[1][fr_active], ifp);
- frsynclist(ipfilter[0][fr_active], ifp);
- frsynclist(ipfilter[1][fr_active], ifp);
- frsynclist(ipacct6[0][fr_active], ifp);
- frsynclist(ipacct6[1][fr_active], ifp);
- frsynclist(ipfilter6[0][fr_active], ifp);
- frsynclist(ipfilter6[1][fr_active], ifp);
-
- for (i = 0; i < IPL_LOGSIZE; i++) {
- frgroup_t *g;
-
- for (g = ipfgroups[i][0]; g != NULL; g = g->fg_next)
- frsynclist(g->fg_start, ifp);
- for (g = ipfgroups[i][1]; g != NULL; g = g->fg_next)
- frsynclist(g->fg_start, ifp);
- }
- RWLOCK_EXIT(&ipf_mutex);
-}
-
-
-/*
- * In the functions below, bcopy() is called because the pointer being
- * copied _from_ in this instance is a pointer to a char buf (which could
- * end up being unaligned) and on the kernel's local stack.
- */
-/* ------------------------------------------------------------------------ */
-/* Function: copyinptr */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: src(I) - pointer to the source address */
-/* dst(I) - destination address */
-/* size(I) - number of bytes to copy */
-/* */
-/* Copy a block of data in from user space, given a pointer to the pointer */
-/* to start copying from (src) and a pointer to where to store it (dst). */
-/* NB: src - pointer to user space pointer, dst - kernel space pointer */
-/* ------------------------------------------------------------------------ */
-int copyinptr(src, dst, size)
-void *src, *dst;
-size_t size;
-{
- caddr_t ca;
- int err;
-
-# if SOLARIS
- err = COPYIN(src, (caddr_t)&ca, sizeof(ca));
- if (err != 0)
- return err;
-# else
- bcopy(src, (caddr_t)&ca, sizeof(ca));
-# endif
- err = COPYIN(ca, dst, size);
- return err;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: copyoutptr */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: src(I) - pointer to the source address */
-/* dst(I) - destination address */
-/* size(I) - number of bytes to copy */
-/* */
-/* Copy a block of data out to user space, given a pointer to the pointer */
-/* to start copying from (src) and a pointer to where to store it (dst). */
-/* NB: src - kernel space pointer, dst - pointer to user space pointer. */
-/* ------------------------------------------------------------------------ */
-int copyoutptr(src, dst, size)
-void *src, *dst;
-size_t size;
-{
- caddr_t ca;
- int err;
-
-# if SOLARIS
- err = COPYIN(dst, (caddr_t)&ca, sizeof(ca));
- if (err != 0)
- return err;
-# else
- bcopy(dst, (caddr_t)&ca, sizeof(ca));
-# endif
- err = COPYOUT(src, ca, size);
- return err;
-}
-#endif
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_lock */
-/* Returns: (void) */
-/* Parameters: data(I) - pointer to lock value to set */
-/* lockp(O) - pointer to location to store old lock value */
-/* */
-/* Get the new value for the lock integer, set it and return the old value */
-/* in *lockp. */
-/* ------------------------------------------------------------------------ */
-void fr_lock(data, lockp)
-caddr_t data;
-int *lockp;
-{
- int arg;
-
- BCOPYIN(data, (caddr_t)&arg, sizeof(arg));
- BCOPYOUT((caddr_t)lockp, data, sizeof(*lockp));
- *lockp = arg;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_getstat */
-/* Returns: Nil */
-/* Parameters: fiop(I) - pointer to ipfilter stats structure */
-/* */
-/* Stores a copy of current pointers, counters, etc, in the friostat */
-/* structure. */
-/* ------------------------------------------------------------------------ */
-void fr_getstat(fiop)
-friostat_t *fiop;
-{
- int i, j;
-
- bcopy((char *)frstats, (char *)fiop->f_st, sizeof(filterstats_t) * 2);
- fiop->f_locks[IPL_LOGSTATE] = fr_state_lock;
- fiop->f_locks[IPL_LOGNAT] = fr_nat_lock;
- fiop->f_locks[IPL_LOGIPF] = fr_frag_lock;
- fiop->f_locks[IPL_LOGAUTH] = fr_auth_lock;
-
- for (i = 0; i < 2; i++)
- for (j = 0; j < 2; j++) {
- fiop->f_ipf[i][j] = ipfilter[i][j];
- fiop->f_acct[i][j] = ipacct[i][j];
- fiop->f_ipf6[i][j] = ipfilter6[i][j];
- fiop->f_acct6[i][j] = ipacct6[i][j];
- }
-
- fiop->f_ticks = fr_ticks;
- fiop->f_active = fr_active;
- fiop->f_froute[0] = fr_frouteok[0];
- fiop->f_froute[1] = fr_frouteok[1];
-
- fiop->f_running = fr_running;
- for (i = 0; i < IPL_LOGSIZE; i++) {
- fiop->f_groups[i][0] = ipfgroups[i][0];
- fiop->f_groups[i][1] = ipfgroups[i][1];
- }
-#ifdef IPFILTER_LOG
- fiop->f_logging = 1;
-#else
- fiop->f_logging = 0;
-#endif
- fiop->f_defpass = fr_pass;
- fiop->f_features = fr_features;
- (void) strncpy(fiop->f_version, ipfilter_version,
- sizeof(fiop->f_version));
-}
-
-
-#ifdef USE_INET6
-int icmptoicmp6types[ICMP_MAXTYPE+1] = {
- ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */
- -1, /* 1: UNUSED */
- -1, /* 2: UNUSED */
- ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */
- -1, /* 4: ICMP_SOURCEQUENCH */
- ND_REDIRECT, /* 5: ICMP_REDIRECT */
- -1, /* 6: UNUSED */
- -1, /* 7: UNUSED */
- ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */
- -1, /* 9: UNUSED */
- -1, /* 10: UNUSED */
- ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */
- ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */
- -1, /* 13: ICMP_TSTAMP */
- -1, /* 14: ICMP_TSTAMPREPLY */
- -1, /* 15: ICMP_IREQ */
- -1, /* 16: ICMP_IREQREPLY */
- -1, /* 17: ICMP_MASKREQ */
- -1, /* 18: ICMP_MASKREPLY */
-};
-
-
-int icmptoicmp6unreach[ICMP_MAX_UNREACH] = {
- ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */
- ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */
- -1, /* 2: ICMP_UNREACH_PROTOCOL */
- ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */
- -1, /* 4: ICMP_UNREACH_NEEDFRAG */
- ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */
- ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */
- ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */
- -1, /* 8: ICMP_UNREACH_ISOLATED */
- ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */
- ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */
- -1, /* 11: ICMP_UNREACH_TOSNET */
- -1, /* 12: ICMP_UNREACH_TOSHOST */
- ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */
-};
-int icmpreplytype6[ICMP6_MAXTYPE + 1];
-#endif
-
-int icmpreplytype4[ICMP_MAXTYPE + 1];
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_matchicmpqueryreply */
-/* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */
-/* Parameters: v(I) - IP protocol version (4 or 6) */
-/* ic(I) - ICMP information */
-/* icmp(I) - ICMP packet header */
-/* rev(I) - direction (0 = forward/1 = reverse) of packet */
-/* */
-/* Check if the ICMP packet defined by the header pointed to by icmp is a */
-/* reply to one as described by what's in ic. If it is a match, return 1, */
-/* else return 0 for no match. */
-/* ------------------------------------------------------------------------ */
-int fr_matchicmpqueryreply(v, ic, icmp, rev)
-int v;
-icmpinfo_t *ic;
-icmphdr_t *icmp;
-int rev;
-{
- int ictype;
-
- ictype = ic->ici_type;
-
- if (v == 4) {
- /*
- * If we matched its type on the way in, then when going out
- * it will still be the same type.
- */
- if ((!rev && (icmp->icmp_type == ictype)) ||
- (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) {
- if (icmp->icmp_type != ICMP_ECHOREPLY)
- return 1;
- if (icmp->icmp_id == ic->ici_id)
- return 1;
- }
- }
-#ifdef USE_INET6
- else if (v == 6) {
- if ((!rev && (icmp->icmp_type == ictype)) ||
- (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) {
- if (icmp->icmp_type != ICMP6_ECHO_REPLY)
- return 1;
- if (icmp->icmp_id == ic->ici_id)
- return 1;
- }
- }
-#endif
- return 0;
-}
-
-
-#ifdef IPFILTER_LOOKUP
-/* ------------------------------------------------------------------------ */
-/* Function: fr_resolvelookup */
-/* Returns: void * - NULL = failure, else success. */
-/* Parameters: type(I) - type of lookup these parameters are for. */
-/* number(I) - table number to use when searching */
-/* funcptr(IO) - pointer to pointer for storing IP address */
-/* searching function. */
-/* */
-/* Search for the "table" number passed in amongst those configured for */
-/* that particular type. If the type is recognised then the function to */
-/* call to do the IP address search will be change, regardless of whether */
-/* or not the "table" number exists. */
-/* ------------------------------------------------------------------------ */
-static void *fr_resolvelookup(type, number, funcptr)
-u_int type, number;
-lookupfunc_t *funcptr;
-{
- char name[FR_GROUPLEN];
- iphtable_t *iph;
- ip_pool_t *ipo;
- void *ptr;
-
-#if defined(SNPRINTF) && defined(_KERNEL)
- SNPRINTF(name, sizeof(name), "%u", number);
-#else
- (void) sprintf(name, "%u", number);
-#endif
-
- READ_ENTER(&ip_poolrw);
-
- switch (type)
- {
- case IPLT_POOL :
-# if (defined(__osf__) && defined(_KERNEL))
- ptr = NULL;
- *funcptr = NULL;
-# else
- ipo = ip_pool_find(IPL_LOGIPF, name);
- ptr = ipo;
- if (ipo != NULL) {
- ATOMIC_INC32(ipo->ipo_ref);
- }
- *funcptr = ip_pool_search;
-# endif
- break;
- case IPLT_HASH :
- iph = fr_findhtable(IPL_LOGIPF, name);
- ptr = iph;
- if (iph != NULL) {
- ATOMIC_INC32(iph->iph_ref);
- }
- *funcptr = fr_iphmfindip;
- break;
- default:
- ptr = NULL;
- *funcptr = NULL;
- break;
- }
- RWLOCK_EXIT(&ip_poolrw);
-
- return ptr;
-}
-#endif
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: frrequest */
-/* Returns: int - 0 == success, > 0 == errno value */
-/* Parameters: unit(I) - device for which this is for */
-/* req(I) - ioctl command (SIOC*) */
-/* data(I) - pointr to ioctl data */
-/* set(I) - 1 or 0 (filter set) */
-/* makecopy(I) - flag indicating whether data points to a rule */
-/* in kernel space & hence doesn't need copying. */
-/* */
-/* This function handles all the requests which operate on the list of */
-/* filter rules. This includes adding, deleting, insertion. It is also */
-/* responsible for creating groups when a "head" rule is loaded. Interface */
-/* names are resolved here and other sanity checks are made on the content */
-/* of the rule structure being loaded. If a rule has user defined timeouts */
-/* then make sure they are created and initialised before exiting. */
-/* ------------------------------------------------------------------------ */
-int frrequest(unit, req, data, set, makecopy)
-int unit;
-ioctlcmd_t req;
-int set, makecopy;
-caddr_t data;
-{
- frentry_t frd, *fp, *f, **fprev, **ftail;
- int error = 0, in, v;
- void *ptr, *uptr;
- u_int *p, *pp;
- frgroup_t *fg;
- char *group;
-
- fg = NULL;
- fp = &frd;
- if (makecopy != 0) {
- error = fr_inobj(data, fp, IPFOBJ_FRENTRY);
- if (error)
- return EFAULT;
- if ((fp->fr_flags & FR_T_BUILTIN) != 0)
- return EINVAL;
- fp->fr_ref = 0;
- fp->fr_flags |= FR_COPIED;
- } else {
- fp = (frentry_t *)data;
- if ((fp->fr_type & FR_T_BUILTIN) == 0)
- return EINVAL;
- fp->fr_flags &= ~FR_COPIED;
- }
-
- if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) ||
- ((fp->fr_dsize != 0) && (fp->fr_data == NULL)))
- return EINVAL;
-
- v = fp->fr_v;
- uptr = fp->fr_data;
-
- /*
- * Only filter rules for IPv4 or IPv6 are accepted.
- */
- if (v == 4)
- /*EMPTY*/;
-#ifdef USE_INET6
- else if (v == 6)
- /*EMPTY*/;
-#endif
- else {
- return EINVAL;
- }
-
- /*
- * If the rule is being loaded from user space, i.e. we had to copy it
- * into kernel space, then do not trust the function pointer in the
- * rule.
- */
- if ((makecopy == 1) && (fp->fr_func != NULL)) {
- if (fr_findfunc(fp->fr_func) == NULL)
- return ESRCH;
- error = fr_funcinit(fp);
- if (error != 0)
- return error;
- }
-
- ptr = NULL;
- /*
- * Check that the group number does exist and that its use (in/out)
- * matches what the rule is.
- */
- if (!strncmp(fp->fr_grhead, "0", FR_GROUPLEN))
- *fp->fr_grhead = '\0';
- group = fp->fr_group;
- if (!strncmp(group, "0", FR_GROUPLEN))
- *group = '\0';
-
- if (FR_ISACCOUNT(fp->fr_flags))
- unit = IPL_LOGCOUNT;
-
- if ((req != (int)SIOCZRLST) && (*group != '\0')) {
- fg = fr_findgroup(group, unit, set, NULL);
- if (fg == NULL)
- return ESRCH;
- if (fg->fg_flags == 0)
- fg->fg_flags = fp->fr_flags & FR_INOUT;
- else if (fg->fg_flags != (fp->fr_flags & FR_INOUT))
- return ESRCH;
- }
-
- in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
-
- /*
- * Work out which rule list this change is being applied to.
- */
- ftail = NULL;
- fprev = NULL;
- if (unit == IPL_LOGAUTH)
- fprev = &ipauth;
- else if (v == 4) {
- if (FR_ISACCOUNT(fp->fr_flags))
- fprev = &ipacct[in][set];
- else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0)
- fprev = &ipfilter[in][set];
- } else if (v == 6) {
- if (FR_ISACCOUNT(fp->fr_flags))
- fprev = &ipacct6[in][set];
- else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0)
- fprev = &ipfilter6[in][set];
- }
- if (fprev == NULL)
- return ESRCH;
-
- if (*group != '\0') {
- if (!fg && !(fg = fr_findgroup(group, unit, set, NULL)))
- return ESRCH;
- fprev = &fg->fg_start;
- }
-
- for (f = *fprev; (f = *fprev) != NULL; fprev = &f->fr_next)
- if (fp->fr_collect <= f->fr_collect)
- break;
- ftail = fprev;
-
- /*
- * Copy in extra data for the rule.
- */
- if (fp->fr_dsize != 0) {
- if (makecopy != 0) {
- KMALLOCS(ptr, void *, fp->fr_dsize);
- if (!ptr)
- return ENOMEM;
- error = COPYIN(uptr, ptr, fp->fr_dsize);
- } else {
- ptr = uptr;
- error = 0;
- }
- if (error != 0) {
- KFREES(ptr, fp->fr_dsize);
- return ENOMEM;
- }
- fp->fr_data = ptr;
- } else
- fp->fr_data = NULL;
-
- /*
- * Perform per-rule type sanity checks of their members.
- */
- switch (fp->fr_type & ~FR_T_BUILTIN)
- {
-#if defined(IPFILTER_BPF)
- case FR_T_BPFOPC :
- if (fp->fr_dsize == 0)
- return EINVAL;
- if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) {
- if (makecopy && fp->fr_data != NULL) {
- KFREES(fp->fr_data, fp->fr_dsize);
- }
- return EINVAL;
- }
- break;
-#endif
- case FR_T_IPF :
- if (fp->fr_dsize != sizeof(fripf_t))
- return EINVAL;
-
- /*
- * Allowing a rule with both "keep state" and "with oow" is
- * pointless because adding a state entry to the table will
- * fail with the out of window (oow) flag set.
- */
- if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW))
- return EINVAL;
-
- switch (fp->fr_satype)
- {
- case FRI_BROADCAST :
- case FRI_DYNAMIC :
- case FRI_NETWORK :
- case FRI_NETMASKED :
- case FRI_PEERADDR :
- if (fp->fr_sifpidx < 0 || fp->fr_sifpidx > 3) {
- if (makecopy && fp->fr_data != NULL) {
- KFREES(fp->fr_data, fp->fr_dsize);
- }
- return EINVAL;
- }
- break;
-#ifdef IPFILTER_LOOKUP
- case FRI_LOOKUP :
- fp->fr_srcptr = fr_resolvelookup(fp->fr_srctype,
- fp->fr_srcnum,
- &fp->fr_srcfunc);
- break;
-#endif
- default :
- break;
- }
-
- switch (fp->fr_datype)
- {
- case FRI_BROADCAST :
- case FRI_DYNAMIC :
- case FRI_NETWORK :
- case FRI_NETMASKED :
- case FRI_PEERADDR :
- if (fp->fr_difpidx < 0 || fp->fr_difpidx > 3) {
- if (makecopy && fp->fr_data != NULL) {
- KFREES(fp->fr_data, fp->fr_dsize);
- }
- return EINVAL;
- }
- break;
-#ifdef IPFILTER_LOOKUP
- case FRI_LOOKUP :
- fp->fr_dstptr = fr_resolvelookup(fp->fr_dsttype,
- fp->fr_dstnum,
- &fp->fr_dstfunc);
- break;
-#endif
- default :
-
- break;
- }
- break;
- case FR_T_NONE :
- break;
- case FR_T_CALLFUNC :
- break;
- case FR_T_COMPIPF :
- break;
- default :
- if (makecopy && fp->fr_data != NULL) {
- KFREES(fp->fr_data, fp->fr_dsize);
- }
- return EINVAL;
- }
-
- /*
- * Lookup all the interface names that are part of the rule.
- */
- frsynclist(fp, NULL);
- fp->fr_statecnt = 0;
-
- /*
- * Look for an existing matching filter rule, but don't include the
- * next or interface pointer in the comparison (fr_next, fr_ifa).
- * This elminates rules which are indentical being loaded. Checksum
- * the constant part of the filter rule to make comparisons quicker
- * (this meaning no pointers are included).
- */
- for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum;
- p < pp; p++)
- fp->fr_cksum += *p;
- pp = (u_int *)(fp->fr_caddr + fp->fr_dsize);
- for (p = (u_int *)fp->fr_data; p < pp; p++)
- fp->fr_cksum += *p;
-
- WRITE_ENTER(&ipf_mutex);
- bzero((char *)frcache, sizeof(frcache));
-
- for (; (f = *ftail) != NULL; ftail = &f->fr_next)
- if ((fp->fr_cksum == f->fr_cksum) &&
- (f->fr_dsize == fp->fr_dsize) &&
- !bcmp((char *)&f->fr_func,
- (char *)&fp->fr_func, FR_CMPSIZ) &&
- (!ptr || !f->fr_data ||
- !bcmp((char *)ptr, (char *)f->fr_data, f->fr_dsize)))
- break;
-
- /*
- * If zero'ing statistics, copy current to caller and zero.
- */
- if (req == (ioctlcmd_t)SIOCZRLST) {
- if (f == NULL)
- error = ESRCH;
- else {
- /*
- * Copy and reduce lock because of impending copyout.
- * Well we should, but if we do then the atomicity of
- * this call and the correctness of fr_hits and
- * fr_bytes cannot be guaranteed. As it is, this code
- * only resets them to 0 if they are successfully
- * copied out into user space.
- */
- bcopy((char *)f, (char *)fp, sizeof(*f));
- /* MUTEX_DOWNGRADE(&ipf_mutex); */
-
- /*
- * When we copy this rule back out, set the data
- * pointer to be what it was in user space.
- */
- fp->fr_data = uptr;
- error = fr_outobj(data, fp, IPFOBJ_FRENTRY);
-
- if (error == 0) {
- if ((f->fr_dsize != 0) && (uptr != NULL))
- error = COPYOUT(f->fr_data, uptr,
- f->fr_dsize);
- if (error == 0) {
- f->fr_hits = 0;
- f->fr_bytes = 0;
- }
- }
- }
-
- if ((ptr != NULL) && (makecopy != 0)) {
- KFREES(ptr, fp->fr_dsize);
- }
- RWLOCK_EXIT(&ipf_mutex);
- return error;
- }
-
- if (!f) {
- if (req == (ioctlcmd_t)SIOCINAFR ||
- req == (ioctlcmd_t)SIOCINIFR) {
- ftail = fprev;
- if (fp->fr_hits != 0) {
- while (--fp->fr_hits && (f = *ftail))
- ftail = &f->fr_next;
- }
- f = NULL;
- ptr = NULL;
- error = 0;
- }
- }
-
- /*
- * Request to remove a rule.
- */
- if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) {
- if (!f)
- error = ESRCH;
- else {
- /*
- * Do not allow activity from user space to interfere
- * with rules not loaded that way.
- */
- if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) {
- error = EPERM;
- goto done;
- }
-
- /*
- * Return EBUSY if the rule is being reference by
- * something else (eg state information.
- */
- if (f->fr_ref > 1) {
- error = EBUSY;
- goto done;
- }
-#ifdef IPFILTER_SCAN
- if (f->fr_isctag[0] != '\0' &&
- (f->fr_isc != (struct ipscan *)-1))
- ipsc_detachfr(f);
-#endif
- if ((fg != NULL) && (fg->fg_head != NULL))
- fg->fg_head->fr_ref--;
- if (unit == IPL_LOGAUTH) {
- error = fr_preauthcmd(req, f, ftail);
- goto done;
- }
- if (*f->fr_grhead != '\0')
- fr_delgroup(f->fr_grhead, unit, set);
- fr_fixskip(fprev, f, -1);
- *ftail = f->fr_next;
- f->fr_next = NULL;
- (void)fr_derefrule(&f);
- }
- } else {
- /*
- * Not removing, so we must be adding/inserting a rule.
- */
- if (f)
- error = EEXIST;
- else {
- if (unit == IPL_LOGAUTH) {
- error = fr_preauthcmd(req, fp, ftail);
- goto done;
- }
- if (makecopy) {
- KMALLOC(f, frentry_t *);
- } else
- f = fp;
- if (f != NULL) {
- if (fg != NULL && fg->fg_head!= NULL )
- fg->fg_head->fr_ref++;
- if (fp != f)
- bcopy((char *)fp, (char *)f,
- sizeof(*f));
- MUTEX_NUKE(&f->fr_lock);
- MUTEX_INIT(&f->fr_lock, "filter rule lock");
-#ifdef IPFILTER_SCAN
- if (f->fr_isctag[0] != '\0' &&
- ipsc_attachfr(f))
- f->fr_isc = (struct ipscan *)-1;
-#endif
- f->fr_hits = 0;
- if (makecopy != 0)
- f->fr_ref = 1;
- f->fr_next = *ftail;
- *ftail = f;
- if (req == (ioctlcmd_t)SIOCINIFR ||
- req == (ioctlcmd_t)SIOCINAFR)
- fr_fixskip(fprev, f, 1);
- f->fr_grp = NULL;
- group = f->fr_grhead;
- if (*group != '\0') {
- fg = fr_addgroup(group, f, f->fr_flags,
- unit, set);
- if (fg != NULL)
- f->fr_grp = &fg->fg_start;
- }
- } else
- error = ENOMEM;
- }
- }
-done:
- RWLOCK_EXIT(&ipf_mutex);
- if ((ptr != NULL) && (error != 0) && (makecopy != 0)) {
- KFREES(ptr, fp->fr_dsize);
- }
- return (error);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_funcinit */
-/* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */
-/* Parameters: fr(I) - pointer to filter rule */
-/* */
-/* If a rule is a call rule, then check if the function it points to needs */
-/* an init function to be called now the rule has been loaded. */
-/* ------------------------------------------------------------------------ */
-static int fr_funcinit(fr)
-frentry_t *fr;
-{
- ipfunc_resolve_t *ft;
- int err;
-
- err = ESRCH;
-
- for (ft = fr_availfuncs; ft->ipfu_addr != NULL; ft++)
- if (ft->ipfu_addr == fr->fr_func) {
- err = 0;
- if (ft->ipfu_init != NULL)
- err = (*ft->ipfu_init)(fr);
- break;
- }
- return err;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_findfunc */
-/* Returns: ipfunc_t - pointer to function if found, else NULL */
-/* Parameters: funcptr(I) - function pointer to lookup */
-/* */
-/* Look for a function in the table of known functions. */
-/* ------------------------------------------------------------------------ */
-static ipfunc_t fr_findfunc(funcptr)
-ipfunc_t funcptr;
-{
- ipfunc_resolve_t *ft;
-
- for (ft = fr_availfuncs; ft->ipfu_addr != NULL; ft++)
- if (ft->ipfu_addr == funcptr)
- return funcptr;
- return NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_resolvefunc */
-/* Returns: int - 0 == success, else error */
-/* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */
-/* */
-/* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */
-/* This will either be the function name (if the pointer is set) or the */
-/* function pointer if the name is set. When found, fill in the other one */
-/* so that the entire, complete, structure can be copied back to user space.*/
-/* ------------------------------------------------------------------------ */
-int fr_resolvefunc(data)
-void *data;
-{
- ipfunc_resolve_t res, *ft;
-
- BCOPYIN(data, &res, sizeof(res));
-
- if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') {
- for (ft = fr_availfuncs; ft->ipfu_addr != NULL; ft++)
- if (strncmp(res.ipfu_name, ft->ipfu_name,
- sizeof(res.ipfu_name)) == 0) {
- res.ipfu_addr = ft->ipfu_addr;
- res.ipfu_init = ft->ipfu_init;
- if (COPYOUT(&res, data, sizeof(res)) != 0)
- return EFAULT;
- return 0;
- }
- }
- if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') {
- for (ft = fr_availfuncs; ft->ipfu_addr != NULL; ft++)
- if (ft->ipfu_addr == res.ipfu_addr) {
- (void) strncpy(res.ipfu_name, ft->ipfu_name,
- sizeof(res.ipfu_name));
- res.ipfu_init = ft->ipfu_init;
- if (COPYOUT(&res, data, sizeof(res)) != 0)
- return EFAULT;
- return 0;
- }
- }
- return ESRCH;
-}
-
-
-#if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && !defined(__FreeBSD__)) || \
- (defined(__FreeBSD__) && (__FreeBSD_version < 490000)) || \
- (defined(__NetBSD__) && (__NetBSD_Version__ < 105000000)) || \
- (defined(__OpenBSD__) && (OpenBSD < 200006))
-/*
- * From: NetBSD
- * ppsratecheck(): packets (or events) per second limitation.
- */
-int
-ppsratecheck(lasttime, curpps, maxpps)
- struct timeval *lasttime;
- int *curpps;
- int maxpps; /* maximum pps allowed */
-{
- struct timeval tv, delta;
- int rv;
-
- GETKTIME(&tv);
-
- delta.tv_sec = tv.tv_sec - lasttime->tv_sec;
- delta.tv_usec = tv.tv_usec - lasttime->tv_usec;
- if (delta.tv_usec < 0) {
- delta.tv_sec--;
- delta.tv_usec += 1000000;
- }
-
- /*
- * check for 0,0 is so that the message will be seen at least once.
- * if more than one second have passed since the last update of
- * lasttime, reset the counter.
- *
- * we do increment *curpps even in *curpps < maxpps case, as some may
- * try to use *curpps for stat purposes as well.
- */
- if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
- delta.tv_sec >= 1) {
- *lasttime = tv;
- *curpps = 0;
- rv = 1;
- } else if (maxpps < 0)
- rv = 1;
- else if (*curpps < maxpps)
- rv = 1;
- else
- rv = 0;
- *curpps = *curpps + 1;
-
- return (rv);
-}
-#endif
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_derefrule */
-/* Returns: int - 0 == rule freed up, else rule not freed */
-/* Parameters: fr(I) - pointer to filter rule */
-/* */
-/* Decrement the reference counter to a rule by one. If it reaches zero, */
-/* free it and any associated storage space being used by it. */
-/* ------------------------------------------------------------------------ */
-int fr_derefrule(frp)
-frentry_t **frp;
-{
- frentry_t *fr;
-
- fr = *frp;
-
- MUTEX_ENTER(&fr->fr_lock);
- fr->fr_ref--;
- if (fr->fr_ref == 0) {
- MUTEX_EXIT(&fr->fr_lock);
- MUTEX_DESTROY(&fr->fr_lock);
-
-#ifdef IPFILTER_LOOKUP
- if (fr->fr_type == FR_T_IPF && fr->fr_satype == FRI_LOOKUP)
- ip_lookup_deref(fr->fr_srctype, fr->fr_srcptr);
- if (fr->fr_type == FR_T_IPF && fr->fr_datype == FRI_LOOKUP)
- ip_lookup_deref(fr->fr_dsttype, fr->fr_dstptr);
-#endif
-
- if (fr->fr_dsize) {
- KFREES(fr->fr_data, fr->fr_dsize);
- }
- if ((fr->fr_flags & FR_COPIED) != 0) {
- KFREE(fr);
- return 0;
- }
- return 1;
- } else {
- MUTEX_EXIT(&fr->fr_lock);
- }
- *frp = NULL;
- return -1;
-}
-
-
-#ifdef IPFILTER_LOOKUP
-/* ------------------------------------------------------------------------ */
-/* Function: fr_grpmapinit */
-/* Returns: int - 0 == success, else ESRCH because table entry not found*/
-/* Parameters: fr(I) - pointer to rule to find hash table for */
-/* */
-/* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */
-/* fr_ptr is later used by fr_srcgrpmap and fr_dstgrpmap. */
-/* ------------------------------------------------------------------------ */
-static int fr_grpmapinit(fr)
-frentry_t *fr;
-{
- char name[FR_GROUPLEN];
- iphtable_t *iph;
-
-#if defined(SNPRINTF) && defined(_KERNEL)
- SNPRINTF(name, sizeof(name), "%d", fr->fr_arg);
-#else
- (void) sprintf(name, "%d", fr->fr_arg);
-#endif
- iph = fr_findhtable(IPL_LOGIPF, name);
- if (iph == NULL)
- return ESRCH;
- if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT))
- return ESRCH;
- fr->fr_ptr = iph;
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_srcgrpmap */
-/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(IO) - pointer to current/new filter decision (unused) */
-/* */
-/* Look for a rule group head in a hash table, using the source address as */
-/* the key, and descend into that group and continue matching rules against */
-/* the packet. */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_srcgrpmap(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- frgroup_t *fg;
- void *rval;
-
- rval = fr_iphmfindgroup(fin->fin_fr->fr_ptr, &fin->fin_src);
- if (rval == NULL)
- return NULL;
-
- fg = rval;
- fin->fin_fr = fg->fg_start;
- (void) fr_scanlist(fin, *passp);
- return fin->fin_fr;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_dstgrpmap */
-/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(IO) - pointer to current/new filter decision (unused) */
-/* */
-/* Look for a rule group head in a hash table, using the destination */
-/* address as the key, and descend into that group and continue matching */
-/* rules against the packet. */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_dstgrpmap(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- frgroup_t *fg;
- void *rval;
-
- rval = fr_iphmfindgroup(fin->fin_fr->fr_ptr, &fin->fin_dst);
- if (rval == NULL)
- return NULL;
-
- fg = rval;
- fin->fin_fr = fg->fg_start;
- (void) fr_scanlist(fin, *passp);
- return fin->fin_fr;
-}
-#endif /* IPFILTER_LOOKUP */
-
-/*
- * Queue functions
- * ===============
- * These functions manage objects on queues for efficient timeouts. There are
- * a number of system defined queues as well as user defined timeouts. It is
- * expected that a lock is held in the domain in which the queue belongs
- * (i.e. either state or NAT) when calling any of these functions that prevents
- * fr_freetimeoutqueue() from being called at the same time as any other.
- */
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_addtimeoutqueue */
-/* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */
-/* timeout queue with given interval. */
-/* Parameters: parent(I) - pointer to pointer to parent node of this list */
-/* of interface queues. */
-/* seconds(I) - timeout value in seconds for this queue. */
-/* */
-/* This routine first looks for a timeout queue that matches the interval */
-/* being requested. If it finds one, increments the reference counter and */
-/* returns a pointer to it. If none are found, it allocates a new one and */
-/* inserts it at the top of the list. */
-/* */
-/* Locking. */
-/* It is assumed that the caller of this function has an appropriate lock */
-/* held (exclusively) in the domain that encompases 'parent'. */
-/* ------------------------------------------------------------------------ */
-ipftq_t *fr_addtimeoutqueue(parent, seconds)
-ipftq_t **parent;
-u_int seconds;
-{
- ipftq_t *ifq;
- u_int period;
-
- period = seconds * IPF_HZ_DIVIDE;
-
- MUTEX_ENTER(&ipf_timeoutlock);
- for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) {
- if (ifq->ifq_ttl == period) {
- /*
- * Reset the delete flag, if set, so the structure
- * gets reused rather than freed and reallocated.
- */
- MUTEX_ENTER(&ifq->ifq_lock);
- ifq->ifq_flags &= ~IFQF_DELETE;
- ifq->ifq_ref++;
- MUTEX_EXIT(&ifq->ifq_lock);
- MUTEX_EXIT(&ipf_timeoutlock);
-
- return ifq;
- }
- }
-
- KMALLOC(ifq, ipftq_t *);
- if (ifq != NULL) {
- ifq->ifq_ttl = period;
- ifq->ifq_head = NULL;
- ifq->ifq_tail = &ifq->ifq_head;
- ifq->ifq_next = *parent;
- ifq->ifq_pnext = parent;
- ifq->ifq_ref = 1;
- ifq->ifq_flags = IFQF_USER;
- *parent = ifq;
- fr_userifqs++;
- MUTEX_NUKE(&ifq->ifq_lock);
- MUTEX_INIT(&ifq->ifq_lock, "ipftq mutex");
- }
- MUTEX_EXIT(&ipf_timeoutlock);
- return ifq;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_deletetimeoutqueue */
-/* Returns: int - new reference count value of the timeout queue */
-/* Parameters: ifq(I) - timeout queue which is losing a reference. */
-/* Locks: ifq->ifq_lock */
-/* */
-/* This routine must be called when we're discarding a pointer to a timeout */
-/* queue object, taking care of the reference counter. */
-/* */
-/* Now that this just sets a DELETE flag, it requires the expire code to */
-/* check the list of user defined timeout queues and call the free function */
-/* below (currently commented out) to stop memory leaking. It is done this */
-/* way because the locking may not be sufficient to safely do a free when */
-/* this function is called. */
-/* ------------------------------------------------------------------------ */
-int fr_deletetimeoutqueue(ifq)
-ipftq_t *ifq;
-{
-
- ifq->ifq_ref--;
- if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) {
- ifq->ifq_flags |= IFQF_DELETE;
- }
-
- return ifq->ifq_ref;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_freetimeoutqueue */
-/* Parameters: ifq(I) - timeout queue which is losing a reference. */
-/* Returns: Nil */
-/* */
-/* Locking: */
-/* It is assumed that the caller of this function has an appropriate lock */
-/* held (exclusively) in the domain that encompases the callers "domain". */
-/* The ifq_lock for this structure should not be held. */
-/* */
-/* Remove a user definde timeout queue from the list of queues it is in and */
-/* tidy up after this is done. */
-/* ------------------------------------------------------------------------ */
-void fr_freetimeoutqueue(ifq)
-ipftq_t *ifq;
-{
-
-
- if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) ||
- ((ifq->ifq_flags & IFQF_USER) == 0)) {
- printf("fr_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n",
- (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl,
- ifq->ifq_ref);
- return;
- }
-
- /*
- * Remove from its position in the list.
- */
- *ifq->ifq_pnext = ifq->ifq_next;
- if (ifq->ifq_next != NULL)
- ifq->ifq_next->ifq_pnext = ifq->ifq_pnext;
-
- MUTEX_DESTROY(&ifq->ifq_lock);
- fr_userifqs--;
- KFREE(ifq);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_deletequeueentry */
-/* Returns: Nil */
-/* Parameters: tqe(I) - timeout queue entry to delete */
-/* ifq(I) - timeout queue to remove entry from */
-/* */
-/* Remove a tail queue entry from its queue and make it an orphan. */
-/* fr_deletetimeoutqueue is called to make sure the reference count on the */
-/* queue is correct. We can't, however, call fr_freetimeoutqueue because */
-/* the correct lock(s) may not be held that would make it safe to do so. */
-/* ------------------------------------------------------------------------ */
-void fr_deletequeueentry(tqe)
-ipftqent_t *tqe;
-{
- ipftq_t *ifq;
-
- ifq = tqe->tqe_ifq;
- if (ifq == NULL)
- return;
-
- MUTEX_ENTER(&ifq->ifq_lock);
-
- if (tqe->tqe_pnext != NULL) {
- *tqe->tqe_pnext = tqe->tqe_next;
- if (tqe->tqe_next != NULL)
- tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
- else /* we must be the tail anyway */
- ifq->ifq_tail = tqe->tqe_pnext;
-
- tqe->tqe_pnext = NULL;
- tqe->tqe_ifq = NULL;
- }
-
- (void) fr_deletetimeoutqueue(ifq);
-
- MUTEX_EXIT(&ifq->ifq_lock);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_queuefront */
-/* Returns: Nil */
-/* Parameters: tqe(I) - pointer to timeout queue entry */
-/* */
-/* Move a queue entry to the front of the queue, if it isn't already there. */
-/* ------------------------------------------------------------------------ */
-void fr_queuefront(tqe)
-ipftqent_t *tqe;
-{
- ipftq_t *ifq;
-
- ifq = tqe->tqe_ifq;
- if (ifq == NULL)
- return;
-
- MUTEX_ENTER(&ifq->ifq_lock);
- if (ifq->ifq_head != tqe) {
- *tqe->tqe_pnext = tqe->tqe_next;
- if (tqe->tqe_next)
- tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
- else
- ifq->ifq_tail = tqe->tqe_pnext;
-
- tqe->tqe_next = ifq->ifq_head;
- ifq->ifq_head->tqe_pnext = &tqe->tqe_next;
- ifq->ifq_head = tqe;
- tqe->tqe_pnext = &ifq->ifq_head;
- }
- MUTEX_EXIT(&ifq->ifq_lock);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_queueback */
-/* Returns: Nil */
-/* Parameters: tqe(I) - pointer to timeout queue entry */
-/* */
-/* Move a queue entry to the back of the queue, if it isn't already there. */
-/* ------------------------------------------------------------------------ */
-void fr_queueback(tqe)
-ipftqent_t *tqe;
-{
- ipftq_t *ifq;
-
- ifq = tqe->tqe_ifq;
- if (ifq == NULL)
- return;
- tqe->tqe_die = fr_ticks + ifq->ifq_ttl;
-
- MUTEX_ENTER(&ifq->ifq_lock);
- if (tqe->tqe_next == NULL) { /* at the end already ? */
- MUTEX_EXIT(&ifq->ifq_lock);
- return;
- }
-
- /*
- * Remove from list
- */
- *tqe->tqe_pnext = tqe->tqe_next;
- tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
-
- /*
- * Make it the last entry.
- */
- tqe->tqe_next = NULL;
- tqe->tqe_pnext = ifq->ifq_tail;
- *ifq->ifq_tail = tqe;
- ifq->ifq_tail = &tqe->tqe_next;
- MUTEX_EXIT(&ifq->ifq_lock);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_queueappend */
-/* Returns: Nil */
-/* Parameters: tqe(I) - pointer to timeout queue entry */
-/* ifq(I) - pointer to timeout queue */
-/* parent(I) - owing object pointer */
-/* */
-/* Add a new item to this queue and put it on the very end. */
-/* ------------------------------------------------------------------------ */
-void fr_queueappend(tqe, ifq, parent)
-ipftqent_t *tqe;
-ipftq_t *ifq;
-void *parent;
-{
-
- MUTEX_ENTER(&ifq->ifq_lock);
- tqe->tqe_parent = parent;
- tqe->tqe_pnext = ifq->ifq_tail;
- *ifq->ifq_tail = tqe;
- ifq->ifq_tail = &tqe->tqe_next;
- tqe->tqe_next = NULL;
- tqe->tqe_ifq = ifq;
- tqe->tqe_die = fr_ticks + ifq->ifq_ttl;
- ifq->ifq_ref++;
- MUTEX_EXIT(&ifq->ifq_lock);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_movequeue */
-/* Returns: Nil */
-/* Parameters: tq(I) - pointer to timeout queue information */
-/* oifp(I) - old timeout queue entry was on */
-/* nifp(I) - new timeout queue to put entry on */
-/* */
-/* Move a queue entry from one timeout queue to another timeout queue. */
-/* If it notices that the current entry is already last and does not need */
-/* to move queue, the return. */
-/* ------------------------------------------------------------------------ */
-void fr_movequeue(tqe, oifq, nifq)
-ipftqent_t *tqe;
-ipftq_t *oifq, *nifq;
-{
- /*
- * Is the operation here going to be a no-op ?
- */
- MUTEX_ENTER(&oifq->ifq_lock);
- if (oifq == nifq && *oifq->ifq_tail == tqe) {
- MUTEX_EXIT(&oifq->ifq_lock);
- return;
- }
-
- /*
- * Remove from the old queue
- */
- *tqe->tqe_pnext = tqe->tqe_next;
- if (tqe->tqe_next)
- tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
- else
- oifq->ifq_tail = tqe->tqe_pnext;
- tqe->tqe_next = NULL;
-
- /*
- * If we're moving from one queue to another, release the lock on the
- * old queue and get a lock on the new queue. For user defined queues,
- * if we're moving off it, call delete in case it can now be freed.
- */
- if (oifq != nifq) {
- tqe->tqe_ifq = NULL;
-
- (void) fr_deletetimeoutqueue(oifq);
-
- MUTEX_EXIT(&oifq->ifq_lock);
-
- MUTEX_ENTER(&nifq->ifq_lock);
-
- tqe->tqe_ifq = nifq;
- nifq->ifq_ref++;
- }
-
- /*
- * Add to the bottom of the new queue
- */
- tqe->tqe_die = fr_ticks + nifq->ifq_ttl;
- tqe->tqe_pnext = nifq->ifq_tail;
- *nifq->ifq_tail = tqe;
- nifq->ifq_tail = &tqe->tqe_next;
- MUTEX_EXIT(&nifq->ifq_lock);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_updateipid */
-/* Returns: int - 0 == success, -1 == error (packet should be droppped) */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* When we are doing NAT, change the IP of every packet to represent a */
-/* single sequence of packets coming from the host, hiding any host */
-/* specific sequencing that might otherwise be revealed. If the packet is */
-/* a fragment, then store the 'new' IPid in the fragment cache and look up */
-/* the fragment cache for non-leading fragments. If a non-leading fragment */
-/* has no match in the cache, return an error. */
-/* ------------------------------------------------------------------------ */
-static INLINE int fr_updateipid(fin)
-fr_info_t *fin;
-{
- u_short id, ido, sums;
- u_32_t sumd, sum;
- ip_t *ip;
-
- if (fin->fin_off != 0) {
- sum = fr_ipid_knownfrag(fin);
- if (sum == 0xffffffff)
- return -1;
- sum &= 0xffff;
- id = (u_short)sum;
- } else {
- id = fr_nextipid(fin);
- if (fin->fin_off == 0 && (fin->fin_flx & FI_FRAG) != 0)
- (void) fr_ipid_newfrag(fin, (u_32_t)id);
- }
-
- ip = fin->fin_ip;
- ido = ntohs(ip->ip_id);
- if (id == ido)
- return 0;
- ip->ip_id = htons(id);
- CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */
- sum = (~ntohs(ip->ip_sum)) & 0xffff;
- sum += sumd;
- sum = (sum >> 16) + (sum & 0xffff);
- sum = (sum >> 16) + (sum & 0xffff);
- sums = ~(u_short)sum;
- ip->ip_sum = htons(sums);
- return 0;
-}
-
-
-#ifdef NEED_FRGETIFNAME
-/* ------------------------------------------------------------------------ */
-/* Function: fr_getifname */
-/* Returns: char * - pointer to interface name */
-/* Parameters: ifp(I) - pointer to network interface */
-/* buffer(O) - pointer to where to store interface name */
-/* */
-/* Constructs an interface name in the buffer passed. The buffer passed is */
-/* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */
-/* as a NULL pointer then return a pointer to a static array. */
-/* ------------------------------------------------------------------------ */
-char *fr_getifname(ifp, buffer)
-struct ifnet *ifp;
-char *buffer;
-{
- static char namebuf[LIFNAMSIZ];
-# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \
- defined(__sgi) || defined(linux) || \
- (defined(sun) && !defined(__SVR4) && !defined(__svr4__))
- int unit, space;
- char temp[20];
- char *s;
-# endif
-
- if (buffer == NULL)
- buffer = namebuf;
- (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ);
- buffer[LIFNAMSIZ - 1] = '\0';
-# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \
- defined(__sgi) || \
- (defined(sun) && !defined(__SVR4) && !defined(__svr4__))
- for (s = buffer; *s; s++)
- ;
- unit = ifp->if_unit;
- space = LIFNAMSIZ - (s - buffer);
- if (space > 0) {
-# if defined(SNPRINTF) && defined(_KERNEL)
- SNPRINTF(temp, sizeof(temp), "%d", unit);
-# else
- (void) sprintf(temp, "%d", unit);
-# endif
- (void) strncpy(s, temp, space);
- }
-# endif
- return buffer;
-}
-#endif
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ioctlswitch */
-/* Returns: int - -1 continue processing, else ioctl return value */
-/* Parameters: unit(I) - device unit opened */
-/* data(I) - pointer to ioctl data */
-/* cmd(I) - ioctl command */
-/* mode(I) - mode value */
-/* */
-/* Based on the value of unit, call the appropriate ioctl handler or return */
-/* EIO if ipfilter is not running. Also checks if write perms are req'd */
-/* for the device in order to execute the ioctl. */
-/* ------------------------------------------------------------------------ */
-int fr_ioctlswitch(unit, data, cmd, mode)
-int unit, mode;
-ioctlcmd_t cmd;
-void *data;
-{
- int error = 0;
-
- switch (unit)
- {
- case IPL_LOGIPF :
- error = -1;
- break;
- case IPL_LOGNAT :
- if (fr_running > 0)
- error = fr_nat_ioctl(data, cmd, mode);
- else
- error = EIO;
- break;
- case IPL_LOGSTATE :
- if (fr_running > 0)
- error = fr_state_ioctl(data, cmd, mode);
- else
- error = EIO;
- break;
- case IPL_LOGAUTH :
- if (fr_running > 0) {
- if ((cmd == (ioctlcmd_t)SIOCADAFR) ||
- (cmd == (ioctlcmd_t)SIOCRMAFR)) {
- if (!(mode & FWRITE)) {
- error = EPERM;
- } else {
- error = frrequest(unit, cmd, data,
- fr_active, 1);
- }
- } else {
- error = fr_auth_ioctl(data, cmd, mode);
- }
- } else
- error = EIO;
- break;
- case IPL_LOGSYNC :
-#ifdef IPFILTER_SYNC
- if (fr_running > 0)
- error = fr_sync_ioctl(data, cmd, mode);
- else
-#endif
- error = EIO;
- break;
- case IPL_LOGSCAN :
-#ifdef IPFILTER_SCAN
- if (fr_running > 0)
- error = fr_scan_ioctl(data, cmd, mode);
- else
-#endif
- error = EIO;
- break;
- case IPL_LOGLOOKUP :
-#ifdef IPFILTER_LOOKUP
- if (fr_running > 0)
- error = ip_lookup_ioctl(data, cmd, mode);
- else
-#endif
- error = EIO;
- break;
- default :
- error = EIO;
- break;
- }
-
- return error;
-}
-
-
-/*
- * This array defines the expected size of objects coming into the kernel
- * for the various recognised object types.
- */
-#define NUM_OBJ_TYPES 14
-
-static int fr_objbytes[NUM_OBJ_TYPES][2] = {
- { 1, sizeof(struct frentry) }, /* frentry */
- { 0, sizeof(struct friostat) },
- { 0, sizeof(struct fr_info) },
- { 0, sizeof(struct fr_authstat) },
- { 0, sizeof(struct ipfrstat) },
- { 0, sizeof(struct ipnat) },
- { 0, sizeof(struct natstat) },
- { 0, sizeof(struct ipstate_save) },
- { 1, sizeof(struct nat_save) }, /* nat_save */
- { 0, sizeof(struct natlookup) },
- { 1, sizeof(struct ipstate) }, /* ipstate */
- { 0, sizeof(struct ips_stat) },
- { 0, sizeof(struct frauth) },
- { 0, sizeof(struct ipftune) }
-};
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_inobj */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: data(I) - pointer to ioctl data */
-/* ptr(I) - pointer to store real data in */
-/* type(I) - type of structure being moved */
-/* */
-/* Copy in the contents of what the ipfobj_t points to. In future, we */
-/* add things to check for version numbers, sizes, etc, to make it backward */
-/* compatible at the ABI for user land. */
-/* ------------------------------------------------------------------------ */
-int fr_inobj(data, ptr, type)
-void *data;
-void *ptr;
-int type;
-{
- ipfobj_t obj;
- int error = 0;
-
- if ((type < 0) || (type > NUM_OBJ_TYPES-1))
- return EINVAL;
-
- BCOPYIN((caddr_t)data, (caddr_t)&obj, sizeof(obj));
-
- if (obj.ipfo_type != type)
- return EINVAL;
-
-#ifndef IPFILTER_COMPAT
- if ((fr_objbytes[type][0] & 1) != 0) {
- if (obj.ipfo_size < fr_objbytes[type][1])
- return EINVAL;
- } else if (obj.ipfo_size != fr_objbytes[type][1])
- return EINVAL;
-#else
- if (obj.ipfo_rev != IPFILTER_VERSION)
- /* XXX compatibility hook here */
- ;
- if ((fr_objbytes[type][0] & 1) != 0) {
- if (obj.ipfo_size < fr_objbytes[type][1])
- /* XXX compatibility hook here */
- return EINVAL;
- } else if (obj.ipfo_size != fr_objbytes[type][1])
- /* XXX compatibility hook here */
- return EINVAL;
-#endif
-
- if ((fr_objbytes[type][0] & 1) != 0) {
- error = COPYIN((caddr_t)obj.ipfo_ptr, (caddr_t)ptr,
- fr_objbytes[type][1]);
- } else {
- error = COPYIN((caddr_t)obj.ipfo_ptr, (caddr_t)ptr,
- obj.ipfo_size);
- }
- return error;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_inobjsz */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: data(I) - pointer to ioctl data */
-/* ptr(I) - pointer to store real data in */
-/* type(I) - type of structure being moved */
-/* sz(I) - size of data to copy */
-/* */
-/* As per fr_inobj, except the size of the object to copy in is passed in */
-/* but it must not be smaller than the size defined for the type and the */
-/* type must allow for varied sized objects. The extra requirement here is */
-/* that sz must match the size of the object being passed in - this is not */
-/* not possible nor required in fr_inobj(). */
-/* ------------------------------------------------------------------------ */
-int fr_inobjsz(data, ptr, type, sz)
-void *data;
-void *ptr;
-int type, sz;
-{
- ipfobj_t obj;
- int error;
-
- if ((type < 0) || (type > NUM_OBJ_TYPES-1))
- return EINVAL;
- if (((fr_objbytes[type][0] & 1) == 0) || (sz < fr_objbytes[type][1]))
- return EINVAL;
-
- BCOPYIN((caddr_t)data, (caddr_t)&obj, sizeof(obj));
-
- if (obj.ipfo_type != type)
- return EINVAL;
-
-#ifndef IPFILTER_COMPAT
- if (obj.ipfo_size != sz)
- return EINVAL;
-#else
- if (obj.ipfo_rev != IPFILTER_VERSION)
- /* XXX compatibility hook here */
- ;
- if (obj.ipfo_size != sz)
- /* XXX compatibility hook here */
- return EINVAL;
-#endif
-
- error = COPYIN((caddr_t)obj.ipfo_ptr, (caddr_t)ptr, sz);
- return error;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_outobjsz */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: data(I) - pointer to ioctl data */
-/* ptr(I) - pointer to store real data in */
-/* type(I) - type of structure being moved */
-/* sz(I) - size of data to copy */
-/* */
-/* As per fr_outobj, except the size of the object to copy out is passed in */
-/* but it must not be smaller than the size defined for the type and the */
-/* type must allow for varied sized objects. The extra requirement here is */
-/* that sz must match the size of the object being passed in - this is not */
-/* not possible nor required in fr_outobj(). */
-/* ------------------------------------------------------------------------ */
-int fr_outobjsz(data, ptr, type, sz)
-void *data;
-void *ptr;
-int type, sz;
-{
- ipfobj_t obj;
- int error;
-
- if ((type < 0) || (type > NUM_OBJ_TYPES-1) ||
- ((fr_objbytes[type][0] & 1) == 0) ||
- (sz < fr_objbytes[type][1]))
- return EINVAL;
-
- BCOPYIN((caddr_t)data, (caddr_t)&obj, sizeof(obj));
-
- if (obj.ipfo_type != type)
- return EINVAL;
-
-#ifndef IPFILTER_COMPAT
- if (obj.ipfo_size != sz)
- return EINVAL;
-#else
- if (obj.ipfo_rev != IPFILTER_VERSION)
- /* XXX compatibility hook here */
- ;
- if (obj.ipfo_size != sz)
- /* XXX compatibility hook here */
- return EINVAL;
-#endif
-
- error = COPYOUT((caddr_t)ptr, (caddr_t)obj.ipfo_ptr, sz);
- return error;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_outobj */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: data(I) - pointer to ioctl data */
-/* ptr(I) - pointer to store real data in */
-/* type(I) - type of structure being moved */
-/* */
-/* Copy out the contents of what ptr is to where ipfobj points to. In */
-/* future, we add things to check for version numbers, sizes, etc, to make */
-/* it backward compatible at the ABI for user land. */
-/* ------------------------------------------------------------------------ */
-int fr_outobj(data, ptr, type)
-void *data;
-void *ptr;
-int type;
-{
- ipfobj_t obj;
- int error;
-
- if ((type < 0) || (type > NUM_OBJ_TYPES-1))
- return EINVAL;
-
- BCOPYIN((caddr_t)data, (caddr_t)&obj, sizeof(obj));
-
- if (obj.ipfo_type != type)
- return EINVAL;
-
-#ifndef IPFILTER_COMPAT
- if ((fr_objbytes[type][0] & 1) != 0) {
- if (obj.ipfo_size < fr_objbytes[type][1])
- return EINVAL;
- } else if (obj.ipfo_size != fr_objbytes[type][1])
- return EINVAL;
-#else
- if (obj.ipfo_rev != IPFILTER_VERSION)
- /* XXX compatibility hook here */
- ;
- if ((fr_objbytes[type][0] & 1) != 0) {
- if (obj.ipfo_size < fr_objbytes[type][1])
- /* XXX compatibility hook here */
- return EINVAL;
- } else if (obj.ipfo_size != fr_objbytes[type][1])
- /* XXX compatibility hook here */
- return EINVAL;
-#endif
-
- error = COPYOUT((caddr_t)ptr, (caddr_t)obj.ipfo_ptr, obj.ipfo_size);
- return error;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_checkl4sum */
-/* Returns: int - 0 = good, -1 = bad, 1 = cannot check */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* If possible, calculate the layer 4 checksum for the packet. If this is */
-/* not possible, return without indicating a failure or success but in a */
-/* way that is ditinguishable. */
-/* ------------------------------------------------------------------------ */
-int fr_checkl4sum(fin)
-fr_info_t *fin;
-{
- u_short sum, hdrsum, *csump;
- udphdr_t *udp;
- int dosum;
-
- if ((fin->fin_flx & FI_NOCKSUM) != 0)
- return 0;
-
- /*
- * If the TCP packet isn't a fragment, isn't too short and otherwise
- * isn't already considered "bad", then validate the checksum. If
- * this check fails then considered the packet to be "bad".
- */
- if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0)
- return 1;
-
- csump = NULL;
- hdrsum = 0;
- dosum = 0;
- sum = 0;
-
-#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID)
- if (dohwcksum && ((*fin->fin_mp)->b_ick_flag == ICK_VALID)) {
- hdrsum = 0;
- sum = 0;
- } else {
-#endif
- switch (fin->fin_p)
- {
- case IPPROTO_TCP :
- csump = &((tcphdr_t *)fin->fin_dp)->th_sum;
- dosum = 1;
- break;
-
- case IPPROTO_UDP :
- udp = fin->fin_dp;
- if (udp->uh_sum != 0) {
- csump = &udp->uh_sum;
- dosum = 1;
- }
- break;
-
- case IPPROTO_ICMP :
- csump = &((struct icmp *)fin->fin_dp)->icmp_cksum;
- dosum = 1;
- break;
-
- default :
- return 1;
- /*NOTREACHED*/
- }
-
- if (csump != NULL)
- hdrsum = *csump;
-
- if (dosum)
- sum = fr_cksum(fin->fin_m, fin->fin_ip,
- fin->fin_p, fin->fin_dp);
-#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID)
- }
-#endif
-#if !defined(_KERNEL)
- if (sum == hdrsum) {
- FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum));
- } else {
- FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum));
- }
-#endif
- if (hdrsum == sum)
- return 0;
- return -1;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ifpfillv4addr */
-/* Returns: int - 0 = address update, -1 = address not updated */
-/* Parameters: atype(I) - type of network address update to perform */
-/* sin(I) - pointer to source of address information */
-/* mask(I) - pointer to source of netmask information */
-/* inp(I) - pointer to destination address store */
-/* inpmask(I) - pointer to destination netmask store */
-/* */
-/* Given a type of network address update (atype) to perform, copy */
-/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */
-/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */
-/* which case the operation fails. For all values of atype other than */
-/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */
-/* value. */
-/* ------------------------------------------------------------------------ */
-int fr_ifpfillv4addr(atype, sin, mask, inp, inpmask)
-int atype;
-struct sockaddr_in *sin, *mask;
-struct in_addr *inp, *inpmask;
-{
- if (inpmask != NULL && atype != FRI_NETMASKED)
- inpmask->s_addr = 0xffffffff;
-
- if (atype == FRI_NETWORK || atype == FRI_NETMASKED) {
- if (atype == FRI_NETMASKED) {
- if (inpmask == NULL)
- return -1;
- inpmask->s_addr = mask->sin_addr.s_addr;
- }
- inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr;
- } else {
- inp->s_addr = sin->sin_addr.s_addr;
- }
- return 0;
-}
-
-
-#ifdef USE_INET6
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ifpfillv6addr */
-/* Returns: int - 0 = address update, -1 = address not updated */
-/* Parameters: atype(I) - type of network address update to perform */
-/* sin(I) - pointer to source of address information */
-/* mask(I) - pointer to source of netmask information */
-/* inp(I) - pointer to destination address store */
-/* inpmask(I) - pointer to destination netmask store */
-/* */
-/* Given a type of network address update (atype) to perform, copy */
-/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */
-/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */
-/* which case the operation fails. For all values of atype other than */
-/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */
-/* value. */
-/* ------------------------------------------------------------------------ */
-int fr_ifpfillv6addr(atype, sin, mask, inp, inpmask)
-int atype;
-struct sockaddr_in6 *sin, *mask;
-struct in_addr *inp, *inpmask;
-{
- i6addr_t *src, *dst, *and, *dmask;
-
- src = (i6addr_t *)&sin->sin6_addr;
- and = (i6addr_t *)&mask->sin6_addr;
- dst = (i6addr_t *)inp;
- dmask = (i6addr_t *)inpmask;
-
- if (inpmask != NULL && atype != FRI_NETMASKED) {
- dmask->i6[0] = 0xffffffff;
- dmask->i6[1] = 0xffffffff;
- dmask->i6[2] = 0xffffffff;
- dmask->i6[3] = 0xffffffff;
- }
-
- if (atype == FRI_NETWORK || atype == FRI_NETMASKED) {
- if (atype == FRI_NETMASKED) {
- if (inpmask == NULL)
- return -1;
- dmask->i6[0] = and->i6[0];
- dmask->i6[1] = and->i6[1];
- dmask->i6[2] = and->i6[2];
- dmask->i6[3] = and->i6[3];
- }
-
- dst->i6[0] = src->i6[0] & and->i6[0];
- dst->i6[1] = src->i6[1] & and->i6[1];
- dst->i6[2] = src->i6[2] & and->i6[2];
- dst->i6[3] = src->i6[3] & and->i6[3];
- } else {
- dst->i6[0] = src->i6[0];
- dst->i6[1] = src->i6[1];
- dst->i6[2] = src->i6[2];
- dst->i6[3] = src->i6[3];
- }
- return 0;
-}
-#endif
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_matchtag */
-/* Returns: 0 == mismatch, 1 == match. */
-/* Parameters: tag1(I) - pointer to first tag to compare */
-/* tag2(I) - pointer to second tag to compare */
-/* */
-/* Returns true (non-zero) or false(0) if the two tag structures can be */
-/* considered to be a match or not match, respectively. The tag is 16 */
-/* bytes long (16 characters) but that is overlayed with 4 32bit ints so */
-/* compare the ints instead, for speed. tag1 is the master of the */
-/* comparison. This function should only be called with both tag1 and tag2 */
-/* as non-NULL pointers. */
-/* ------------------------------------------------------------------------ */
-int fr_matchtag(tag1, tag2)
-ipftag_t *tag1, *tag2;
-{
- if (tag1 == tag2)
- return 1;
-
- if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0))
- return 1;
-
- if ((tag1->ipt_num[0] == tag2->ipt_num[0]) &&
- (tag1->ipt_num[1] == tag2->ipt_num[1]) &&
- (tag1->ipt_num[2] == tag2->ipt_num[2]) &&
- (tag1->ipt_num[3] == tag2->ipt_num[3]))
- return 1;
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_coalesce */
-/* Returns: 1 == success, -1 == failure, 0 == no change */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Attempt to get all of the packet data into a single, contiguous buffer. */
-/* If this call returns a failure then the buffers have also been freed. */
-/* ------------------------------------------------------------------------ */
-int fr_coalesce(fin)
-fr_info_t *fin;
-{
- if ((fin->fin_flx & FI_COALESCE) != 0)
- return 1;
-
- /*
- * If the mbuf pointers indicate that there is no mbuf to work with,
- * return but do not indicate success or failure.
- */
- if (fin->fin_m == NULL || fin->fin_mp == NULL)
- return 0;
-
-#if defined(_KERNEL)
- if (fr_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) {
- ATOMIC_INCL(fr_badcoalesces[fin->fin_out]);
-# ifdef MENTAT
- FREE_MB_T(*fin->fin_mp);
-# endif
- *fin->fin_mp = NULL;
- fin->fin_m = NULL;
- return -1;
- }
-#else
- fin = fin; /* LINT */
-#endif
- return 1;
-}
-
-
-/*
- * The following table lists all of the tunable variables that can be
- * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row
- * in the table below is as follows:
- *
- * pointer to value, name of value, minimum, maximum, size of the value's
- * container, value attribute flags
- *
- * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED
- * means the value can only be written to when IPFilter is loaded but disabled.
- * The obvious implication is if neither of these are set then the value can be
- * changed at any time without harm.
- */
-ipftuneable_t ipf_tuneables[] = {
- /* filtering */
- { { &fr_flags }, "fr_flags", 0, 0xffffffff,
- sizeof(fr_flags), 0 },
- { { &fr_active }, "fr_active", 0, 0,
- sizeof(fr_active), IPFT_RDONLY },
- { { &fr_control_forwarding }, "fr_control_forwarding", 0, 1,
- sizeof(fr_control_forwarding), 0 },
- { { &fr_update_ipid }, "fr_update_ipid", 0, 1,
- sizeof(fr_update_ipid), 0 },
- { { &fr_chksrc }, "fr_chksrc", 0, 1,
- sizeof(fr_chksrc), 0 },
- { { &fr_pass }, "fr_pass", 0, 0xffffffff,
- sizeof(fr_pass), 0 },
- /* state */
- { { &fr_tcpidletimeout }, "fr_tcpidletimeout", 1, 0x7fffffff,
- sizeof(fr_tcpidletimeout), IPFT_WRDISABLED },
- { { &fr_tcpclosewait }, "fr_tcpclosewait", 1, 0x7fffffff,
- sizeof(fr_tcpclosewait), IPFT_WRDISABLED },
- { { &fr_tcplastack }, "fr_tcplastack", 1, 0x7fffffff,
- sizeof(fr_tcplastack), IPFT_WRDISABLED },
- { { &fr_tcptimeout }, "fr_tcptimeout", 1, 0x7fffffff,
- sizeof(fr_tcptimeout), IPFT_WRDISABLED },
- { { &fr_tcpclosed }, "fr_tcpclosed", 1, 0x7fffffff,
- sizeof(fr_tcpclosed), IPFT_WRDISABLED },
- { { &fr_tcphalfclosed }, "fr_tcphalfclosed", 1, 0x7fffffff,
- sizeof(fr_tcphalfclosed), IPFT_WRDISABLED },
- { { &fr_udptimeout }, "fr_udptimeout", 1, 0x7fffffff,
- sizeof(fr_udptimeout), IPFT_WRDISABLED },
- { { &fr_udpacktimeout }, "fr_udpacktimeout", 1, 0x7fffffff,
- sizeof(fr_udpacktimeout), IPFT_WRDISABLED },
- { { &fr_icmptimeout }, "fr_icmptimeout", 1, 0x7fffffff,
- sizeof(fr_icmptimeout), IPFT_WRDISABLED },
- { { &fr_icmpacktimeout }, "fr_icmpacktimeout", 1, 0x7fffffff,
- sizeof(fr_icmpacktimeout), IPFT_WRDISABLED },
- { { &fr_iptimeout }, "fr_iptimeout", 1, 0x7fffffff,
- sizeof(fr_iptimeout), IPFT_WRDISABLED },
- { { &fr_statemax }, "fr_statemax", 1, 0x7fffffff,
- sizeof(fr_statemax), 0 },
- { { &fr_statesize }, "fr_statesize", 1, 0x7fffffff,
- sizeof(fr_statesize), IPFT_WRDISABLED },
- { { &fr_state_lock }, "fr_state_lock", 0, 1,
- sizeof(fr_state_lock), IPFT_RDONLY },
- { { &fr_state_maxbucket }, "fr_state_maxbucket", 1, 0x7fffffff,
- sizeof(fr_state_maxbucket), IPFT_WRDISABLED },
- { { &fr_state_maxbucket_reset }, "fr_state_maxbucket_reset", 0, 1,
- sizeof(fr_state_maxbucket_reset), IPFT_WRDISABLED },
- { { &ipstate_logging }, "ipstate_logging", 0, 1,
- sizeof(ipstate_logging), 0 },
- /* nat */
- { { &fr_nat_lock }, "fr_nat_lock", 0, 1,
- sizeof(fr_nat_lock), IPFT_RDONLY },
- { { &ipf_nattable_sz }, "ipf_nattable_sz", 1, 0x7fffffff,
- sizeof(ipf_nattable_sz), IPFT_WRDISABLED },
- { { &ipf_nattable_max }, "ipf_nattable_max", 1, 0x7fffffff,
- sizeof(ipf_nattable_max), 0 },
- { { &ipf_natrules_sz }, "ipf_natrules_sz", 1, 0x7fffffff,
- sizeof(ipf_natrules_sz), IPFT_WRDISABLED },
- { { &ipf_rdrrules_sz }, "ipf_rdrrules_sz", 1, 0x7fffffff,
- sizeof(ipf_rdrrules_sz), IPFT_WRDISABLED },
- { { &ipf_hostmap_sz }, "ipf_hostmap_sz", 1, 0x7fffffff,
- sizeof(ipf_hostmap_sz), IPFT_WRDISABLED },
- { { &fr_nat_maxbucket }, "fr_nat_maxbucket", 1, 0x7fffffff,
- sizeof(fr_nat_maxbucket), IPFT_WRDISABLED },
- { { &fr_nat_maxbucket_reset }, "fr_nat_maxbucket_reset", 0, 1,
- sizeof(fr_nat_maxbucket_reset), IPFT_WRDISABLED },
- { { &nat_logging }, "nat_logging", 0, 1,
- sizeof(nat_logging), 0 },
- { { &fr_defnatage }, "fr_defnatage", 1, 0x7fffffff,
- sizeof(fr_defnatage), IPFT_WRDISABLED },
- { { &fr_defnatipage }, "fr_defnatipage", 1, 0x7fffffff,
- sizeof(fr_defnatipage), IPFT_WRDISABLED },
- { { &fr_defnaticmpage }, "fr_defnaticmpage", 1, 0x7fffffff,
- sizeof(fr_defnaticmpage), IPFT_WRDISABLED },
- /* frag */
- { { &ipfr_size }, "ipfr_size", 1, 0x7fffffff,
- sizeof(ipfr_size), IPFT_WRDISABLED },
- { { &fr_ipfrttl }, "fr_ipfrttl", 1, 0x7fffffff,
- sizeof(fr_ipfrttl), IPFT_WRDISABLED },
-#ifdef IPFILTER_LOG
- /* log */
- { { &ipl_suppress }, "ipl_suppress", 0, 1,
- sizeof(ipl_suppress), 0 },
- { { &ipl_buffer_sz }, "ipl_buffer_sz", 0, 0,
- sizeof(ipl_buffer_sz), IPFT_RDONLY },
- { { &ipl_logmax }, "ipl_logmax", 0, 0x7fffffff,
- sizeof(ipl_logmax), IPFT_WRDISABLED },
- { { &ipl_logall }, "ipl_logall", 0, 1,
- sizeof(ipl_logall), 0 },
- { { &ipl_logsize }, "ipl_logsize", 0, 0x80000,
- sizeof(ipl_logsize), 0 },
-#endif
- { { NULL }, NULL, 0, 0 }
-};
-
-static ipftuneable_t *ipf_tunelist = NULL;
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_findtunebycookie */
-/* Returns: NULL = search failed, else pointer to tune struct */
-/* Parameters: cookie(I) - cookie value to search for amongst tuneables */
-/* next(O) - pointer to place to store the cookie for the */
-/* "next" tuneable, if it is desired. */
-/* */
-/* This function is used to walk through all of the existing tunables with */
-/* successive calls. It searches the known tunables for the one which has */
-/* a matching value for "cookie" - ie its address. When returning a match, */
-/* the next one to be found may be returned inside next. */
-/* ------------------------------------------------------------------------ */
-static ipftuneable_t *fr_findtunebycookie(cookie, next)
-void *cookie, **next;
-{
- ipftuneable_t *ta, **tap;
-
- for (ta = ipf_tuneables; ta->ipft_name != NULL; ta++)
- if (ta == cookie) {
- if (next != NULL) {
- /*
- * If the next entry in the array has a name
- * present, then return a pointer to it for
- * where to go next, else return a pointer to
- * the dynaminc list as a key to search there
- * next. This facilitates a weak linking of
- * the two "lists" together.
- */
- if ((ta + 1)->ipft_name != NULL)
- *next = ta + 1;
- else
- *next = &ipf_tunelist;
- }
- return ta;
- }
-
- for (tap = &ipf_tunelist; (ta = *tap) != NULL; tap = &ta->ipft_next)
- if (tap == cookie) {
- if (next != NULL)
- *next = &ta->ipft_next;
- return ta;
- }
-
- if (next != NULL)
- *next = NULL;
- return NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_findtunebyname */
-/* Returns: NULL = search failed, else pointer to tune struct */
-/* Parameters: name(I) - name of the tuneable entry to find. */
-/* */
-/* Search the static array of tuneables and the list of dynamic tuneables */
-/* for an entry with a matching name. If we can find one, return a pointer */
-/* to the matching structure. */
-/* ------------------------------------------------------------------------ */
-static ipftuneable_t *fr_findtunebyname(name)
-char *name;
-{
- ipftuneable_t *ta;
-
- for (ta = ipf_tuneables; ta->ipft_name != NULL; ta++)
- if (!strcmp(ta->ipft_name, name)) {
- return ta;
- }
-
- for (ta = ipf_tunelist; ta != NULL; ta = ta->ipft_next)
- if (!strcmp(ta->ipft_name, name)) {
- return ta;
- }
-
- return NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_addipftune */
-/* Returns: int - 0 == success, else failure */
-/* Parameters: newtune - pointer to new tune struct to add to tuneables */
-/* */
-/* Appends the tune structure pointer to by "newtune" to the end of the */
-/* current list of "dynamic" tuneable parameters. Once added, the owner */
-/* of the object is not expected to ever change "ipft_next". */
-/* ------------------------------------------------------------------------ */
-int fr_addipftune(newtune)
-ipftuneable_t *newtune;
-{
- ipftuneable_t *ta, **tap;
-
- ta = fr_findtunebyname(newtune->ipft_name);
- if (ta != NULL)
- return EEXIST;
-
- for (tap = &ipf_tunelist; *tap != NULL; tap = &(*tap)->ipft_next)
- ;
-
- newtune->ipft_next = NULL;
- *tap = newtune;
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_delipftune */
-/* Returns: int - 0 == success, else failure */
-/* Parameters: oldtune - pointer to tune struct to remove from the list of */
-/* current dynamic tuneables */
-/* */
-/* Search for the tune structure, by pointer, in the list of those that are */
-/* dynamically added at run time. If found, adjust the list so that this */
-/* structure is no longer part of it. */
-/* ------------------------------------------------------------------------ */
-int fr_delipftune(oldtune)
-ipftuneable_t *oldtune;
-{
- ipftuneable_t *ta, **tap;
-
- for (tap = &ipf_tunelist; (ta = *tap) != NULL; tap = &ta->ipft_next)
- if (ta == oldtune) {
- *tap = oldtune->ipft_next;
- oldtune->ipft_next = NULL;
- return 0;
- }
-
- return ESRCH;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ipftune */
-/* Returns: int - 0 == success, else failure */
-/* Parameters: cmd(I) - ioctl command number */
-/* data(I) - pointer to ioctl data structure */
-/* */
-/* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */
-/* three ioctls provide the means to access and control global variables */
-/* within IPFilter, allowing (for example) timeouts and table sizes to be */
-/* changed without rebooting, reloading or recompiling. The initialisation */
-/* and 'destruction' routines of the various components of ipfilter are all */
-/* each responsible for handling their own values being too big. */
-/* ------------------------------------------------------------------------ */
-int fr_ipftune(cmd, data)
-ioctlcmd_t cmd;
-void *data;
-{
- ipftuneable_t *ta;
- ipftune_t tu;
- void *cookie;
- int error;
-
- error = fr_inobj(data, &tu, IPFOBJ_TUNEABLE);
- if (error != 0)
- return error;
-
- tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0';
- cookie = tu.ipft_cookie;
- ta = NULL;
-
- switch (cmd)
- {
- case SIOCIPFGETNEXT :
- /*
- * If cookie is non-NULL, assume it to be a pointer to the last
- * entry we looked at, so find it (if possible) and return a
- * pointer to the next one after it. The last entry in the
- * the table is a NULL entry, so when we get to it, set cookie
- * to NULL and return that, indicating end of list, erstwhile
- * if we come in with cookie set to NULL, we are starting anew
- * at the front of the list.
- */
- if (cookie != NULL) {
- ta = fr_findtunebycookie(cookie, &tu.ipft_cookie);
- } else {
- ta = ipf_tuneables;
- tu.ipft_cookie = ta + 1;
- }
- if (ta != NULL) {
- /*
- * Entry found, but does the data pointed to by that
- * row fit in what we can return?
- */
- if (ta->ipft_sz > sizeof(tu.ipft_un))
- return EINVAL;
-
- tu.ipft_vlong = 0;
- if (ta->ipft_sz == sizeof(u_long))
- tu.ipft_vlong = *ta->ipft_plong;
- else if (ta->ipft_sz == sizeof(u_int))
- tu.ipft_vint = *ta->ipft_pint;
- else if (ta->ipft_sz == sizeof(u_short))
- tu.ipft_vshort = *ta->ipft_pshort;
- else if (ta->ipft_sz == sizeof(u_char))
- tu.ipft_vchar = *ta->ipft_pchar;
-
- tu.ipft_sz = ta->ipft_sz;
- tu.ipft_min = ta->ipft_min;
- tu.ipft_max = ta->ipft_max;
- tu.ipft_flags = ta->ipft_flags;
- bcopy(ta->ipft_name, tu.ipft_name,
- MIN(sizeof(tu.ipft_name),
- strlen(ta->ipft_name) + 1));
- }
- error = fr_outobj(data, &tu, IPFOBJ_TUNEABLE);
- break;
-
- case SIOCIPFGET :
- case SIOCIPFSET :
- /*
- * Search by name or by cookie value for a particular entry
- * in the tuning paramter table.
- */
- error = ESRCH;
- if (cookie != NULL) {
- ta = fr_findtunebycookie(cookie, NULL);
- if (ta != NULL)
- error = 0;
- } else if (tu.ipft_name[0] != '\0') {
- ta = fr_findtunebyname(tu.ipft_name);
- if (ta != NULL)
- error = 0;
- }
- if (error != 0)
- break;
-
- if (cmd == (ioctlcmd_t)SIOCIPFGET) {
- /*
- * Fetch the tuning parameters for a particular value
- */
- tu.ipft_vlong = 0;
- if (ta->ipft_sz == sizeof(u_long))
- tu.ipft_vlong = *ta->ipft_plong;
- else if (ta->ipft_sz == sizeof(u_int))
- tu.ipft_vint = *ta->ipft_pint;
- else if (ta->ipft_sz == sizeof(u_short))
- tu.ipft_vshort = *ta->ipft_pshort;
- else if (ta->ipft_sz == sizeof(u_char))
- tu.ipft_vchar = *ta->ipft_pchar;
- tu.ipft_sz = ta->ipft_sz;
- tu.ipft_min = ta->ipft_min;
- tu.ipft_max = ta->ipft_max;
- tu.ipft_flags = ta->ipft_flags;
- error = fr_outobj(data, &tu, IPFOBJ_TUNEABLE);
-
- } else if (cmd == (ioctlcmd_t)SIOCIPFSET) {
- /*
- * Set an internal parameter. The hard part here is
- * getting the new value safely and correctly out of
- * the kernel (given we only know its size, not type.)
- */
- u_long in;
-
- if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) &&
- (fr_running > 0)) {
- error = EBUSY;
- break;
- }
-
- in = tu.ipft_vlong;
- if (in < ta->ipft_min || in > ta->ipft_max) {
- error = EINVAL;
- break;
- }
-
- if (ta->ipft_sz == sizeof(u_long)) {
- tu.ipft_vlong = *ta->ipft_plong;
- *ta->ipft_plong = in;
- } else if (ta->ipft_sz == sizeof(u_int)) {
- tu.ipft_vint = *ta->ipft_pint;
- *ta->ipft_pint = (u_int)(in & 0xffffffff);
- } else if (ta->ipft_sz == sizeof(u_short)) {
- tu.ipft_vshort = *ta->ipft_pshort;
- *ta->ipft_pshort = (u_short)(in & 0xffff);
- } else if (ta->ipft_sz == sizeof(u_char)) {
- tu.ipft_vchar = *ta->ipft_pchar;
- *ta->ipft_pchar = (u_char)(in & 0xff);
- }
- error = fr_outobj(data, &tu, IPFOBJ_TUNEABLE);
- }
- break;
-
- default :
- error = EINVAL;
- break;
- }
-
- return error;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_initialise */
-/* Returns: int - 0 == success, < 0 == failure */
-/* Parameters: None. */
-/* */
-/* Call of the initialise functions for all the various subsystems inside */
-/* of IPFilter. If any of them should fail, return immeadiately a failure */
-/* BUT do not try to recover from the error here. */
-/* ------------------------------------------------------------------------ */
-int fr_initialise()
-{
- int i;
-
-#ifdef IPFILTER_LOG
- i = fr_loginit();
- if (i < 0)
- return -10 + i;
-#endif
- i = fr_natinit();
- if (i < 0)
- return -20 + i;
-
- i = fr_stateinit();
- if (i < 0)
- return -30 + i;
-
- i = fr_authinit();
- if (i < 0)
- return -40 + i;
-
- i = fr_fraginit();
- if (i < 0)
- return -50 + i;
-
- i = appr_init();
- if (i < 0)
- return -60 + i;
-
-#ifdef IPFILTER_SYNC
- i = ipfsync_init();
- if (i < 0)
- return -70 + i;
-#endif
-#ifdef IPFILTER_SCAN
- i = ipsc_init();
- if (i < 0)
- return -80 + i;
-#endif
-#ifdef IPFILTER_LOOKUP
- i = ip_lookup_init();
- if (i < 0)
- return -90 + i;
-#endif
-#ifdef IPFILTER_COMPILED
- ipfrule_add();
-#endif
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_deinitialise */
-/* Returns: None. */
-/* Parameters: None. */
-/* */
-/* Call all the various subsystem cleanup routines to deallocate memory or */
-/* destroy locks or whatever they've done that they need to now undo. */
-/* The order here IS important as there are some cross references of */
-/* internal data structures. */
-/* ------------------------------------------------------------------------ */
-void fr_deinitialise()
-{
- fr_fragunload();
- fr_authunload();
- fr_natunload();
- fr_stateunload();
-#ifdef IPFILTER_SCAN
- fr_scanunload();
-#endif
- appr_unload();
-
-#ifdef IPFILTER_COMPILED
- ipfrule_remove();
-#endif
-
- (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
- (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE);
- (void) frflush(IPL_LOGCOUNT, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
- (void) frflush(IPL_LOGCOUNT, 0, FR_INQUE|FR_OUTQUE);
-
-#ifdef IPFILTER_LOOKUP
- ip_lookup_unload();
-#endif
-
-#ifdef IPFILTER_LOG
- fr_logunload();
-#endif
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_zerostats */
-/* Returns: int - 0 = success, else failure */
-/* Parameters: data(O) - pointer to pointer for copying data back to */
-/* */
-/* Copies the current statistics out to userspace and then zero's the */
-/* current ones in the kernel. The lock is only held across the bzero() as */
-/* the copyout may result in paging (ie network activity.) */
-/* ------------------------------------------------------------------------ */
-int fr_zerostats(data)
-caddr_t data;
-{
- friostat_t fio;
- int error;
-
- fr_getstat(&fio);
- error = copyoutptr(&fio, data, sizeof(fio));
- if (error)
- return EFAULT;
-
- WRITE_ENTER(&ipf_mutex);
- bzero((char *)frstats, sizeof(*frstats) * 2);
- RWLOCK_EXIT(&ipf_mutex);
-
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_resolvedest */
-/* Returns: Nil */
-/* Parameters: fdp(IO) - pointer to destination information to resolve */
-/* v(I) - IP protocol version to match */
-/* */
-/* Looks up an interface name in the frdest structure pointed to by fdp and */
-/* if a matching name can be found for the particular IP protocol version */
-/* then store the interface pointer in the frdest struct. If no match is */
-/* found, then set the interface pointer to be -1 as NULL is considered to */
-/* indicate there is no information at all in the structure. */
-/* ------------------------------------------------------------------------ */
-void fr_resolvedest(fdp, v)
-frdest_t *fdp;
-int v;
-{
- void *ifp;
-
- ifp = NULL;
- v = v; /* LINT */
-
- if (*fdp->fd_ifname != '\0') {
- ifp = GETIFP(fdp->fd_ifname, v);
- if (ifp == NULL)
- ifp = (void *)-1;
- }
- fdp->fd_ifp = ifp;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_icmp4errortype */
-/* Returns: int - 1 == success, 0 == failure */
-/* Parameters: icmptype(I) - ICMP type number */
-/* */
-/* Tests to see if the ICMP type number passed is an error type or not. */
-/* ------------------------------------------------------------------------ */
-int fr_icmp4errortype(icmptype)
-int icmptype;
-{
-
- switch (icmptype)
- {
- case ICMP_SOURCEQUENCH :
- case ICMP_PARAMPROB :
- case ICMP_REDIRECT :
- case ICMP_TIMXCEED :
- case ICMP_UNREACH :
- return 1;
- default:
- return 0;
- }
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_resolvenic */
-/* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */
-/* pointer to interface structure for NIC */
-/* Parameters: name(I) - complete interface name */
-/* v(I) - IP protocol version */
-/* */
-/* Look for a network interface structure that firstly has a matching name */
-/* to that passed in and that is also being used for that IP protocol */
-/* version (necessary on some platforms where there are separate listings */
-/* for both IPv4 and IPv6 on the same physical NIC. */
-/* */
-/* One might wonder why name gets terminated with a \0 byte in here. The */
-/* reason is an interface name could get into the kernel structures of ipf */
-/* in any number of ways and so long as they all use the same sized array */
-/* to put the name in, it makes sense to ensure it gets null terminated */
-/* before it is used for its intended purpose - finding its match in the */
-/* kernel's list of configured interfaces. */
-/* */
-/* NOTE: This SHOULD ONLY be used with IPFilter structures that have an */
-/* array for the name that is LIFNAMSIZ bytes (at least) in length. */
-/* ------------------------------------------------------------------------ */
-void *fr_resolvenic(name, v)
-char *name;
-int v;
-{
- void *nic;
-
- if (name[0] == '\0')
- return NULL;
-
- if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) {
- return NULL;
- }
-
- name[LIFNAMSIZ - 1] = '\0';
-
- nic = GETIFP(name, v);
- if (nic == NULL)
- nic = (void *)-1;
- return nic;
-}
diff --git a/contrib/ipfilter/fils.c b/contrib/ipfilter/fils.c
deleted file mode 100644
index e21af892a577..000000000000
--- a/contrib/ipfilter/fils.c
+++ /dev/null
@@ -1,1536 +0,0 @@
-/*
- * Copyright (C) 1993-2001 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#ifdef __FreeBSD__
-# ifndef __FreeBSD_cc_version
-# include <osreldate.h>
-# else
-# if __FreeBSD_cc_version < 430000
-# include <osreldate.h>
-# endif
-# endif
-#endif
-#if defined(__sgi) && (IRIX > 602)
-# include <sys/ptimers.h>
-#endif
-#include <stdio.h>
-#include <string.h>
-#if !defined(__SVR4) && !defined(__svr4__)
-# include <strings.h>
-#endif
-#include <sys/types.h>
-#include <sys/time.h>
-#include <sys/param.h>
-#include <sys/file.h>
-#if defined(STATETOP)
-# if defined(_BSDI_VERSION)
-# undef STATETOP)
-# endif
-# if defined(__FreeBSD__) && \
- (!defined(__FreeBSD_version) || (__FreeBSD_version < 430000))
-# undef STATETOP
-# endif
-# if defined(__NetBSD_Version__)
-# if (__NetBSD_Version__ < 105000000)
-# undef STATETOP
-# else
-# include <poll.h>
-# define USE_POLL
-# endif
-# endif
-# if defined(sun)
-# if defined(__svr4__) || defined(__SVR4)
-# include <sys/select.h>
-# else
-# undef STATETOP /* NOT supported on SunOS4 */
-# endif
-# endif
-#endif
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <stddef.h>
-#include <nlist.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <net/if.h>
-#if __FreeBSD_version >= 300000
-# include <net/if_var.h>
-#endif
-#include <netdb.h>
-#include <arpa/nameser.h>
-#include <resolv.h>
-#include <netinet/tcp.h>
-#if defined(STATETOP) && !defined(linux)
-# include <netinet/ip_var.h>
-# include <netinet/tcp_fsm.h>
-#endif
-#include "netinet/ip_compat.h"
-#include "netinet/ip_fil.h"
-#include "ipf.h"
-#include "netinet/ip_nat.h"
-#include "netinet/ip_frag.h"
-#include "netinet/ip_state.h"
-#include "netinet/ip_proxy.h"
-#include "netinet/ip_auth.h"
-#ifdef STATETOP
-# include "netinet/ipl.h"
-# include <ctype.h>
-# if SOLARIS || defined(__NetBSD__) || defined(_BSDI_VERSION) || \
- defined(__sgi)
-# ifdef ERR
-# undef ERR
-# endif
-# include <curses.h>
-# else /* SOLARIS */
-# include <ncurses.h>
-# endif /* SOLARIS */
-#endif /* STATETOP */
-#include "kmem.h"
-#if defined(__NetBSD__) || (__OpenBSD__)
-# include <paths.h>
-#endif
-
-#if !defined(lint)
-static const char sccsid[] = "@(#)fils.c 1.21 4/20/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.45 2004/04/10 11:45:48 darrenr Exp $";
-#endif
-
-extern char *optarg;
-extern int optind;
-
-#define PRINTF (void)printf
-#define FPRINTF (void)fprintf
-#define F_IN 0
-#define F_OUT 1
-#define F_ACIN 2
-#define F_ACOUT 3
-static char *filters[4] = { "ipfilter(in)", "ipfilter(out)",
- "ipacct(in)", "ipacct(out)" };
-
-int opts = 0;
-int use_inet6 = 0;
-int live_kernel = 1;
-int state_fd = -1;
-int auth_fd = -1;
-int ipf_fd = -1;
-
-#ifdef STATETOP
-#define STSTRSIZE 80
-#define STGROWSIZE 16
-#define HOSTNMLEN 40
-
-#define STSORT_PR 0
-#define STSORT_PKTS 1
-#define STSORT_BYTES 2
-#define STSORT_TTL 3
-#define STSORT_SRCIP 4
-#define STSORT_DSTIP 5
-#define STSORT_MAX STSORT_DSTIP
-#define STSORT_DEFAULT STSORT_BYTES
-
-
-typedef struct statetop {
- union i6addr st_src;
- union i6addr st_dst;
- u_short st_sport;
- u_short st_dport;
- u_char st_p;
- u_char st_state[2];
- U_QUAD_T st_pkts;
- U_QUAD_T st_bytes;
- u_long st_age;
-} statetop_t;
-#endif
-
-extern int main __P((int, char *[]));
-static void showstats __P((friostat_t *, u_32_t));
-static void showfrstates __P((ipfrstat_t *));
-static void showlist __P((friostat_t *));
-static void showipstates __P((ips_stat_t *));
-static void showauthstates __P((fr_authstat_t *));
-static void showgroups __P((friostat_t *));
-static void Usage __P((char *));
-static void printlist __P((frentry_t *));
-static void parse_ipportstr __P((const char *, struct in_addr *, int *));
-static int ipfstate_live __P((char *, friostat_t **, ips_stat_t **,
- ipfrstat_t **, fr_authstat_t **, u_32_t *));
-static void ipfstate_dead __P((char *, friostat_t **, ips_stat_t **,
- ipfrstat_t **, fr_authstat_t **, u_32_t *));
-#ifdef STATETOP
-static void topipstates __P((struct in_addr, struct in_addr, int, int, int, int, int));
-static char *ttl_to_string __P((long));
-static int sort_p __P((const void *, const void *));
-static int sort_pkts __P((const void *, const void *));
-static int sort_bytes __P((const void *, const void *));
-static int sort_ttl __P((const void *, const void *));
-static int sort_srcip __P((const void *, const void *));
-static int sort_dstip __P((const void *, const void *));
-#endif
-#if SOLARIS
-void showqiflist __P((char *));
-#endif
-
-
-static void Usage(name)
-char *name;
-{
-#ifdef USE_INET6
- fprintf(stderr, "Usage: %s [-6aAfhIinosv] [-d <device>]\n", name);
-#else
- fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name);
-#endif
- fprintf(stderr, "\t\t[-M corefile] [-N symbol-list]\n");
- fprintf(stderr, " %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
- exit(1);
-}
-
-
-int main(argc,argv)
-int argc;
-char *argv[];
-{
- fr_authstat_t frauthst;
- fr_authstat_t *frauthstp = &frauthst;
- friostat_t fio;
- friostat_t *fiop = &fio;
- ips_stat_t ipsst;
- ips_stat_t *ipsstp = &ipsst;
- ipfrstat_t ifrst;
- ipfrstat_t *ifrstp = &ifrst;
- char *device = IPL_NAME, *memf = NULL;
- char *kern = NULL;
- int c, myoptind;
- struct protoent *proto;
-
- int protocol = -1; /* -1 = wild card for any protocol */
- int refreshtime = 1; /* default update time */
- int sport = -1; /* -1 = wild card for any source port */
- int dport = -1; /* -1 = wild card for any dest port */
- int topclosed = 0; /* do not show closed tcp sessions */
- struct in_addr saddr, daddr;
- u_32_t frf;
-
- saddr.s_addr = INADDR_ANY; /* default any source addr */
- daddr.s_addr = INADDR_ANY; /* default any dest addr */
-
- /*
- * Parse these two arguments now lest there be any buffer overflows
- * in the parsing of the rest.
- */
- myoptind = optind;
- while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
- switch (c)
- {
- case 'M' :
- memf = optarg;
- live_kernel = 0;
- break;
- case 'N' :
- kern = optarg;
- live_kernel = 0;
- break;
- }
- optind = myoptind;
-
- if (live_kernel == 1) {
- if ((state_fd = open(IPL_STATE, O_RDONLY)) == -1) {
- perror("open");
- exit(-1);
- }
- if ((auth_fd = open(IPL_AUTH, O_RDONLY)) == -1) {
- perror("open");
- exit(-1);
- }
- if ((ipf_fd = open(device, O_RDONLY)) == -1) {
- perror("open");
- exit(-1);
- }
- }
-
- if (kern != NULL || memf != NULL)
- {
- (void)setuid(getuid());
- (void)setgid(getgid());
- }
-
- if (openkmem(kern, memf) == -1)
- exit(-1);
-
- (void)setuid(getuid());
- (void)setgid(getgid());
-
- while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
- {
- switch (c)
- {
-#ifdef USE_INET6
- case '6' :
- use_inet6 = 1;
- break;
-#endif
- case 'a' :
- opts |= OPT_ACCNT|OPT_SHOWLIST;
- break;
- case 'A' :
- device = IPAUTH_NAME;
- opts |= OPT_AUTHSTATS;
- break;
- case 'C' :
- topclosed = 1;
- break;
- case 'd' :
- device = optarg;
- break;
- case 'D' :
- parse_ipportstr(optarg, &daddr, &dport);
- break;
- case 'f' :
- opts |= OPT_FRSTATES;
- break;
- case 'g' :
- opts |= OPT_GROUPS;
- break;
- case 'h' :
- opts |= OPT_HITS;
- break;
- case 'i' :
- opts |= OPT_INQUE|OPT_SHOWLIST;
- break;
- case 'I' :
- opts |= OPT_INACTIVE;
- break;
- case 'l' :
- opts |= OPT_SHOWLIST;
- break;
- case 'M' :
- break;
- case 'N' :
- break;
- case 'n' :
- opts |= OPT_SHOWLINENO;
- break;
- case 'o' :
- opts |= OPT_OUTQUE|OPT_SHOWLIST;
- break;
- case 'P' :
- if ((proto = getprotobyname(optarg)) != NULL) {
- protocol = proto->p_proto;
- } else if (!sscanf(optarg, "%ud", &protocol) ||
- (protocol < 0)) {
- fprintf(stderr, "%s : Invalid protocol: %s\n",
- argv[0], optarg);
- exit(-2);
- }
- break;
- case 'q' :
-#if SOLARIS
- showqiflist(kern);
- exit(0);
- break;
-#else
- fprintf(stderr, "-q only availble on Solaris\n");
- exit(1);
- break;
-#endif
- case 's' :
- opts |= OPT_IPSTATES;
- break;
- case 'S' :
- parse_ipportstr(optarg, &saddr, &sport);
- break;
- case 't' :
-#ifdef STATETOP
- opts |= OPT_STATETOP;
- break;
-#else
- fprintf(stderr,
- "%s : state top facility not compiled in\n",
- argv[0]);
- exit(-2);
-#endif
- case 'T' :
- if (!sscanf(optarg, "%d", &refreshtime) ||
- (refreshtime <= 0)) {
- fprintf(stderr,
- "%s : Invalid refreshtime < 1 : %s\n",
- argv[0], optarg);
- exit(-2);
- }
- break;
- case 'v' :
- opts |= OPT_VERBOSE;
- break;
- default :
- Usage(argv[0]);
- break;
- }
- }
-
- if (live_kernel == 1) {
- bzero((char *)&fio, sizeof(fio));
- bzero((char *)&ipsst, sizeof(ipsst));
- bzero((char *)&ifrst, sizeof(ifrst));
-
- ipfstate_live(device, &fiop, &ipsstp, &ifrstp,
- &frauthstp, &frf);
- } else
- ipfstate_dead(kern, &fiop, &ipsstp, &ifrstp, &frauthstp, &frf);
-
- if (opts & OPT_IPSTATES) {
- showipstates(ipsstp);
- } else if (opts & OPT_SHOWLIST) {
- showlist(fiop);
- if ((opts & OPT_OUTQUE) && (opts & OPT_INQUE)){
- opts &= ~OPT_OUTQUE;
- showlist(fiop);
- }
- } else {
- if (opts & OPT_FRSTATES)
- showfrstates(ifrstp);
-#ifdef STATETOP
- else if (opts & OPT_STATETOP)
- topipstates(saddr, daddr, sport, dport,
- protocol, refreshtime, topclosed);
-#endif
- else if (opts & OPT_AUTHSTATS)
- showauthstates(frauthstp);
- else if (opts & OPT_GROUPS)
- showgroups(fiop);
- else
- showstats(fiop, frf);
- }
- return 0;
-}
-
-
-/*
- * Fill in the stats structures from the live kernel, using a combination
- * of ioctl's and copying directly from kernel memory.
- */
-int ipfstate_live(device, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
-char *device;
-friostat_t **fiopp;
-ips_stat_t **ipsstpp;
-ipfrstat_t **ifrstpp;
-fr_authstat_t **frauthstpp;
-u_32_t *frfp;
-{
-
- if (!(opts & OPT_AUTHSTATS) && ioctl(ipf_fd, SIOCGETFS, fiopp) == -1) {
- perror("ioctl(ipf:SIOCGETFS)");
- exit(-1);
- }
-
- if ((opts & OPT_IPSTATES)) {
- if ((ioctl(state_fd, SIOCGETFS, ipsstpp) == -1)) {
- perror("ioctl(state:SIOCGETFS)");
- exit(-1);
- }
- }
- if ((opts & OPT_FRSTATES) &&
- (ioctl(ipf_fd, SIOCGFRST, ifrstpp) == -1)) {
- perror("ioctl(SIOCGFRST)");
- exit(-1);
- }
-
- if (opts & OPT_VERBOSE)
- PRINTF("opts %#x name %s\n", opts, device);
-
- if ((opts & OPT_AUTHSTATS) &&
- (ioctl(auth_fd, SIOCATHST, frauthstpp) == -1)) {
- perror("ioctl(SIOCATHST)");
- exit(-1);
- }
-
- if (ioctl(ipf_fd, SIOCGETFF, frfp) == -1)
- perror("ioctl(SIOCGETFF)");
-
- return ipf_fd;
-}
-
-
-/*
- * Build up the stats structures from data held in the "core" memory.
- * This is mainly useful when looking at data in crash dumps and ioctl's
- * just won't work any more.
- */
-void ipfstate_dead(kernel, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
-char *kernel;
-friostat_t **fiopp;
-ips_stat_t **ipsstpp;
-ipfrstat_t **ifrstpp;
-fr_authstat_t **frauthstpp;
-u_32_t *frfp;
-{
- static fr_authstat_t frauthst, *frauthstp;
- static ips_stat_t ipsst, *ipsstp;
- static ipfrstat_t ifrst, *ifrstp;
- static friostat_t fio, *fiop;
-
- void *rules[2][2];
- struct nlist deadlist[42] = {
- { "fr_authstats" }, /* 0 */
- { "fae_list" },
- { "ipauth" },
- { "fr_authlist" },
- { "fr_authstart" },
- { "fr_authend" }, /* 5 */
- { "fr_authnext" },
- { "fr_auth" },
- { "fr_authused" },
- { "fr_authsize" },
- { "fr_defaultauthage" }, /* 10 */
- { "fr_authpkts" },
- { "fr_auth_lock" },
- { "frstats" },
- { "ips_stats" },
- { "ips_num" }, /* 15 */
- { "ips_wild" },
- { "ips_list" },
- { "ips_table" },
- { "fr_statemax" },
- { "fr_statesize" }, /* 20 */
- { "fr_state_doflush" },
- { "fr_state_lock" },
- { "ipfr_heads" },
- { "ipfr_nattab" },
- { "ipfr_stats" }, /* 25 */
- { "ipfr_inuse" },
- { "fr_ipfrttl" },
- { "fr_frag_lock" },
- { "ipfr_timer_id" },
- { "fr_nat_lock" }, /* 30 */
- { "ipfilter" },
- { "ipfilter6" },
- { "ipacct" },
- { "ipacct6" },
- { "ipl_frouteok" }, /* 35 */
- { "fr_running" },
- { "ipfgroups" },
- { "fr_active" },
- { "fr_pass" },
- { "fr_flags" }, /* 40 */
- { NULL }
- };
-
-
- frauthstp = &frauthst;
- ipsstp = &ipsst;
- ifrstp = &ifrst;
- fiop = &fio;
-
- *frfp = 0;
- *fiopp = fiop;
- *ipsstpp = ipsstp;
- *ifrstpp = ifrstp;
- *frauthstpp = frauthstp;
-
- bzero((char *)fiop, sizeof(*fiop));
- bzero((char *)ipsstp, sizeof(*ipsstp));
- bzero((char *)ifrstp, sizeof(*ifrstp));
- bzero((char *)frauthstp, sizeof(*frauthstp));
-
- if (nlist(kernel, deadlist) == -1) {
- fprintf(stderr, "nlist error\n");
- return;
- }
-
- /*
- * This is for SIOCGETFF.
- */
- kmemcpy((char *)frfp, (u_long)deadlist[40].n_value, sizeof(*frfp));
-
- /*
- * f_locks is a combination of the lock variable from each part of
- * ipfilter (state, auth, nat, fragments).
- */
- kmemcpy((char *)fiop, (u_long)deadlist[13].n_value, sizeof(*fiop));
- kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[22].n_value,
- sizeof(fiop->f_locks[0]));
- kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[30].n_value,
- sizeof(fiop->f_locks[1]));
- kmemcpy((char *)&fiop->f_locks[2], (u_long)deadlist[28].n_value,
- sizeof(fiop->f_locks[2]));
- kmemcpy((char *)&fiop->f_locks[3], (u_long)deadlist[12].n_value,
- sizeof(fiop->f_locks[3]));
-
- /*
- * Get pointers to each list of rules (active, inactive, in, out)
- */
- kmemcpy((char *)&rules, (u_long)deadlist[31].n_value, sizeof(rules));
- fiop->f_fin[0] = rules[0][0];
- fiop->f_fin[1] = rules[0][1];
- fiop->f_fout[0] = rules[1][0];
- fiop->f_fout[1] = rules[1][1];
-
- /*
- * Same for IPv6, except make them null if support for it is not
- * being compiled in.
- */
-#ifdef USE_INET6
- kmemcpy((char *)&rules, (u_long)deadlist[32].n_value, sizeof(rules));
- fiop->f_fin6[0] = rules[0][0];
- fiop->f_fin6[1] = rules[0][1];
- fiop->f_fout6[0] = rules[1][0];
- fiop->f_fout6[1] = rules[1][1];
-#else
- fiop->f_fin6[0] = NULL;
- fiop->f_fin6[1] = NULL;
- fiop->f_fout6[0] = NULL;
- fiop->f_fout6[1] = NULL;
-#endif
-
- /*
- * Now get accounting rules pointers.
- */
- kmemcpy((char *)&rules, (u_long)deadlist[33].n_value, sizeof(rules));
- fiop->f_acctin[0] = rules[0][0];
- fiop->f_acctin[1] = rules[0][1];
- fiop->f_acctout[0] = rules[1][0];
- fiop->f_acctout[1] = rules[1][1];
-
-#ifdef USE_INET6
- kmemcpy((char *)&rules, (u_long)deadlist[34].n_value, sizeof(rules));
- fiop->f_acctin6[0] = rules[0][0];
- fiop->f_acctin6[1] = rules[0][1];
- fiop->f_acctout6[0] = rules[1][0];
- fiop->f_acctout6[1] = rules[1][1];
-#else
- fiop->f_acctin6[0] = NULL;
- fiop->f_acctin6[1] = NULL;
- fiop->f_acctout6[0] = NULL;
- fiop->f_acctout6[1] = NULL;
-#endif
-
- /*
- * A collection of "global" variables used inside the kernel which
- * are all collected in friostat_t via ioctl.
- */
- kmemcpy((char *)&fiop->f_froute, (u_long)deadlist[35].n_value,
- sizeof(fiop->f_froute));
- kmemcpy((char *)&fiop->f_running, (u_long)deadlist[36].n_value,
- sizeof(fiop->f_running));
- kmemcpy((char *)&fiop->f_groups, (u_long)deadlist[37].n_value,
- sizeof(fiop->f_groups));
- kmemcpy((char *)&fiop->f_active, (u_long)deadlist[38].n_value,
- sizeof(fiop->f_active));
- kmemcpy((char *)&fiop->f_defpass, (u_long)deadlist[39].n_value,
- sizeof(fiop->f_defpass));
-
- /*
- * Build up the state information stats structure.
- */
- kmemcpy((char *)ipsstp, (u_long)deadlist[14].n_value, sizeof(*ipsstp));
- kmemcpy((char *)&ipsstp->iss_active, (u_long)deadlist[15].n_value,
- sizeof(ipsstp->iss_active));
- ipsstp->iss_table = (void *)deadlist[18].n_value;
- ipsstp->iss_list = (void *)deadlist[17].n_value;
-
- /*
- * Build up the authentiation information stats structure.
- */
- kmemcpy((char *)frauthstp, (u_long)deadlist[0].n_value,
- sizeof(*frauthstp));
- frauthstp->fas_faelist = (void *)deadlist[1].n_value;
-
- /*
- * Build up the fragment information stats structure.
- */
- kmemcpy((char *)ifrstp, (u_long)deadlist[25].n_value,
- sizeof(*ifrstp));
- ifrstp->ifs_table = (void *)deadlist[23].n_value;
- ifrstp->ifs_nattab = (void *)deadlist[24].n_value;
- kmemcpy((char *)&ifrstp->ifs_inuse, (u_long)deadlist[26].n_value,
- sizeof(ifrstp->ifs_inuse));
-}
-
-
-/*
- * Display the kernel stats for packets blocked and passed and other
- * associated running totals which are kept.
- */
-static void showstats(fp, frf)
-struct friostat *fp;
-u_32_t frf;
-{
-
-#if SOLARIS
- PRINTF("dropped packets:\tin %lu\tout %lu\n",
- fp->f_st[0].fr_drop, fp->f_st[1].fr_drop);
- PRINTF("non-data packets:\tin %lu\tout %lu\n",
- fp->f_st[0].fr_notdata, fp->f_st[1].fr_notdata);
- PRINTF("no-data packets:\tin %lu\tout %lu\n",
- fp->f_st[0].fr_nodata, fp->f_st[1].fr_nodata);
- PRINTF("non-ip packets:\t\tin %lu\tout %lu\n",
- fp->f_st[0].fr_notip, fp->f_st[1].fr_notip);
- PRINTF(" bad packets:\t\tin %lu\tout %lu\n",
- fp->f_st[0].fr_bad, fp->f_st[1].fr_bad);
- PRINTF("copied messages:\tin %lu\tout %lu\n",
- fp->f_st[0].fr_copy, fp->f_st[1].fr_copy);
-#endif
-#ifdef USE_INET6
- PRINTF(" IPv6 packets:\t\tin %lu out %lu\n",
- fp->f_st[0].fr_ipv6[0], fp->f_st[0].fr_ipv6[1]);
-#endif
- PRINTF(" input packets:\t\tblocked %lu passed %lu nomatch %lu",
- fp->f_st[0].fr_block, fp->f_st[0].fr_pass,
- fp->f_st[0].fr_nom);
- PRINTF(" counted %lu short %lu\n",
- fp->f_st[0].fr_acct, fp->f_st[0].fr_short);
- PRINTF("output packets:\t\tblocked %lu passed %lu nomatch %lu",
- fp->f_st[1].fr_block, fp->f_st[1].fr_pass,
- fp->f_st[1].fr_nom);
- PRINTF(" counted %lu short %lu\n",
- fp->f_st[1].fr_acct, fp->f_st[1].fr_short);
- PRINTF(" input packets logged:\tblocked %lu passed %lu\n",
- fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl);
- PRINTF("output packets logged:\tblocked %lu passed %lu\n",
- fp->f_st[1].fr_bpkl, fp->f_st[1].fr_ppkl);
- PRINTF(" packets logged:\tinput %lu output %lu\n",
- fp->f_st[0].fr_pkl, fp->f_st[1].fr_pkl);
- PRINTF(" log failures:\t\tinput %lu output %lu\n",
- fp->f_st[0].fr_skip, fp->f_st[1].fr_skip);
- PRINTF("fragment state(in):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
- fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr, fp->f_st[0].fr_cfr);
- PRINTF("fragment state(out):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
- fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr, fp->f_st[1].fr_cfr);
- PRINTF("packet state(in):\tkept %lu\tlost %lu\n",
- fp->f_st[0].fr_ads, fp->f_st[0].fr_bads);
- PRINTF("packet state(out):\tkept %lu\tlost %lu\n",
- fp->f_st[1].fr_ads, fp->f_st[1].fr_bads);
- PRINTF("ICMP replies:\t%lu\tTCP RSTs sent:\t%lu\n",
- fp->f_st[0].fr_ret, fp->f_st[1].fr_ret);
- PRINTF("Invalid source(in):\t%lu\n", fp->f_st[0].fr_badsrc);
- PRINTF("Result cache hits(in):\t%lu\t(out):\t%lu\n",
- fp->f_st[0].fr_chit, fp->f_st[1].fr_chit);
- PRINTF("IN Pullups succeeded:\t%lu\tfailed:\t%lu\n",
- fp->f_st[0].fr_pull[0], fp->f_st[0].fr_pull[1]);
- PRINTF("OUT Pullups succeeded:\t%lu\tfailed:\t%lu\n",
- fp->f_st[1].fr_pull[0], fp->f_st[1].fr_pull[1]);
- PRINTF("Fastroute successes:\t%lu\tfailures:\t%lu\n",
- fp->f_froute[0], fp->f_froute[1]);
- PRINTF("TCP cksum fails(in):\t%lu\t(out):\t%lu\n",
- fp->f_st[0].fr_tcpbad, fp->f_st[1].fr_tcpbad);
-
- PRINTF("Packet log flags set: (%#x)\n", frf);
- if (frf & FF_LOGPASS)
- PRINTF("\tpackets passed through filter\n");
- if (frf & FF_LOGBLOCK)
- PRINTF("\tpackets blocked by filter\n");
- if (frf & FF_LOGNOMATCH)
- PRINTF("\tpackets not matched by filter\n");
- if (!frf)
- PRINTF("\tnone\n");
-}
-
-
-/*
- * Print out a list of rules from the kernel, starting at the one passed.
- */
-static void printlist(fp)
-frentry_t *fp;
-{
- struct frentry fb;
- int n;
-
- for (n = 1; fp; n++) {
- if (kmemcpy((char *)&fb, (u_long)fp, sizeof(fb)) == -1) {
- perror("kmemcpy");
- return;
- }
- fp = &fb;
- if (opts & OPT_OUTQUE)
- fp->fr_flags |= FR_OUTQUE;
- if (opts & (OPT_HITS|OPT_VERBOSE))
-#ifdef USE_QUAD_T
- PRINTF("%qu ", (unsigned long long) fp->fr_hits);
-#else
- PRINTF("%lu ", fp->fr_hits);
-#endif
- if (opts & (OPT_ACCNT|OPT_VERBOSE))
-#ifdef USE_QUAD_T
- PRINTF("%qu ", (unsigned long long) fp->fr_bytes);
-#else
- PRINTF("%lu ", fp->fr_bytes);
-#endif
- if (opts & OPT_SHOWLINENO)
- PRINTF("@%d ", n);
- printfr(fp);
- if (opts & OPT_VERBOSE)
- binprint(fp);
- if (fp->fr_grp)
- printlist(fp->fr_grp);
- fp = fp->fr_next;
- }
-}
-
-/*
- * print out all of the asked for rule sets, using the stats struct as
- * the base from which to get the pointers.
- */
-static void showlist(fiop)
-struct friostat *fiop;
-{
- struct frentry *fp = NULL;
- int i, set;
-
- set = fiop->f_active;
- if (opts & OPT_INACTIVE)
- set = 1 - set;
- if (opts & OPT_ACCNT) {
-#ifdef USE_INET6
- if ((use_inet6) && (opts & OPT_OUTQUE)) {
- i = F_ACOUT;
- fp = (struct frentry *)fiop->f_acctout6[set];
- } else if ((use_inet6) && (opts & OPT_INQUE)) {
- i = F_ACIN;
- fp = (struct frentry *)fiop->f_acctin6[set];
- } else
-#endif
- if (opts & OPT_OUTQUE) {
- i = F_ACOUT;
- fp = (struct frentry *)fiop->f_acctout[set];
- } else if (opts & OPT_INQUE) {
- i = F_ACIN;
- fp = (struct frentry *)fiop->f_acctin[set];
- } else {
- FPRINTF(stderr, "No -i or -o given with -a\n");
- return;
- }
- } else {
-#ifdef USE_INET6
- if ((use_inet6) && (opts & OPT_OUTQUE)) {
- i = F_OUT;
- fp = (struct frentry *)fiop->f_fout6[set];
- } else if ((use_inet6) && (opts & OPT_INQUE)) {
- i = F_IN;
- fp = (struct frentry *)fiop->f_fin6[set];
- } else
-#endif
- if (opts & OPT_OUTQUE) {
- i = F_OUT;
- fp = (struct frentry *)fiop->f_fout[set];
- } else if (opts & OPT_INQUE) {
- i = F_IN;
- fp = (struct frentry *)fiop->f_fin[set];
- } else
- return;
- }
- if (opts & OPT_VERBOSE)
- FPRINTF(stderr, "showlist:opts %#x i %d\n", opts, i);
-
- if (opts & OPT_VERBOSE)
- PRINTF("fp %p set %d\n", fp, set);
- if (fp == NULL) {
- FPRINTF(stderr, "empty list for %s%s\n",
- (opts & OPT_INACTIVE) ? "inactive " : "", filters[i]);
- return;
- }
- printlist(fp);
-}
-
-
-/*
- * Display ipfilter stateful filtering information
- */
-static void showipstates(ipsp)
-ips_stat_t *ipsp;
-{
- ipstate_t *istab[IPSTATE_SIZE];
-
- /*
- * If a list of states hasn't been asked for, only print out stats
- */
- if (!(opts & OPT_SHOWLIST)) {
- PRINTF("IP states added:\n\t%lu TCP\n\t%lu UDP\n\t%lu ICMP\n",
- ipsp->iss_tcp, ipsp->iss_udp, ipsp->iss_icmp);
- PRINTF("\t%lu hits\n\t%lu misses\n", ipsp->iss_hits,
- ipsp->iss_miss);
- PRINTF("\t%lu maximum\n\t%lu no memory\n\t%lu bkts in use\n",
- ipsp->iss_max, ipsp->iss_nomem, ipsp->iss_inuse);
- PRINTF("\t%lu logged\n\t%lu log failures\n",
- ipsp->iss_logged, ipsp->iss_logfail);
- PRINTF("\t%lu active\n\t%lu expired\n\t%lu closed\n",
- ipsp->iss_active, ipsp->iss_expire, ipsp->iss_fin);
- return;
- }
-
- if (kmemcpy((char *)istab, (u_long)ipsp->iss_table, sizeof(istab)))
- return;
-
- /*
- * Print out all the state information currently held in the kernel.
- */
- while (ipsp->iss_list != NULL) {
- ipsp->iss_list = printstate(ipsp->iss_list, opts);
- }
-}
-
-
-#if SOLARIS
-/*
- * Displays the list of interfaces of which IPFilter has taken control in
- * Solaris.
- */
-void showqiflist(kern)
-char *kern;
-{
- struct nlist qifnlist[2] = {
- { "_qif_head" },
- { NULL }
- };
- qif_t qif, *qf;
- ill_t ill;
-
- if (kern == NULL)
- kern = "/dev/ksyms";
-
- if (nlist(kern, qifnlist) == -1) {
- fprintf(stderr, "nlist error\n");
- return;
- }
-
- printf("List of interfaces bound by IPFilter:\n");
- if (kmemcpy((char *)&qf, (u_long)qifnlist[0].n_value, sizeof(qf)))
- return;
- while (qf) {
- if (kmemcpy((char *)&qif, (u_long)qf, sizeof(qif)))
- break;
- if (kmemcpy((char *)&ill, (u_long)qif.qf_ill, sizeof(ill)))
- ill.ill_ppa = -1;
- printf("Name: %-8s Header Length: %2d SAP: %s (%04x) PPA %d",
- qif.qf_name, qif.qf_hl,
-#ifdef IP6_DL_SAP
- (qif.qf_sap == IP6_DL_SAP) ? "IPv6" : "IPv4"
-#else
- "IPv4"
-#endif
- , qif.qf_sap, ill.ill_ppa);
- printf(" %ld %ld", qif.qf_incnt, qif.qf_outcnt);
- qf = qif.qf_next;
- putchar('\n');
- }
-}
-#endif
-
-
-#ifdef STATETOP
-static void topipstates(saddr, daddr, sport, dport, protocol,
- refreshtime, topclosed)
-struct in_addr saddr;
-struct in_addr daddr;
-int sport;
-int dport;
-int protocol;
-int refreshtime;
-int topclosed;
-{
- char str1[STSTRSIZE], str2[STSTRSIZE], str3[STSTRSIZE], str4[STSTRSIZE];
- int maxtsentries = 0, reverse = 0, sorting = STSORT_DEFAULT;
- int i, j, winx, tsentry, maxx, maxy, redraw = 0;
- ipstate_t *istab[IPSTATE_SIZE], ips;
- ips_stat_t ipsst, *ipsstp = &ipsst;
- statetop_t *tstable = NULL, *tp;
- char hostnm[HOSTNMLEN];
- struct protoent *proto;
- int c = 0;
- time_t t;
-#ifdef USE_POLL
- struct pollfd set[1];
-#else
- struct timeval selecttimeout;
- fd_set readfd;
-#endif
-
- /* init ncurses stuff */
- initscr();
- cbreak();
- noecho();
-
- /* init hostname */
- gethostname(hostnm, sizeof(hostnm) - 1);
- hostnm[sizeof(hostnm) - 1] = '\0';
-
- /* repeat until user aborts */
- while ( 1 ) {
-
- /* get state table */
- bzero((char *)&ipsst, sizeof(&ipsst));
- if ((ioctl(state_fd, SIOCGETFS, &ipsstp) == -1)) {
- perror("ioctl(SIOCGETFS)");
- exit(-1);
- }
- if (kmemcpy((char *)istab, (u_long)ipsstp->iss_table,
- sizeof(ips)))
- return;
-
- /* clear the history */
- tsentry = -1;
-
- /* read the state table and store in tstable */
- while (ipsstp->iss_list) {
- if (kmemcpy((char *)&ips, (u_long)ipsstp->iss_list,
- sizeof(ips)))
- break;
- ipsstp->iss_list = ips.is_next;
-
- if (((saddr.s_addr == INADDR_ANY) ||
- (saddr.s_addr == ips.is_saddr)) &&
- ((daddr.s_addr == INADDR_ANY) ||
- (daddr.s_addr == ips.is_daddr)) &&
- ((protocol < 0) || (protocol == ips.is_p)) &&
- (((ips.is_p != IPPROTO_TCP) &&
- (ips.is_p != IPPROTO_UDP)) ||
- (((sport < 0) ||
- (htons(sport) == ips.is_sport)) &&
- ((dport < 0) ||
- (htons(dport) == ips.is_dport)))) &&
- (topclosed || (ips.is_p != IPPROTO_TCP) ||
- (ips.is_state[0] < TCPS_LAST_ACK) ||
- (ips.is_state[1] < TCPS_LAST_ACK))) {
- /*
- * if necessary make room for this state
- * entry
- */
- tsentry++;
- if (!maxtsentries ||
- (tsentry == maxtsentries)) {
-
- maxtsentries += STGROWSIZE;
- tstable = realloc(tstable, maxtsentries * sizeof(statetop_t));
- if (!tstable) {
- perror("malloc");
- exit(-1);
- }
- }
-
- /* fill structure */
- tp = tstable + tsentry;
- tp->st_src = ips.is_src;
- tp->st_dst = ips.is_dst;
- tp->st_p = ips.is_p;
- tp->st_state[0] = ips.is_state[0];
- tp->st_state[1] = ips.is_state[1];
- tp->st_pkts = ips.is_pkts;
- tp->st_bytes = ips.is_bytes;
- tp->st_age = ips.is_age;
- if ((ips.is_p == IPPROTO_TCP) ||
- (ips.is_p == IPPROTO_UDP)) {
- tp->st_sport = ips.is_sport;
- tp->st_dport = ips.is_dport;
- }
-
- }
- }
-
-
- /* sort the array */
- if (tsentry != -1)
- switch (sorting)
- {
- case STSORT_PR:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_p);
- break;
- case STSORT_PKTS:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_pkts);
- break;
- case STSORT_BYTES:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_bytes);
- break;
- case STSORT_TTL:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_ttl);
- break;
- case STSORT_SRCIP:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_srcip);
- break;
- case STSORT_DSTIP:
- qsort(tstable, tsentry + 1,
- sizeof(statetop_t), sort_dstip);
- break;
- default:
- break;
- }
-
- /* print title */
- erase();
- getmaxyx(stdscr, maxy, maxx);
- attron(A_BOLD);
- winx = 0;
- move(winx,0);
- sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION);
- for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
- printw(" ");
- printw("%s", str1);
- attroff(A_BOLD);
-
- /* just for fun add a clock */
- move(winx, maxx - 8);
- t = time(NULL);
- strftime(str1, 80, "%T", localtime(&t));
- printw("%s\n", str1);
-
- /*
- * print the display filters, this is placed in the loop,
- * because someday I might add code for changing these
- * while the programming is running :-)
- */
- if (sport >= 0)
- sprintf(str1, "%s,%d", inet_ntoa(saddr), sport);
- else
- sprintf(str1, "%s", inet_ntoa(saddr));
-
- if (dport >= 0)
- sprintf(str2, "%s,%d", inet_ntoa(daddr), dport);
- else
- sprintf(str2, "%s", inet_ntoa(daddr));
-
- if (protocol < 0)
- strcpy(str3, "any");
- else if ((proto = getprotobynumber(protocol)) != NULL)
- sprintf(str3, "%s", proto->p_name);
- else
- sprintf(str3, "%d", protocol);
-
- switch (sorting)
- {
- case STSORT_PR:
- sprintf(str4, "proto");
- break;
- case STSORT_PKTS:
- sprintf(str4, "# pkts");
- break;
- case STSORT_BYTES:
- sprintf(str4, "# bytes");
- break;
- case STSORT_TTL:
- sprintf(str4, "ttl");
- break;
- case STSORT_SRCIP:
- sprintf(str4, "srcip");
- break;
- case STSORT_DSTIP:
- sprintf(str4, "dstip");
- break;
- default:
- sprintf(str4, "unknown");
- break;
- }
-
- if (reverse)
- strcat(str4, " (reverse)");
-
- winx += 2;
- move(winx,0);
- printw("Src = %s Dest = %s Proto = %s Sorted by = %s\n\n",
- str1, str2, str3, str4);
-
- /* print column description */
- winx += 2;
- move(winx,0);
- attron(A_BOLD);
- printw("%-21s %-21s %3s %4s %7s %9s %9s\n", "Source IP",
- "Destination IP", "ST", "PR", "#pkts", "#bytes", "ttl");
- attroff(A_BOLD);
-
- /* print all the entries */
- tp = tstable;
- if (reverse)
- tp += tsentry;
-
- if (tsentry > maxy - 6)
- tsentry = maxy - 6;
- for (i = 0; i <= tsentry; i++) {
- /* print src/dest and port */
- if ((tp->st_p == IPPROTO_TCP) ||
- (tp->st_p == IPPROTO_UDP)) {
- sprintf(str1, "%s,%hu",
- inet_ntoa(tp->st_src.in4),
- ntohs(tp->st_sport));
- sprintf(str2, "%s,%hu",
- inet_ntoa(tp->st_dst.in4),
- ntohs(tp->st_dport));
- } else {
- sprintf(str1, "%s", inet_ntoa(tp->st_src.in4));
- sprintf(str2, "%s", inet_ntoa(tp->st_dst.in4));
- }
- winx++;
- move(winx, 0);
- printw("%-21s %-21s", str1, str2);
-
- /* print state */
- sprintf(str1, "%X/%X", tp->st_state[0],
- tp->st_state[1]);
- printw(" %3s", str1);
-
- /* print proto */
- proto = getprotobynumber(tp->st_p);
- if (proto) {
- strncpy(str1, proto->p_name, 4);
- str1[4] = '\0';
- } else {
- sprintf(str1, "%d", tp->st_p);
- }
- printw(" %4s", str1);
- /* print #pkt/#bytes */
-#ifdef USE_QUAD_T
- printw(" %7qu %9qu", (unsigned long long) tp->st_pkts,
- (unsigned long long) tp->st_bytes);
-#else
- printw(" %7lu %9lu", tp->st_pkts, tp->st_bytes);
-#endif
- printw(" %9s", ttl_to_string(tp->st_age));
-
- if (reverse)
- tp--;
- else
- tp++;
- }
-
- /* screen data structure is filled, now update the screen */
- if (redraw)
- clearok(stdscr,1);
-
- refresh();
- if (redraw) {
- clearok(stdscr,0);
- redraw = 0;
- }
-
- /* wait for key press or a 1 second time out period */
-#ifdef USE_POLL
- set[0].fd = 0;
- set[0].events = POLLIN;
- poll(set, 1, refreshtime * 1000);
-
- /* if key pressed, read all waiting keys */
- if (set[0].revents & POLLIN)
-#else
- selecttimeout.tv_sec = refreshtime;
- selecttimeout.tv_usec = 0;
- FD_ZERO(&readfd);
- FD_SET(0, &readfd);
- select(1, &readfd, NULL, NULL, &selecttimeout);
-
- /* if key pressed, read all waiting keys */
- if (FD_ISSET(0, &readfd))
-#endif
-
- {
- c = wgetch(stdscr);
- if (c == ERR)
- continue;
-
- if (isalpha(c) && isupper(c))
- c = tolower(c);
- if (c == 'l') {
- redraw = 1;
- } else if (c == 'q') {
- break; /* exits while() loop */
- } else if (c == 'r') {
- reverse = !reverse;
- } else if (c == 's') {
- sorting++;
- if (sorting > STSORT_MAX)
- sorting = 0;
- }
- }
- } /* while */
-
- printw("\n");
- nocbreak();
- endwin();
-}
-#endif
-
-
-/*
- * Show fragment cache information that's held in the kernel.
- */
-static void showfrstates(ifsp)
-ipfrstat_t *ifsp;
-{
- struct ipfr *ipfrtab[IPFT_SIZE], ifr;
- frentry_t fr;
- int i;
-
- /*
- * print out the numeric statistics
- */
- PRINTF("IP fragment states:\n\t%lu new\n\t%lu expired\n\t%lu hits\n",
- ifsp->ifs_new, ifsp->ifs_expire, ifsp->ifs_hits);
- PRINTF("\t%lu no memory\n\t%lu already exist\n",
- ifsp->ifs_nomem, ifsp->ifs_exists);
- PRINTF("\t%lu inuse\n", ifsp->ifs_inuse);
- if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_table, sizeof(ipfrtab)))
- return;
-
- /*
- * Print out the contents (if any) of the fragment cache table.
- */
- PRINTF("\n");
- for (i = 0; i < IPFT_SIZE; i++)
- while (ipfrtab[i]) {
- if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
- sizeof(ifr)) == -1)
- break;
- PRINTF("%s -> ", hostname(4, &ifr.ipfr_src));
- if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule,
- sizeof(fr)) == -1)
- break;
- PRINTF("%s id %d ttl %d pr %d seen0 %d ifp %p tos %#02x = fl %#x\n",
- hostname(4, &ifr.ipfr_dst), ntohs(ifr.ipfr_id),
- ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_seen0,
- ifr.ipfr_ifp, ifr.ipfr_tos, fr.fr_flags);
- ipfrtab[i] = ifr.ipfr_next;
- }
- if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_nattab,sizeof(ipfrtab)))
- return;
- for (i = 0; i < IPFT_SIZE; i++)
- while (ipfrtab[i]) {
- if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
- sizeof(ifr)) == -1)
- break;
- PRINTF("NAT: %s -> ", hostname(4, &ifr.ipfr_src));
- if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule,
- sizeof(fr)) == -1)
- break;
- PRINTF("%s %d %d %d %#02x = %#x\n",
- hostname(4, &ifr.ipfr_dst), ifr.ipfr_id,
- ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_tos,
- fr.fr_flags);
- ipfrtab[i] = ifr.ipfr_next;
- }
-}
-
-
-/*
- * Show stats on how auth within IPFilter has been used
- */
-static void showauthstates(asp)
-fr_authstat_t *asp;
-{
- frauthent_t *frap, fra;
-
-#ifdef USE_QUAD_T
- printf("Authorisation hits: %qu\tmisses %qu\n",
- (unsigned long long) asp->fas_hits,
- (unsigned long long) asp->fas_miss);
-#else
- printf("Authorisation hits: %ld\tmisses %ld\n", asp->fas_hits,
- asp->fas_miss);
-#endif
- printf("nospace %ld\nadded %ld\nsendfail %ld\nsendok %ld\n",
- asp->fas_nospace, asp->fas_added, asp->fas_sendfail,
- asp->fas_sendok);
- printf("queok %ld\nquefail %ld\nexpire %ld\n",
- asp->fas_queok, asp->fas_quefail, asp->fas_expire);
-
- frap = asp->fas_faelist;
- while (frap) {
- if (kmemcpy((char *)&fra, (u_long)frap, sizeof(fra)) == -1)
- break;
-
- printf("age %ld\t", fra.fae_age);
- printfr(&fra.fae_fr);
- frap = fra.fae_next;
- }
-}
-
-
-/*
- * Display groups used for each of filter rules, accounting rules and
- * authentication, separately.
- */
-static void showgroups(fiop)
-struct friostat *fiop;
-{
- static char *gnames[3] = { "Filter", "Accounting", "Authentication" };
- frgroup_t *fp, grp;
- int on, off, i;
-
- on = fiop->f_active;
- off = 1 - on;
-
- for (i = 0; i < 3; i++) {
- printf("%s groups (active):\n", gnames[i]);
- for (fp = fiop->f_groups[i][on]; fp; fp = grp.fg_next)
- if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
- break;
- else
- printf("%hu\n", grp.fg_num);
- printf("%s groups (inactive):\n", gnames[i]);
- for (fp = fiop->f_groups[i][off]; fp; fp = grp.fg_next)
- if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
- break;
- else
- printf("%hu\n", grp.fg_num);
- }
-}
-
-static void parse_ipportstr(argument, ip, port)
-const char *argument;
-struct in_addr *ip;
-int *port;
-{
-
- char *s, *comma;
-
- /* make working copy of argument, Theoretically you must be able
- * to write to optarg, but that seems very ugly to me....
- */
- if ((s = malloc(strlen(argument) + 1)) == NULL)
- perror("malloc");
- strcpy(s, argument);
-
- /* get port */
- if ((comma = strchr(s, ',')) != NULL) {
- if (!strcasecmp(s, "any")) {
- *port = -1;
- } else if (!sscanf(comma + 1, "%d", port) ||
- (*port < 0) || (*port > 65535)) {
- fprintf(stderr, "Invalid port specfication in %s\n",
- argument);
- exit(-2);
- }
- *comma = '\0';
- }
-
-
- /* get ip address */
- if (!strcasecmp(s, "any")) {
- ip->s_addr = INADDR_ANY;
- } else if (!inet_aton(s, ip)) {
- fprintf(stderr, "Invalid IP address: %s\n", s);
- exit(-2);
- }
-
- /* free allocated memory */
- free(s);
-}
-
-
-#ifdef STATETOP
-static char ttlbuf[STSTRSIZE];
-
-static char *ttl_to_string(ttl)
-long int ttl;
-{
-
- int hours, minutes, seconds;
-
- /* ttl is in half seconds */
- ttl /= 2;
-
- hours = ttl / 3600;
- ttl = ttl % 3600;
- minutes = ttl / 60;
- seconds = ttl % 60;
-
- if (hours > 0 )
- sprintf(ttlbuf, "%2d:%02d:%02d", hours, minutes, seconds);
- else
- sprintf(ttlbuf, "%2d:%02d", minutes, seconds);
- return ttlbuf;
-}
-
-
-static int sort_pkts(a, b)
-const void *a;
-const void *b;
-{
-
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ap->st_pkts == bp->st_pkts)
- return 0;
- else if (ap->st_pkts < bp->st_pkts)
- return 1;
- return -1;
-}
-
-
-static int sort_bytes(a, b)
-const void *a;
-const void *b;
-{
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ap->st_bytes == bp->st_bytes)
- return 0;
- else if (ap->st_bytes < bp->st_bytes)
- return 1;
- return -1;
-}
-
-
-static int sort_p(a, b)
-const void *a;
-const void *b;
-{
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ap->st_p == bp->st_p)
- return 0;
- else if (ap->st_p < bp->st_p)
- return 1;
- return -1;
-}
-
-
-static int sort_ttl(a, b)
-const void *a;
-const void *b;
-{
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ap->st_age == bp->st_age)
- return 0;
- else if (ap->st_age < bp->st_age)
- return 1;
- return -1;
-}
-
-static int sort_srcip(a, b)
-const void *a;
-const void *b;
-{
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ntohl(ap->st_src.in4.s_addr) == ntohl(bp->st_src.in4.s_addr))
- return 0;
- else if (ntohl(ap->st_src.in4.s_addr) > ntohl(bp->st_src.in4.s_addr))
- return 1;
- return -1;
-}
-
-static int sort_dstip(a, b)
-const void *a;
-const void *b;
-{
- register const statetop_t *ap = a;
- register const statetop_t *bp = b;
-
- if (ntohl(ap->st_dst.in4.s_addr) == ntohl(bp->st_dst.in4.s_addr))
- return 0;
- else if (ntohl(ap->st_dst.in4.s_addr) > ntohl(bp->st_dst.in4.s_addr))
- return 1;
- return -1;
-}
-#endif
diff --git a/contrib/ipfilter/inet_addr.c b/contrib/ipfilter/inet_addr.c
deleted file mode 100644
index e940280a280a..000000000000
--- a/contrib/ipfilter/inet_addr.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * ++Copyright++ 1983, 1990, 1993
- * -
- * Copyright (c) 1983, 1990, 1993
- * The Regents of the University of California. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- * must display the following acknowledgement:
- * This product includes software developed by the University of
- * California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- * may be used to endorse or promote products derived from this software
- * without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * -
- * Portions Copyright (c) 1993 by Digital Equipment Corporation.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies, and that
- * the name of Digital Equipment Corporation not be used in advertising or
- * publicity pertaining to distribution of the document or software without
- * specific, written prior permission.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT
- * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
- * -
- * --Copyright--
- */
-#ifdef __STDC__
-# ifndef __P
-# define __P(x) x
-# endif
-#else
-# undef __P
-# define __P(x) ()
-# undef const
-# define const
-#endif
-
-#if !defined(lint)
-static const char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93";
-static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1.4.2 2002/02/22 15:32:46 darrenr Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <ctype.h>
-
-int inet_aton __P((const char *, struct in_addr *));
-
-/*
- * Check whether "cp" is a valid ascii representation
- * of an Internet address and convert to a binary address.
- * Returns 1 if the address is valid, 0 if not.
- * This replaces inet_addr, the return value from which
- * cannot distinguish between failure and a local broadcast address.
- */
-int
-inet_aton(cp, addr)
- register const char *cp;
- struct in_addr *addr;
-{
- register u_long val;
- register int base, n;
- register char c;
- u_int parts[4];
- register u_int *pp = parts;
-
- c = *cp;
- for (;;) {
- /*
- * Collect number up to ``.''.
- * Values are specified as for C:
- * 0x=hex, 0=octal, isdigit=decimal.
- */
- if (!isdigit(c))
- return (0);
- val = 0; base = 10;
- if (c == '0') {
- c = *++cp;
- if (c == 'x' || c == 'X')
- base = 16, c = *++cp;
- else
- base = 8;
- }
- for (;;) {
- if (isascii(c) && isdigit(c)) {
- val = (val * base) + (c - '0');
- c = *++cp;
- } else if (base == 16 && isascii(c) && isxdigit(c)) {
- val = (val << 4) |
- (c + 10 - (islower(c) ? 'a' : 'A'));
- c = *++cp;
- } else
- break;
- }
- if (c == '.') {
- /*
- * Internet format:
- * a.b.c.d
- * a.b.c (with c treated as 16 bits)
- * a.b (with b treated as 24 bits)
- */
- if (pp >= parts + 3)
- return (0);
- *pp++ = val;
- c = *++cp;
- } else
- break;
- }
- /*
- * Check for trailing characters.
- */
- if (c != '\0' && (!isascii(c) || !isspace(c)))
- return (0);
- /*
- * Concoct the address according to
- * the number of parts specified.
- */
- n = pp - parts + 1;
- switch (n) {
-
- case 0:
- return (0); /* initial nondigit */
-
- case 1: /* a -- 32 bits */
- break;
-
- case 2: /* a.b -- 8.24 bits */
- if (val > 0xffffff)
- return (0);
- val |= parts[0] << 24;
- break;
-
- case 3: /* a.b.c -- 8.8.16 bits */
- if (val > 0xffff)
- return (0);
- val |= (parts[0] << 24) | (parts[1] << 16);
- break;
-
- case 4: /* a.b.c.d -- 8.8.8.8 bits */
- if (val > 0xff)
- return (0);
- val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
- break;
- }
- if (addr)
- addr->s_addr = htonl(val);
- return (1);
-}
-
-/* these are compatibility routines, not needed on recent BSD releases */
-
-/*
- * Ascii internet address interpretation routine.
- * The value returned is in network order.
- */
-#if (defined(SOLARIS2) && (SOLARIS2 > 5)) || \
- (defined(IRIX) && (IRIX >= 605))
-in_addr_t
-#else
-u_long
-#endif
-inet_addr(cp)
- register const char *cp;
-{
- struct in_addr val;
-
- if (inet_aton(cp, &val))
- return (val.s_addr);
- return (0xffffffff);
-}
diff --git a/contrib/ipfilter/ip_auth.c b/contrib/ipfilter/ip_auth.c
deleted file mode 100644
index b91c2e6245c0..000000000000
--- a/contrib/ipfilter/ip_auth.c
+++ /dev/null
@@ -1,804 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1998-2003 by Darren Reed & Guido van Rooij.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#if defined(KERNEL) || defined(_KERNEL)
-# undef KERNEL
-# undef _KERNEL
-# define KERNEL 1
-# define _KERNEL 1
-#endif
-#include <sys/errno.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/file.h>
-#if !defined(_KERNEL)
-# include <stdio.h>
-# include <stdlib.h>
-# include <string.h>
-# define _KERNEL
-# ifdef __OpenBSD__
-struct file;
-# endif
-# include <sys/uio.h>
-# undef _KERNEL
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 220000)
-# include <sys/filio.h>
-# include <sys/fcntl.h>
-#else
-# include <sys/ioctl.h>
-#endif
-#if !defined(linux)
-# include <sys/protosw.h>
-#endif
-#include <sys/socket.h>
-#if defined(_KERNEL)
-# include <sys/systm.h>
-# if !defined(__SVR4) && !defined(__svr4__) && !defined(linux)
-# include <sys/mbuf.h>
-# endif
-#endif
-#if defined(__SVR4) || defined(__svr4__)
-# include <sys/filio.h>
-# include <sys/byteorder.h>
-# ifdef _KERNEL
-# include <sys/dditypes.h>
-# endif
-# include <sys/stream.h>
-# include <sys/kmem.h>
-#endif
-#if (_BSDI_VERSION >= 199802) || (__FreeBSD_version >= 400000)
-# include <sys/queue.h>
-#endif
-#if defined(__NetBSD__) || defined(__OpenBSD__) || defined(bsdi)
-# include <machine/cpu.h>
-#endif
-#if defined(_KERNEL) && defined(__NetBSD__) && (__NetBSD_Version__ >= 104000000)
-# include <sys/proc.h>
-#endif
-#include <net/if.h>
-#ifdef sun
-# include <net/af.h>
-#endif
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#if !defined(_KERNEL) && !defined(__osf__) && !defined(__sgi)
-# define KERNEL
-# define _KERNEL
-# define NOT_KERNEL
-#endif
-#if !defined(linux)
-# include <netinet/ip_var.h>
-#endif
-#ifdef NOT_KERNEL
-# undef _KERNEL
-# undef KERNEL
-#endif
-#include <netinet/tcp.h>
-#if defined(IRIX) && (IRIX < 60516) /* IRIX < 6 */
-extern struct ifqueue ipintrq; /* ip packet input queue */
-#else
-# if !defined(__hpux) && !defined(linux)
-# if __FreeBSD_version >= 300000
-# include <net/if_var.h>
-# if __FreeBSD_version >= 500042
-# define IF_QFULL _IF_QFULL
-# define IF_DROP _IF_DROP
-# endif /* __FreeBSD_version >= 500042 */
-# endif
-# include <netinet/in_var.h>
-# include <netinet/tcp_fsm.h>
-# endif
-#endif
-#include <netinet/udp.h>
-#include <netinet/ip_icmp.h>
-#include "netinet/ip_compat.h"
-#include <netinet/tcpip.h>
-#include "netinet/ip_fil.h"
-#include "netinet/ip_auth.h"
-#if !defined(MENTAT) && !defined(linux)
-# include <net/netisr.h>
-# ifdef __FreeBSD__
-# include <machine/cpufunc.h>
-# endif
-#endif
-#if (__FreeBSD_version >= 300000)
-# include <sys/malloc.h>
-# if defined(_KERNEL) && !defined(IPFILTER_LKM)
-# include <sys/libkern.h>
-# include <sys/systm.h>
-# endif
-#endif
-/* END OF INCLUDES */
-
-#if !defined(lint)
-static const char rcsid[] = "@(#)Id: ip_auth.c,v 2.73.2.3 2004/08/26 11:25:21 darrenr Exp";
-#endif
-
-
-#if SOLARIS
-extern kcondvar_t ipfauthwait;
-#endif /* SOLARIS */
-#if defined(linux) && defined(_KERNEL)
-wait_queue_head_t fr_authnext_linux;
-#endif
-
-int fr_authsize = FR_NUMAUTH;
-int fr_authused = 0;
-int fr_defaultauthage = 600;
-int fr_auth_lock = 0;
-int fr_auth_init = 0;
-fr_authstat_t fr_authstats;
-static frauth_t *fr_auth = NULL;
-mb_t **fr_authpkts = NULL;
-int fr_authstart = 0, fr_authend = 0, fr_authnext = 0;
-frauthent_t *fae_list = NULL;
-frentry_t *ipauth = NULL,
- *fr_authlist = NULL;
-
-
-int fr_authinit()
-{
- KMALLOCS(fr_auth, frauth_t *, fr_authsize * sizeof(*fr_auth));
- if (fr_auth != NULL)
- bzero((char *)fr_auth, fr_authsize * sizeof(*fr_auth));
- else
- return -1;
-
- KMALLOCS(fr_authpkts, mb_t **, fr_authsize * sizeof(*fr_authpkts));
- if (fr_authpkts != NULL)
- bzero((char *)fr_authpkts, fr_authsize * sizeof(*fr_authpkts));
- else
- return -2;
-
- MUTEX_INIT(&ipf_authmx, "ipf auth log mutex");
- RWLOCK_INIT(&ipf_auth, "ipf IP User-Auth rwlock");
-#if SOLARIS && defined(_KERNEL)
- cv_init(&ipfauthwait, "ipf auth condvar", CV_DRIVER, NULL);
-#endif
-#if defined(linux) && defined(_KERNEL)
- init_waitqueue_head(&fr_authnext_linux);
-#endif
-
- fr_auth_init = 1;
-
- return 0;
-}
-
-
-/*
- * Check if a packet has authorization. If the packet is found to match an
- * authorization result and that would result in a feedback loop (i.e. it
- * will end up returning FR_AUTH) then return FR_BLOCK instead.
- */
-frentry_t *fr_checkauth(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- frentry_t *fr;
- frauth_t *fra;
- u_32_t pass;
- u_short id;
- ip_t *ip;
- int i;
-
- if (fr_auth_lock || !fr_authused)
- return NULL;
-
- ip = fin->fin_ip;
- id = ip->ip_id;
-
- READ_ENTER(&ipf_auth);
- for (i = fr_authstart; i != fr_authend; ) {
- /*
- * index becomes -2 only after an SIOCAUTHW. Check this in
- * case the same packet gets sent again and it hasn't yet been
- * auth'd.
- */
- fra = fr_auth + i;
- if ((fra->fra_index == -2) && (id == fra->fra_info.fin_id) &&
- !bcmp((char *)fin, (char *)&fra->fra_info, FI_CSIZE)) {
- /*
- * Avoid feedback loop.
- */
- if (!(pass = fra->fra_pass) || (FR_ISAUTH(pass)))
- pass = FR_BLOCK;
- /*
- * Create a dummy rule for the stateful checking to
- * use and return. Zero out any values we don't
- * trust from userland!
- */
- if ((pass & FR_KEEPSTATE) || ((pass & FR_KEEPFRAG) &&
- (fin->fin_flx & FI_FRAG))) {
- KMALLOC(fr, frentry_t *);
- if (fr) {
- bcopy((char *)fra->fra_info.fin_fr,
- (char *)fr, sizeof(*fr));
- fr->fr_grp = NULL;
- fr->fr_ifa = fin->fin_ifp;
- fr->fr_func = NULL;
- fr->fr_ref = 1;
- fr->fr_flags = pass;
- fr->fr_ifas[1] = NULL;
- fr->fr_ifas[2] = NULL;
- fr->fr_ifas[3] = NULL;
- }
- } else
- fr = fra->fra_info.fin_fr;
- fin->fin_fr = fr;
- RWLOCK_EXIT(&ipf_auth);
- WRITE_ENTER(&ipf_auth);
- if ((fr != NULL) && (fr != fra->fra_info.fin_fr)) {
- fr->fr_next = fr_authlist;
- fr_authlist = fr;
- }
- fr_authstats.fas_hits++;
- fra->fra_index = -1;
- fr_authused--;
- if (i == fr_authstart) {
- while (fra->fra_index == -1) {
- i++;
- fra++;
- if (i == fr_authsize) {
- i = 0;
- fra = fr_auth;
- }
- fr_authstart = i;
- if (i == fr_authend)
- break;
- }
- if (fr_authstart == fr_authend) {
- fr_authnext = 0;
- fr_authstart = fr_authend = 0;
- }
- }
- RWLOCK_EXIT(&ipf_auth);
- if (passp != NULL)
- *passp = pass;
- ATOMIC_INC64(fr_authstats.fas_hits);
- return fr;
- }
- i++;
- if (i == fr_authsize)
- i = 0;
- }
- fr_authstats.fas_miss++;
- RWLOCK_EXIT(&ipf_auth);
- ATOMIC_INC64(fr_authstats.fas_miss);
- return NULL;
-}
-
-
-/*
- * Check if we have room in the auth array to hold details for another packet.
- * If we do, store it and wake up any user programs which are waiting to
- * hear about these events.
- */
-int fr_newauth(m, fin)
-mb_t *m;
-fr_info_t *fin;
-{
-#if defined(_KERNEL) && defined(MENTAT)
- qpktinfo_t *qpi = fin->fin_qpi;
-#endif
- frauth_t *fra;
-#if !defined(sparc) && !defined(m68k)
- ip_t *ip;
-#endif
- int i;
-
- if (fr_auth_lock)
- return 0;
-
- WRITE_ENTER(&ipf_auth);
- if (fr_authstart > fr_authend) {
- fr_authstats.fas_nospace++;
- RWLOCK_EXIT(&ipf_auth);
- return 0;
- } else {
- if (fr_authused == fr_authsize) {
- fr_authstats.fas_nospace++;
- RWLOCK_EXIT(&ipf_auth);
- return 0;
- }
- }
-
- fr_authstats.fas_added++;
- fr_authused++;
- i = fr_authend++;
- if (fr_authend == fr_authsize)
- fr_authend = 0;
- RWLOCK_EXIT(&ipf_auth);
-
- fra = fr_auth + i;
- fra->fra_index = i;
- fra->fra_pass = 0;
- fra->fra_age = fr_defaultauthage;
- bcopy((char *)fin, (char *)&fra->fra_info, sizeof(*fin));
-#if !defined(sparc) && !defined(m68k)
- /*
- * No need to copyback here as we want to undo the changes, not keep
- * them.
- */
- ip = fin->fin_ip;
-# if defined(MENTAT) && defined(_KERNEL)
- if ((ip == (ip_t *)m->b_rptr) && (fin->fin_v == 4))
-# endif
- {
- register u_short bo;
-
- bo = ip->ip_len;
- ip->ip_len = htons(bo);
- bo = ip->ip_off;
- ip->ip_off = htons(bo);
- }
-#endif
-#if SOLARIS && defined(_KERNEL)
- m->b_rptr -= qpi->qpi_off;
- fr_authpkts[i] = *(mblk_t **)fin->fin_mp;
- fra->fra_q = qpi->qpi_q; /* The queue can disappear! */
- cv_signal(&ipfauthwait);
-#else
-# if defined(BSD) && !defined(sparc) && (BSD >= 199306)
- if (!fin->fin_out) {
- ip->ip_len = htons(ip->ip_len);
- ip->ip_off = htons(ip->ip_off);
- }
-# endif
- fr_authpkts[i] = m;
- WAKEUP(&fr_authnext,0);
-#endif
- return 1;
-}
-
-
-int fr_auth_ioctl(data, cmd, mode)
-caddr_t data;
-ioctlcmd_t cmd;
-int mode;
-{
- mb_t *m;
-#if defined(_KERNEL) && !defined(MENTAT) && !defined(linux) && \
- (!defined(__FreeBSD_version) || (__FreeBSD_version < 501000))
- struct ifqueue *ifq;
-# ifdef USE_SPL
- int s;
-# endif /* USE_SPL */
-#endif
- frauth_t auth, *au = &auth, *fra;
- int i, error = 0, len;
- char *t;
-
- switch (cmd)
- {
- case SIOCSTLCK :
- if (!(mode & FWRITE)) {
- error = EPERM;
- break;
- }
- fr_lock(data, &fr_auth_lock);
- break;
-
- case SIOCATHST:
- fr_authstats.fas_faelist = fae_list;
- error = fr_outobj(data, &fr_authstats, IPFOBJ_AUTHSTAT);
- break;
-
- case SIOCIPFFL:
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- i = fr_authflush();
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
- error = copyoutptr((char *)&i, data, sizeof(i));
- break;
-
- case SIOCAUTHW:
-fr_authioctlloop:
- error = fr_inobj(data, au, IPFOBJ_FRAUTH);
- READ_ENTER(&ipf_auth);
- if ((fr_authnext != fr_authend) && fr_authpkts[fr_authnext]) {
- error = fr_outobj(data, &fr_auth[fr_authnext],
- IPFOBJ_FRAUTH);
- if (auth.fra_len != 0 && auth.fra_buf != NULL) {
- /*
- * Copy packet contents out to user space if
- * requested. Bail on an error.
- */
- m = fr_authpkts[fr_authnext];
- len = MSGDSIZE(m);
- if (len > auth.fra_len)
- len = auth.fra_len;
- auth.fra_len = len;
- for (t = auth.fra_buf; m && (len > 0); ) {
- i = MIN(M_LEN(m), len);
- error = copyoutptr(MTOD(m, char *),
- t, i);
- len -= i;
- t += i;
- if (error != 0)
- break;
- }
- }
- RWLOCK_EXIT(&ipf_auth);
- if (error != 0)
- break;
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- fr_authnext++;
- if (fr_authnext == fr_authsize)
- fr_authnext = 0;
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
- return 0;
- }
- RWLOCK_EXIT(&ipf_auth);
- /*
- * We exit ipf_global here because a program that enters in
- * here will have a lock on it and goto sleep having this lock.
- * If someone were to do an 'ipf -D' the system would then
- * deadlock. The catch with releasing it here is that the
- * caller of this function expects it to be held when we
- * return so we have to reacquire it in here.
- */
- RWLOCK_EXIT(&ipf_global);
-
- MUTEX_ENTER(&ipf_authmx);
-#ifdef _KERNEL
-# if SOLARIS
- error = 0;
- if (!cv_wait_sig(&ipfauthwait, &ipf_authmx.ipf_lk))
- error = EINTR;
-# else /* SOLARIS */
-# ifdef __hpux
- {
- lock_t *l;
-
- l = get_sleep_lock(&fr_authnext);
- error = sleep(&fr_authnext, PZERO+1);
- spinunlock(l);
- }
-# else
-# ifdef __osf__
- error = mpsleep(&fr_authnext, PSUSP|PCATCH, "fr_authnext", 0,
- &ipf_authmx, MS_LOCK_SIMPLE);
-# else
- error = SLEEP(&fr_authnext, "fr_authnext");
-# endif /* __osf__ */
-# endif /* __hpux */
-# endif /* SOLARIS */
-#endif
- MUTEX_EXIT(&ipf_authmx);
- READ_ENTER(&ipf_global);
- if (error == 0) {
- READ_ENTER(&ipf_auth);
- goto fr_authioctlloop;
- }
- break;
-
- case SIOCAUTHR:
- error = fr_inobj(data, &auth, IPFOBJ_FRAUTH);
- if (error != 0)
- return error;
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- i = au->fra_index;
- fra = fr_auth + i;
- if ((i < 0) || (i >= fr_authsize) ||
- (fra->fra_info.fin_id != au->fra_info.fin_id)) {
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
- return ESRCH;
- }
- m = fr_authpkts[i];
- fra->fra_index = -2;
- fra->fra_pass = au->fra_pass;
- fr_authpkts[i] = NULL;
- RWLOCK_EXIT(&ipf_auth);
-#ifdef _KERNEL
- if ((m != NULL) && (au->fra_info.fin_out != 0)) {
-# ifdef MENTAT
- error = !putq(fra->fra_q, m);
-# else /* MENTAT */
-# ifdef linux
-# else
-# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__) || \
- (defined(__sgi) && (IRIX >= 60500) || \
- (defined(__FreeBSD__) && (__FreeBSD_version >= 470102)))
- error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
- NULL);
-# else
- error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL);
-# endif
-# endif /* Linux */
-# endif /* MENTAT */
- if (error != 0)
- fr_authstats.fas_sendfail++;
- else
- fr_authstats.fas_sendok++;
- } else if (m) {
-# ifdef MENTAT
- error = !putq(fra->fra_q, m);
-# else /* MENTAT */
-# ifdef linux
-# else
-# if __FreeBSD_version >= 501000
- netisr_dispatch(NETISR_IP, m);
-# else
-# if IRIX >= 60516
- ifq = &((struct ifnet *)fra->fra_info.fin_ifp)->if_snd;
-# else
- ifq = &ipintrq;
-# endif
- if (IF_QFULL(ifq)) {
- IF_DROP(ifq);
- FREE_MB_T(m);
- error = ENOBUFS;
- } else {
- IF_ENQUEUE(ifq, m);
-# if IRIX < 60500
- schednetisr(NETISR_IP);
-# endif
- }
-# endif
-# endif /* Linux */
-# endif /* MENTAT */
- if (error != 0)
- fr_authstats.fas_quefail++;
- else
- fr_authstats.fas_queok++;
- } else
- error = EINVAL;
-# ifdef MENTAT
- if (error != 0)
- error = EINVAL;
-# else /* MENTAT */
- /*
- * If we experience an error which will result in the packet
- * not being processed, make sure we advance to the next one.
- */
- if (error == ENOBUFS) {
- fr_authused--;
- fra->fra_index = -1;
- fra->fra_pass = 0;
- if (i == fr_authstart) {
- while (fra->fra_index == -1) {
- i++;
- if (i == fr_authsize)
- i = 0;
- fr_authstart = i;
- if (i == fr_authend)
- break;
- }
- if (fr_authstart == fr_authend) {
- fr_authnext = 0;
- fr_authstart = fr_authend = 0;
- }
- }
- }
-# endif /* MENTAT */
-#endif /* _KERNEL */
- SPL_X(s);
- break;
-
- default :
- error = EINVAL;
- break;
- }
- return error;
-}
-
-
-/*
- * Free all network buffer memory used to keep saved packets.
- */
-void fr_authunload()
-{
- register int i;
- register frauthent_t *fae, **faep;
- frentry_t *fr, **frp;
- mb_t *m;
-
- if (fr_auth != NULL) {
- KFREES(fr_auth, fr_authsize * sizeof(*fr_auth));
- fr_auth = NULL;
- }
-
- if (fr_authpkts != NULL) {
- for (i = 0; i < fr_authsize; i++) {
- m = fr_authpkts[i];
- if (m != NULL) {
- FREE_MB_T(m);
- fr_authpkts[i] = NULL;
- }
- }
- KFREES(fr_authpkts, fr_authsize * sizeof(*fr_authpkts));
- fr_authpkts = NULL;
- }
-
- faep = &fae_list;
- while ((fae = *faep) != NULL) {
- *faep = fae->fae_next;
- KFREE(fae);
- }
- ipauth = NULL;
-
- if (fr_authlist != NULL) {
- for (frp = &fr_authlist; ((fr = *frp) != NULL); ) {
- if (fr->fr_ref == 1) {
- *frp = fr->fr_next;
- KFREE(fr);
- } else
- frp = &fr->fr_next;
- }
- }
-
- if (fr_auth_init == 1) {
-# if SOLARIS && defined(_KERNEL)
- cv_destroy(&ipfauthwait);
-# endif
- MUTEX_DESTROY(&ipf_authmx);
- RW_DESTROY(&ipf_auth);
-
- fr_auth_init = 0;
- }
-}
-
-
-/*
- * Slowly expire held auth records. Timeouts are set
- * in expectation of this being called twice per second.
- */
-void fr_authexpire()
-{
- register int i;
- register frauth_t *fra;
- register frauthent_t *fae, **faep;
- register frentry_t *fr, **frp;
- mb_t *m;
-# if !defined(MENAT) && defined(_KERNEL) && defined(USE_SPL)
- int s;
-# endif
-
- if (fr_auth_lock)
- return;
-
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- for (i = 0, fra = fr_auth; i < fr_authsize; i++, fra++) {
- fra->fra_age--;
- if ((fra->fra_age == 0) && (m = fr_authpkts[i])) {
- FREE_MB_T(m);
- fr_authpkts[i] = NULL;
- fr_auth[i].fra_index = -1;
- fr_authstats.fas_expire++;
- fr_authused--;
- }
- }
-
- for (faep = &fae_list; ((fae = *faep) != NULL); ) {
- fae->fae_age--;
- if (fae->fae_age == 0) {
- *faep = fae->fae_next;
- KFREE(fae);
- fr_authstats.fas_expire++;
- } else
- faep = &fae->fae_next;
- }
- if (fae_list != NULL)
- ipauth = &fae_list->fae_fr;
- else
- ipauth = NULL;
-
- for (frp = &fr_authlist; ((fr = *frp) != NULL); ) {
- if (fr->fr_ref == 1) {
- *frp = fr->fr_next;
- KFREE(fr);
- } else
- frp = &fr->fr_next;
- }
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
-}
-
-int fr_preauthcmd(cmd, fr, frptr)
-ioctlcmd_t cmd;
-frentry_t *fr, **frptr;
-{
- frauthent_t *fae, **faep;
- int error = 0;
-# if !defined(MENAT) && defined(_KERNEL) && defined(USE_SPL)
- int s;
-#endif
-
- if ((cmd != SIOCADAFR) && (cmd != SIOCRMAFR))
- return EIO;
-
- for (faep = &fae_list; ((fae = *faep) != NULL); ) {
- if (&fae->fae_fr == fr)
- break;
- else
- faep = &fae->fae_next;
- }
-
- if (cmd == (ioctlcmd_t)SIOCRMAFR) {
- if (fr == NULL || frptr == NULL)
- error = EINVAL;
- else if (fae == NULL)
- error = ESRCH;
- else {
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- *faep = fae->fae_next;
- if (ipauth == &fae->fae_fr)
- ipauth = fae_list ? &fae_list->fae_fr : NULL;
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
-
- KFREE(fae);
- }
- } else if (fr != NULL && frptr != NULL) {
- KMALLOC(fae, frauthent_t *);
- if (fae != NULL) {
- bcopy((char *)fr, (char *)&fae->fae_fr,
- sizeof(*fr));
- SPL_NET(s);
- WRITE_ENTER(&ipf_auth);
- fae->fae_age = fr_defaultauthage;
- fae->fae_fr.fr_hits = 0;
- fae->fae_fr.fr_next = *frptr;
- *frptr = &fae->fae_fr;
- fae->fae_next = *faep;
- *faep = fae;
- ipauth = &fae_list->fae_fr;
- RWLOCK_EXIT(&ipf_auth);
- SPL_X(s);
- } else
- error = ENOMEM;
- } else
- error = EINVAL;
- return error;
-}
-
-
-/*
- * Flush held packets.
- * Must already be properly SPL'ed and Locked on &ipf_auth.
- *
- */
-int fr_authflush()
-{
- register int i, num_flushed;
- mb_t *m;
-
- if (fr_auth_lock)
- return -1;
-
- num_flushed = 0;
-
- for (i = 0 ; i < fr_authsize; i++) {
- m = fr_authpkts[i];
- if (m != NULL) {
- FREE_MB_T(m);
- fr_authpkts[i] = NULL;
- fr_auth[i].fra_index = -1;
- /* perhaps add & use a flush counter inst.*/
- fr_authstats.fas_expire++;
- fr_authused--;
- num_flushed++;
- }
- }
-
- fr_authstart = 0;
- fr_authend = 0;
- fr_authnext = 0;
-
- return num_flushed;
-}
diff --git a/contrib/ipfilter/ip_auth.h b/contrib/ipfilter/ip_auth.h
deleted file mode 100644
index a39e7fd823f1..000000000000
--- a/contrib/ipfilter/ip_auth.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1997-2001 by Darren Reed & Guido Van Rooij.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- *
- * Id: ip_auth.h,v 2.16 2003/07/25 12:29:56 darrenr Exp
- *
- */
-#ifndef __IP_AUTH_H__
-#define __IP_AUTH_H__
-
-#define FR_NUMAUTH 32
-
-typedef struct frauth {
- int fra_age;
- int fra_len;
- int fra_index;
- u_32_t fra_pass;
- fr_info_t fra_info;
- char *fra_buf;
-#ifdef MENTAT
- queue_t *fra_q;
-#endif
-} frauth_t;
-
-typedef struct frauthent {
- struct frentry fae_fr;
- struct frauthent *fae_next;
- u_long fae_age;
-} frauthent_t;
-
-typedef struct fr_authstat {
- U_QUAD_T fas_hits;
- U_QUAD_T fas_miss;
- u_long fas_nospace;
- u_long fas_added;
- u_long fas_sendfail;
- u_long fas_sendok;
- u_long fas_queok;
- u_long fas_quefail;
- u_long fas_expire;
- frauthent_t *fas_faelist;
-} fr_authstat_t;
-
-
-extern frentry_t *ipauth;
-extern struct fr_authstat fr_authstats;
-extern int fr_defaultauthage;
-extern int fr_authstart;
-extern int fr_authend;
-extern int fr_authsize;
-extern int fr_authused;
-extern int fr_auth_lock;
-extern frentry_t *fr_checkauth __P((fr_info_t *, u_32_t *));
-extern void fr_authexpire __P((void));
-extern int fr_authinit __P((void));
-extern void fr_authunload __P((void));
-extern int fr_authflush __P((void));
-extern mb_t **fr_authpkts;
-extern int fr_newauth __P((mb_t *, fr_info_t *));
-extern int fr_preauthcmd __P((ioctlcmd_t, frentry_t *, frentry_t **));
-extern int fr_auth_ioctl __P((caddr_t, ioctlcmd_t, int));
-
-#endif /* __IP_AUTH_H__ */
diff --git a/contrib/ipfilter/ip_compat.h b/contrib/ipfilter/ip_compat.h
deleted file mode 100644
index 6ea3f709a558..000000000000
--- a/contrib/ipfilter/ip_compat.h
+++ /dev/null
@@ -1,2295 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2001, 2003 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- *
- * @(#)ip_compat.h 1.8 1/14/96
- * Id: ip_compat.h,v 2.142.2.25 2005/03/28 09:33:36 darrenr Exp
- */
-
-#ifndef __IP_COMPAT_H__
-#define __IP_COMPAT_H__
-
-#ifndef __P
-# ifdef __STDC__
-# define __P(x) x
-# else
-# define __P(x) ()
-# endif
-#endif
-#ifndef __STDC__
-# undef const
-# define const
-#endif
-
-#if defined(_KERNEL) || defined(KERNEL) || defined(__KERNEL__)
-# undef KERNEL
-# undef _KERNEL
-# undef __KERNEL__
-# define KERNEL
-# define _KERNEL
-# define __KERNEL__
-#endif
-
-#ifndef SOLARIS
-#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
-#endif
-#if SOLARIS2 >= 8
-# ifndef USE_INET6
-# define USE_INET6
-# endif
-#endif
-#if defined(__FreeBSD_version) && (__FreeBSD_version >= 400000) && \
- !defined(_KERNEL) && !defined(USE_INET6) && !defined(NOINET6)
-# define USE_INET6
-#endif
-#if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105000000) && \
- !defined(_KERNEL) && !defined(USE_INET6)
-# define USE_INET6
-# define IPFILTER_M_IPFILTER
-#endif
-#if defined(OpenBSD) && (OpenBSD >= 200206) && \
- !defined(_KERNEL) && !defined(USE_INET6)
-# define USE_INET6
-#endif
-#if defined(__osf__)
-# define USE_INET6
-#endif
-#if defined(linux) && (!defined(_KERNEL) || defined(CONFIG_IPV6))
-# define USE_INET6
-#endif
-#if defined(HPUXREV) && (HPUXREV >= 1111)
-# define USE_INET6
-#endif
-
-#if defined(BSD) && (BSD < 199103) && defined(__osf__)
-# undef BSD
-# define BSD 199103
-#endif
-
-#if defined(__SVR4) || defined(__svr4__) || defined(__sgi)
-# define index strchr
-# if !defined(_KERNEL)
-# define bzero(a,b) memset(a,0,b)
-# define bcmp memcmp
-# define bcopy(a,b,c) memmove(b,a,c)
-# endif
-#endif
-
-#ifndef LIFNAMSIZ
-# ifdef IF_NAMESIZE
-# define LIFNAMSIZ IF_NAMESIZE
-# else
-# ifdef IFNAMSIZ
-# define LIFNAMSIZ IFNAMSIZ
-# else
-# define LIFNAMSIZ 16
-# endif
-# endif
-#endif
-
-#if defined(__sgi) || defined(bsdi) || defined(__hpux) || defined(hpux)
-struct ether_addr {
- u_char ether_addr_octet[6];
-};
-#endif
-
-#if defined(__sgi) && !defined(IPFILTER_LKM)
-# ifdef __STDC__
-# define IPL_EXTERN(ep) ipfilter##ep
-# else
-# define IPL_EXTERN(ep) ipfilter/**/ep
-# endif
-#else
-# ifdef __STDC__
-# define IPL_EXTERN(ep) ipl##ep
-# else
-# define IPL_EXTERN(ep) ipl/**/ep
-# endif
-#endif
-
-/*
- * This is a workaround for <sys/uio.h> troubles on FreeBSD and OpenBSD.
- */
-#ifndef linux
-# ifndef _KERNEL
-# define ADD_KERNEL
-# define _KERNEL
-# define KERNEL
-# endif
-# ifdef __OpenBSD__
-struct file;
-# endif
-# include <sys/uio.h>
-# ifdef ADD_KERNEL
-# undef _KERNEL
-# undef KERNEL
-# endif
-#endif
-
-
-/* ----------------------------------------------------------------------- */
-/* S O L A R I S */
-/* ----------------------------------------------------------------------- */
-#if SOLARIS
-# define MENTAT 1
-# include <sys/cmn_err.h>
-# include <sys/isa_defs.h>
-# include <sys/stream.h>
-# include <sys/ioccom.h>
-# include <sys/sysmacros.h>
-# include <sys/kmem.h>
-# if SOLARIS2 >= 10
-# include <sys/procset.h>
-# include <sys/proc.h>
-# include <sys/devops.h>
-# include <sys/ddi_impldefs.h>
-# endif
-/*
- * because Solaris 2 defines these in two places :-/
- */
-# ifndef KERNEL
-# define _KERNEL
-# undef RES_INIT
-# endif /* _KERNEL */
-
-# if SOLARIS2 >= 8
-# include <netinet/ip6.h>
-# include <netinet/icmp6.h>
-# endif
-
-# include <inet/common.h>
-/* These 5 are defined in <inet/ip.h> and <netinet/ip.h> */
-# undef IPOPT_EOL
-# undef IPOPT_NOP
-# undef IPOPT_LSRR
-# undef IPOPT_RR
-# undef IPOPT_SSRR
-# ifdef i386
-# define _SYS_PROMIF_H
-# endif
-# include <inet/ip.h>
-# undef COPYOUT
-# include <inet/ip_ire.h>
-# ifndef KERNEL
-# undef _KERNEL
-# endif
-# if SOLARIS2 >= 8
-# define SNPRINTF snprintf
-
-# include <inet/ip_if.h>
-# define ipif_local_addr ipif_lcl_addr
-/* Only defined in private include file */
-# ifndef V4_PART_OF_V6
-# define V4_PART_OF_V6(v6) v6.s6_addr32[3]
-# endif
-struct ip6_ext {
- u_char ip6e_nxt;
- u_char ip6e_len;
-};
-# endif /* SOLARIS2 >= 8 */
-
-# if SOLARIS2 >= 6
-# include <sys/atomic.h>
-typedef uint32_t u_32_t;
-# else
-typedef unsigned int u_32_t;
-# endif
-# define U_32_T 1
-
-# ifdef _KERNEL
-# define KRWLOCK_T krwlock_t
-# define KMUTEX_T kmutex_t
-# include "qif.h"
-# include "pfil.h"
-# if SOLARIS2 >= 6
-# if SOLARIS2 == 6
-# define ATOMIC_INCL(x) atomic_add_long((uint32_t*)&(x), 1)
-# define ATOMIC_DECL(x) atomic_add_long((uint32_t*)&(x), -1)
-# else
-# define ATOMIC_INCL(x) atomic_add_long(&(x), 1)
-# define ATOMIC_DECL(x) atomic_add_long(&(x), -1)
-# endif /* SOLARIS2 == 6 */
-# define ATOMIC_INC64(x) atomic_add_64((uint64_t*)&(x), 1)
-# define ATOMIC_INC32(x) atomic_add_32((uint32_t*)&(x), 1)
-# define ATOMIC_INC16(x) atomic_add_16((uint16_t*)&(x), 1)
-# define ATOMIC_DEC64(x) atomic_add_64((uint64_t*)&(x), -1)
-# define ATOMIC_DEC32(x) atomic_add_32((uint32_t*)&(x), -1)
-# define ATOMIC_DEC16(x) atomic_add_16((uint16_t*)&(x), -1)
-# else
-# define ATOMIC_INC(x) { mutex_enter(&ipf_rw); (x)++; \
- mutex_exit(&ipf_rw); }
-# define ATOMIC_DEC(x) { mutex_enter(&ipf_rw); (x)--; \
- mutex_exit(&ipf_rw); }
-# endif /* SOLARIS2 >= 6 */
-# define USE_MUTEXES
-# define MUTEX_ENTER(x) mutex_enter(&(x)->ipf_lk)
-# define READ_ENTER(x) rw_enter(&(x)->ipf_lk, RW_READER)
-# define WRITE_ENTER(x) rw_enter(&(x)->ipf_lk, RW_WRITER)
-# define MUTEX_DOWNGRADE(x) rw_downgrade(&(x)->ipf_lk)
-# define RWLOCK_INIT(x, y) rw_init(&(x)->ipf_lk, (y), \
- RW_DRIVER, NULL)
-# define RWLOCK_EXIT(x) rw_exit(&(x)->ipf_lk)
-# define RW_DESTROY(x) rw_destroy(&(x)->ipf_lk)
-# define MUTEX_INIT(x, y) mutex_init(&(x)->ipf_lk, (y), \
- MUTEX_DRIVER, NULL)
-# define MUTEX_DESTROY(x) mutex_destroy(&(x)->ipf_lk)
-# define MUTEX_NUKE(x) bzero((x), sizeof(*(x)))
-# define MUTEX_EXIT(x) mutex_exit(&(x)->ipf_lk)
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYIN(a,b,c) (void) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) (void) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define UIOMOVE(a,b,c,d) uiomove((caddr_t)a,b,c,d)
-# define KFREE(x) kmem_free((char *)(x), sizeof(*(x)))
-# define KFREES(x,s) kmem_free((char *)(x), (s))
-# define SPL_NET(x) ;
-# define SPL_IMP(x) ;
-# undef SPL_X
-# define SPL_X(x) ;
-# ifdef sparc
-# define ntohs(x) (x)
-# define ntohl(x) (x)
-# define htons(x) (x)
-# define htonl(x) (x)
-# endif /* sparc */
-# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
-# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
-# define GET_MINOR(x) getminor(x)
-extern void *get_unit __P((char *, int));
-# define GETIFP(n, v) get_unit(n, v)
-# define IFNAME(x) ((qif_t *)x)->qf_name
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, ((qif_t *)x)->qf_name, \
- LIFNAMSIZ)
-# define GETKTIME(x) uniqtime((struct timeval *)x)
-# define MSGDSIZE(x) msgdsize(x)
-# define M_LEN(x) ((x)->b_wptr - (x)->b_rptr)
-# define M_DUPLICATE(x) dupmsg((x))
-# define MTOD(m,t) ((t)((m)->b_rptr))
-# define MTYPE(m) ((m)->b_datap->db_type)
-# define FREE_MB_T(m) freemsg(m)
-# define m_next b_cont
-# define CACHE_HASH(x) (((qpktinfo_t *)(x)->fin_qpi)->qpi_num & 7)
-# define IPF_PANIC(x,y) if (x) { printf y; cmn_err(CE_PANIC, "ipf_panic"); }
-typedef mblk_t mb_t;
-# endif /* _KERNEL */
-
-# if (SOLARIS2 >= 7)
-# ifdef lint
-# define ALIGN32(ptr) (ptr ? 0L : 0L)
-# define ALIGN16(ptr) (ptr ? 0L : 0L)
-# else
-# define ALIGN32(ptr) (ptr)
-# define ALIGN16(ptr) (ptr)
-# endif
-# endif
-
-# if SOLARIS2 < 6
-typedef struct uio uio_t;
-# endif
-typedef int ioctlcmd_t;
-
-# define OS_RECOGNISED 1
-
-#endif /* SOLARIS */
-
-/* ----------------------------------------------------------------------- */
-/* H P U X */
-/* ----------------------------------------------------------------------- */
-#ifdef __hpux
-# define MENTAT 1
-# include <sys/sysmacros.h>
-# include <sys/spinlock.h>
-# include <sys/lock.h>
-# include <sys/stream.h>
-# ifdef USE_INET6
-# include <netinet/if_ether.h>
-# include <netinet/ip6.h>
-# include <netinet/icmp6.h>
-typedef struct ip6_hdr ip6_t;
-# endif
-
-# ifdef _KERNEL
-# define SNPRINTF sprintf
-# if (HPUXREV >= 1111)
-# define IPL_SELECT
-# ifdef IPL_SELECT
-# include <machine/sys/user.h>
-# include <sys/kthread_iface.h>
-# define READ_COLLISION 0x01
-
-typedef struct iplog_select_s {
- kthread_t *read_waiter;
- int state;
-} iplog_select_t;
-# endif
-# endif
-
-# define GETKTIME(x) uniqtime((struct timeval *)x)
-
-# if HPUXREV == 1111
-# include "kern_svcs.h"
-# else
-# include <sys/kern_svcs.h>
-# endif
-# undef ti_flags
-# undef TCP_NODELAY
-# undef TCP_MAXSEG
-# include <sys/reg.h>
-# include "../netinet/ip_info.h"
-/*
- * According to /usr/include/sys/spinlock.h on HP-UX 11.00, these functions
- * are available. Attempting to use them actually results in unresolved
- * symbols when it comes time to load the module.
- * This has been fixed! Yipee!
- */
-# if 1
-# ifdef __LP64__
-# define ATOMIC_INCL(x) lock_and_incr_int64(&ipf_rw.ipf_lk, &(x), 1)
-# define ATOMIC_DECL(x) lock_and_incr_int64(&ipf_rw.ipf_lk, &(x), -1)
-# else
-# define ATOMIC_INCL(x) lock_and_incr_int32(&ipf_rw.ipf_lk, &(x), 1)
-# define ATOMIC_DECL(x) lock_and_incr_int32(&ipf_rw.ipf_lk, &(x), -1)
-# endif
-# define ATOMIC_INC64(x) lock_and_incr_int64(&ipf_rw.ipf_lk, &(x), 1)
-# define ATOMIC_INC32(x) lock_and_incr_int32(&ipf_rw.ipf_lk, &(x), 1)
-# define ATOMIC_INC16(x) lock_and_incr_int16(&ipf_rw.ipf_lk, &(x), 1)
-# define ATOMIC_DEC64(x) lock_and_incr_int64(&ipf_rw.ipf_lk, &(x), -1)
-# define ATOMIC_DEC32(x) lock_and_incr_int32(&ipf_rw.ipf_lk, &(x), -1)
-# define ATOMIC_DEC16(x) lock_and_incr_int16(&ipf_rw.ipf_lk, &(x), -1)
-# else /* 0 */
-# define ATOMIC_INC64(x) { MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_DEC64(x) { MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_INC32(x) { MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_DEC32(x) { MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_INCL(x) { MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_DECL(x) { MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_INC(x) { MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_DEC(x) { MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw); }
-# endif
-# define ip_cksum ip_csuma
-# define memcpy(a,b,c) bcopy((caddr_t)b, (caddr_t)a, c)
-# define USE_MUTEXES
-# define MUTEX_INIT(x, y) initlock(&(x)->ipf_lk, 0, 0, (y))
-# define MUTEX_ENTER(x) spinlock(&(x)->ipf_lk)
-# define MUTEX_EXIT(x) spinunlock(&(x)->ipf_lk);
-# define MUTEX_DESTROY(x)
-# define MUTEX_NUKE(x) bzero((char *)(x), sizeof(*(x)))
-# define KMUTEX_T lock_t
-# define kmutex_t lock_t /* for pfil.h */
-# define krwlock_t lock_t /* for pfil.h */
-/*
- * The read-write lock implementation in HP-UX 11.0 is crippled - it can
- * only be used by threads working in a user context!
- * This has been fixed! Yipee! (Or at least it does in 11.00, not 11.11..)
- */
-# if HPUXREV < 1111
-# define MUTEX_DOWNGRADE(x) lock_write_to_read(x)
-# define KRWLOCK_T struct rw_lock
-# define READ_ENTER(x) lock_read(&(x)->ipf_lk)
-# define WRITE_ENTER(x) lock_write(&(x)->ipf_lk)
-# if HPUXREV >= 1111
-# define RWLOCK_INIT(x, y) rwlock_init4(&(x)->ipf_lk, 0, RWLCK_CANSLEEP, 0, y)
-# else
-# define RWLOCK_INIT(x, y) lock_init3(&(x)->ipf_lk, 0, 1, 0, 0, y)
-# endif
-# define RWLOCK_EXIT(x) lock_done(&(x)->ipf_lk)
-# else
-# define KRWLOCK_T lock_t
-# define KMUTEX_T lock_t
-# define READ_ENTER(x) MUTEX_ENTER(x)
-# define WRITE_ENTER(x) MUTEX_ENTER(x)
-# define MUTEX_DOWNGRADE(x)
-# define RWLOCK_INIT(x, y) initlock(&(x)->ipf_lk, 0, 0, y)
-# define RWLOCK_EXIT(x) MUTEX_EXIT(x)
-# endif
-# define RW_DESTROY(x)
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# if HPUXREV >= 1111
-# define BCOPYIN(a,b,c) 0; bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) 0; bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# else
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# endif
-# define SPL_NET(x) ;
-# define SPL_IMP(x) ;
-# undef SPL_X
-# define SPL_X(x) ;
-extern void *get_unit __P((char *, int));
-# define GETIFP(n, v) get_unit(n, v)
-# define IFNAME(x, b) ((ill_t *)x)->ill_name
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, ((qif_t *)x)->qf_name, \
- LIFNAMSIZ)
-# define UIOMOVE(a,b,c,d) uiomove((caddr_t)a,b,c,d)
-# define SLEEP(id, n) { lock_t *_l = get_sleep_lock((caddr_t)id); \
- sleep(id, PZERO+1); \
- spinunlock(_l); \
- }
-# define WAKEUP(id,x) { lock_t *_l = get_sleep_lock((caddr_t)id); \
- wakeup(id + x); \
- spinunlock(_l); \
- }
-# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), M_IOSYS, M_NOWAIT)
-# define KMALLOCS(a, b, c) MALLOC((a), b, (c), M_IOSYS, M_NOWAIT)
-# define KFREE(x) kmem_free((char *)(x), sizeof(*(x)))
-# define KFREES(x,s) kmem_free((char *)(x), (s))
-# define MSGDSIZE(x) msgdsize(x)
-# define M_LEN(x) ((x)->b_wptr - (x)->b_rptr)
-# define M_DUPLICATE(x) dupmsg((x))
-# define MTOD(m,t) ((t)((m)->b_rptr))
-# define MTYPE(m) ((m)->b_datap->db_type)
-# define FREE_MB_T(m) freemsg(m)
-# define m_next b_cont
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-typedef mblk_t mb_t;
-
-# define CACHE_HASH(x) (((qpktinfo_t *)(x)->fin_qpi)->qpi_num & 7)
-
-# include "qif.h"
-# include "pfil.h"
-
-# else /* _KERNEL */
-
-typedef unsigned char uchar_t;
-
-# ifndef _SYS_STREAM_INCLUDED
-typedef char * mblk_t;
-typedef void * queue_t;
-typedef u_long ulong;
-# endif
-# include <netinet/ip_info.h>
-
-# endif /* _KERNEL */
-
-# ifdef lint
-# define ALIGN32(ptr) (ptr ? 0L : 0L)
-# define ALIGN16(ptr) (ptr ? 0L : 0L)
-# else
-# define ALIGN32(ptr) (ptr)
-# define ALIGN16(ptr) (ptr)
-# endif
-
-typedef struct uio uio_t;
-typedef int ioctlcmd_t;
-typedef int minor_t;
-typedef unsigned int u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-
-#endif /* __hpux */
-
-/* ----------------------------------------------------------------------- */
-/* I R I X */
-/* ----------------------------------------------------------------------- */
-#ifdef __sgi
-# undef MENTAT
-# if IRIX < 60500
-typedef struct uio uio_t;
-# endif
-typedef int ioctlcmd_t;
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-# ifdef INET6
-# define USE_INET6
-# endif
-
-# define hz HZ
-# include <sys/ksynch.h>
-# define IPF_LOCK_PL plhi
-# include <sys/sema.h>
-# undef kmutex_t
-typedef struct {
- lock_t *l;
- int pl;
-} kmutex_t;
-
-# ifdef MUTEX_INIT
-# define KMUTEX_T mutex_t
-# else
-# define KMUTEX_T kmutex_t
-# define KRWLOCK_T kmutex_t
-# endif
-
-# ifdef _KERNEL
-# define ATOMIC_INC(x) { MUTEX_ENTER(&ipf_rw); \
- (x)++; MUTEX_EXIT(&ipf_rw); }
-# define ATOMIC_DEC(x) { MUTEX_ENTER(&ipf_rw); \
- (x)--; MUTEX_EXIT(&ipf_rw); }
-# define USE_MUTEXES
-# ifdef MUTEX_INIT
-# include <sys/atomic_ops.h>
-# define ATOMIC_INCL(x) atomicAddUlong(&(x), 1)
-# define ATOMIC_INC64(x) atomicAddUint64(&(x), 1)
-# define ATOMIC_INC32(x) atomicAddUint(&(x), 1)
-# define ATOMIC_INC16 ATOMIC_INC
-# define ATOMIC_DECL(x) atomicAddUlong(&(x), -1)
-# define ATOMIC_DEC64(x) atomicAddUint64(&(x), -1)
-# define ATOMIC_DEC32(x) atomicAddUint(&(x), -1)
-# define ATOMIC_DEC16 ATOMIC_DEC
-# undef MUTEX_INIT
-# define MUTEX_INIT(x, y) mutex_init(&(x)->ipf_lk, \
- MUTEX_DEFAULT, y)
-# undef MUTEX_ENTER
-# define MUTEX_ENTER(x) mutex_lock(&(x)->ipf_lk, 0)
-# undef MUTEX_EXIT
-# define MUTEX_EXIT(x) mutex_unlock(&(x)->ipf_lk)
-# undef MUTEX_DESTROY
-# define MUTEX_DESTROY(x) mutex_destroy(&(x)->ipf_lk)
-# define MUTEX_DOWNGRADE(x) mrdemote(&(x)->ipf_lk)
-# define KRWLOCK_T mrlock_t
-# define RWLOCK_INIT(x, y) mrinit(&(x)->ipf_lk, y)
-# undef RW_DESTROY
-# define RW_DESTROY(x) mrfree(&(x)->ipf_lk)
-# define READ_ENTER(x) RW_RDLOCK(&(x)->ipf_lk)
-# define WRITE_ENTER(x) RW_WRLOCK(&(x)->ipf_lk)
-# define RWLOCK_EXIT(x) RW_UNLOCK(&(x)->ipf_lk)
-# else
-# define READ_ENTER(x) MUTEX_ENTER(&(x)->ipf_lk)
-# define WRITE_ENTER(x) MUTEX_ENTER(&(x)->ipf_lk)
-# define MUTEX_DOWNGRADE(x) ;
-# define RWLOCK_EXIT(x) MUTEX_EXIT(&(x)->ipf_lk)
-# define MUTEX_EXIT(x) UNLOCK((x)->ipf_lk.l, (x)->ipf_lk.pl);
-# define MUTEX_INIT(x,y) (x)->ipf_lk.l = LOCK_ALLOC((uchar_t)-1, IPF_LOCK_PL, (lkinfo_t *)-1, KM_NOSLEEP)
-# define MUTEX_DESTROY(x) LOCK_DEALLOC((x)->ipf_lk.l)
-# define MUTEX_ENTER(x) (x)->ipf_lk.pl = LOCK((x)->ipf_lk.l, \
- IPF_LOCK_PL);
-# endif
-# define MUTEX_NUKE(x) bzero((x), sizeof(*(x)))
-# define FREE_MB_T(m) m_freem(m)
-# define MTOD(m,t) mtod(m,t)
-# define COPYIN(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define COPYOUT(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define BCOPYIN(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define BCOPYOUT(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define UIOMOVE(a,b,c,d) uiomove((caddr_t)a,b,c,d)
-# define SLEEP(id, n) sleep((id), PZERO+1)
-# define WAKEUP(id,x) wakeup(id+x)
-# define KFREE(x) kmem_free((char *)(x), sizeof(*(x)))
-# define KFREES(x,s) kmem_free((char *)(x), (s))
-# define GETIFP(n,v) ifunit(n)
-# include <sys/kmem.h>
-# include <sys/ddi.h>
-# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
-# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
-# define GET_MINOR(x) getminor(x)
-# define USE_SPL 1
-# define SPL_IMP(x) (x) = splimp()
-# define SPL_NET(x) (x) = splnet()
-# define SPL_X(x) (void) splx(x)
-extern void m_copydata __P((struct mbuf *, int, int, caddr_t));
-extern void m_copyback __P((struct mbuf *, int, int, caddr_t));
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define GETKTIME(x) microtime((struct timeval *)x)
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-typedef struct mbuf mb_t;
-# else
-# undef RW_DESTROY
-# undef MUTEX_INIT
-# undef MUTEX_DESTROY
-# endif /* _KERNEL */
-
-# define OS_RECOGNISED 1
-
-#endif /* __sgi */
-
-/* ----------------------------------------------------------------------- */
-/* T R U 6 4 */
-/* ----------------------------------------------------------------------- */
-#ifdef __osf__
-# undef MENTAT
-
-# include <kern/lock.h>
-# include <sys/sysmacros.h>
-
-# ifdef _KERNEL
-# define KMUTEX_T simple_lock_data_t
-# define KRWLOCK_T lock_data_t
-# include <net/net_globals.h>
-# define USE_MUTEXES
-# define READ_ENTER(x) lock_read(&(x)->ipf_lk)
-# define WRITE_ENTER(x) lock_write(&(x)->ipf_lk)
-# define MUTEX_DOWNGRADE(x) lock_write_to_read(&(x)->ipf_lk)
-# define RWLOCK_INIT(x, y) lock_init(&(x)->ipf_lk, TRUE)
-# define RWLOCK_EXIT(x) lock_done(&(x)->ipf_lk)
-# define RW_DESTROY(x) lock_terminate(&(x)->ipf_lk)
-# define MUTEX_ENTER(x) simple_lock(&(x)->ipf_lk)
-# define MUTEX_INIT(x, y) simple_lock_init(&(x)->ipf_lk)
-# define MUTEX_DESTROY(x) simple_lock_terminate(&(x)->ipf_lk)
-# define MUTEX_EXIT(x) simple_unlock(&(x)->ipf_lk)
-# define MUTEX_NUKE(x) bzero(x, sizeof(*(x)))
-# define ATOMIC_INC64(x) atomic_incq((uint64_t*)&(x))
-# define ATOMIC_DEC64(x) atomic_decq((uint64_t*)&(x))
-# define ATOMIC_INC32(x) atomic_incl((uint32_t*)&(x))
-# define ATOMIC_DEC32(x) atomic_decl((uint32_t*)&(x))
-# define ATOMIC_INC16(x) { simple_lock(&ipf_rw); (x)++; \
- simple_unlock(&ipf_rw); }
-# define ATOMIC_DEC16(x) { simple_lock(&ipf_rw); (x)--; \
- simple_unlock(&ipf_rw); }
-# define ATOMIC_INCL(x) atomic_incl((uint32_t*)&(x))
-# define ATOMIC_DECL(x) atomic_decl((uint32_t*)&(x))
-# define ATOMIC_INC(x) { simple_lock(&ipf_rw); (x)++; \
- simple_unlock(&ipf_rw); }
-# define ATOMIC_DEC(x) { simple_lock(&ipf_rw); (x)--; \
- simple_unlock(&ipf_rw); }
-# define SPL_NET(x) ;
-# define SPL_IMP(x) ;
-# undef SPL_X
-# define SPL_X(x) ;
-# define UIOMOVE(a,b,c,d) uiomove((caddr_t)a, b, d)
-# define FREE_MB_T(m) m_freem(m)
-# define MTOD(m,t) mtod(m,t)
-# define GETIFP(n, v) ifunit(n)
-# define GET_MINOR getminor
-# define WAKEUP(id,x) wakeup(id + x)
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), M_PFILT, M_NOWAIT)
-# define KMALLOCS(a, b, c) MALLOC((a), b, (c), M_PFILT, \
- ((c) > 4096) ? M_WAITOK : M_NOWAIT)
-# define KFREE(x) FREE((x), M_PFILT)
-# define KFREES(x,s) FREE((x), M_PFILT)
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define GETKTIME(x) microtime((struct timeval *)x)
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-typedef struct mbuf mb_t;
-# endif /* _KERNEL */
-
-# if (defined(_KERNEL) || defined(_NO_BITFIELDS) || (__STDC__ == 1))
-# define IP_V(x) ((x)->ip_vhl >> 4)
-# define IP_HL(x) ((x)->ip_vhl & 0xf)
-# define IP_V_A(x,y) (x)->ip_vhl |= (((y) << 4) & 0xf0)
-# define IP_HL_A(x,y) (x)->ip_vhl |= ((y) & 0xf)
-# define TCP_X2(x) ((x)->th_xoff & 0xf)
-# define TCP_X2_A(x,y) (x)->th_xoff |= ((y) & 0xf)
-# define TCP_OFF(x) ((x)->th_xoff >> 4)
-# define TCP_OFF_A(x,y) (x)->th_xoff |= (((y) << 4) & 0xf0)
-# endif
-
-/*
- * These are from's Solaris' #defines for little endian.
- */
-#define IP6F_MORE_FRAG 0x0100
-#define IP6F_RESERVED_MASK 0x0600
-#define IP6F_OFF_MASK 0xf8ff
-
-struct ip6_ext {
- u_char ip6e_nxt;
- u_char ip6e_len;
-};
-
-typedef int ioctlcmd_t;
-/*
- * Really, any arch where sizeof(long) != sizeof(int).
- */
-typedef unsigned int u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-#endif /* __osf__ */
-
-/* ----------------------------------------------------------------------- */
-/* N E T B S D */
-/* ----------------------------------------------------------------------- */
-#ifdef __NetBSD__
-# if defined(_KERNEL) && !defined(IPFILTER_LKM)
-# include "bpfilter.h"
-# if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 104110000)
-# include "opt_inet.h"
-# endif
-# ifdef INET6
-# define USE_INET6
-# endif
-# if (__NetBSD_Version__ >= 105000000)
-# define HAVE_M_PULLDOWN 1
-# endif
-# endif
-
-# ifdef _KERNEL
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define GETKTIME(x) microtime((struct timeval *)x)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-typedef struct mbuf mb_t;
-# endif /* _KERNEL */
-# if (NetBSD <= 1991011) && (NetBSD >= 199606)
-# define IFNAME(x) ((struct ifnet *)x)->if_xname
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, \
- ((struct ifnet *)x)->if_xname, \
- LIFNAMSIZ)
-# define CACHE_HASH(x) ((((struct ifnet *)fin->fin_ifp)->if_index)&7)
-# else
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# endif
-
-typedef struct uio uio_t;
-typedef u_long ioctlcmd_t;
-typedef int minor_t;
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-#endif /* __NetBSD__ */
-
-
-/* ----------------------------------------------------------------------- */
-/* F R E E B S D */
-/* ----------------------------------------------------------------------- */
-#ifdef __FreeBSD__
-# if defined(_KERNEL) && !defined(IPFILTER_LKM) && !defined(KLD_MODULE)
-# if (__FreeBSD_version >= 500000)
-# include "opt_bpf.h"
-# else
-# include "bpf.h"
-# endif
-# if defined(__FreeBSD_version) && (__FreeBSD_version >= 400000)
-# include "opt_inet6.h"
-# endif
-# if defined(INET6) && !defined(USE_INET6)
-# define USE_INET6
-# endif
-# endif
-
-# if defined(_KERNEL)
-# if (__FreeBSD_version >= 400000)
-/*
- * When #define'd, the 5.2.1 kernel panics when used with the ftp proxy.
- * There may be other, safe, kernels but this is not extensively tested yet.
- */
-# define HAVE_M_PULLDOWN
-# endif
-# if !defined(IPFILTER_LKM) && (__FreeBSD_version >= 300000)
-# include "opt_ipfilter.h"
-# endif
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-
-# if (__FreeBSD_version >= 500043)
-# define NETBSD_PF
-# endif
-# endif /* _KERNEL */
-
-# if (__FreeBSD_version >= 500043)
-# include <sys/mutex.h>
-# include <sys/sx.h>
-/*
- * Whilst the sx(9) locks on FreeBSD have the right semantics and interface
- * for what we want to use them for, despite testing showing they work -
- * with a WITNESS kernel, it generates LOR messages.
- */
-# define KMUTEX_T struct mtx
-# if 1
-# define KRWLOCK_T struct mtx
-# else
-# define KRWLOCK_T struct sx
-# endif
-# endif
-
-# if (__FreeBSD_version >= 501113)
-# include <net/if_var.h>
-# define IFNAME(x) ((struct ifnet *)x)->if_xname
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, \
- ((struct ifnet *)x)->if_xname, \
- LIFNAMSIZ)
-# endif
-# if (__FreeBSD_version >= 500043)
-# define CACHE_HASH(x) ((((struct ifnet *)fin->fin_ifp)->if_index) & 7)
-# else
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# endif
-
-# ifdef _KERNEL
-# define GETKTIME(x) microtime((struct timeval *)x)
-
-# if (__FreeBSD_version >= 500002)
-# include <netinet/in_systm.h>
-# include <netinet/ip.h>
-# include <machine/in_cksum.h>
-# endif
-
-# if (__FreeBSD_version >= 500043)
-# define USE_MUTEXES
-# define MUTEX_ENTER(x) mtx_lock(&(x)->ipf_lk)
-# define MUTEX_EXIT(x) mtx_unlock(&(x)->ipf_lk)
-# define MUTEX_INIT(x,y) mtx_init(&(x)->ipf_lk, (y), NULL,\
- MTX_DEF)
-# define MUTEX_DESTROY(x) mtx_destroy(&(x)->ipf_lk)
-# define MUTEX_NUKE(x) bzero((x), sizeof(*(x)))
-/*
- * Whilst the sx(9) locks on FreeBSD have the right semantics and interface
- * for what we want to use them for, despite testing showing they work -
- * with a WITNESS kernel, it generates LOR messages.
- */
-# if 1
-# define READ_ENTER(x) mtx_lock(&(x)->ipf_lk)
-# define WRITE_ENTER(x) mtx_lock(&(x)->ipf_lk)
-# define RWLOCK_EXIT(x) mtx_unlock(&(x)->ipf_lk)
-# define MUTEX_DOWNGRADE(x) ;
-# define RWLOCK_INIT(x,y) mtx_init(&(x)->ipf_lk, (y), NULL,\
- MTX_DEF)
-# define RW_DESTROY(x) mtx_destroy(&(x)->ipf_lk)
-# else
-# define READ_ENTER(x) sx_slock(&(x)->ipf_lk)
-# define WRITE_ENTER(x) sx_xlock(&(x)->ipf_lk)
-# define MUTEX_DOWNGRADE(x) sx_downgrade(&(x)->ipf_lk)
-# define RWLOCK_INIT(x, y) sx_init(&(x)->ipf_lk, (y))
-# define RW_DESTROY(x) sx_destroy(&(x)->ipf_lk)
-# ifdef sx_unlock
-# define RWLOCK_EXIT(x) sx_unlock(x)
-# else
-# define RWLOCK_EXIT(x) do { \
- if ((x)->ipf_lk.sx_cnt < 0) \
- sx_xunlock(&(x)->ipf_lk); \
- else \
- sx_sunlock(&(x)->ipf_lk); \
- } while (0)
-# endif
-# endif
-# include <machine/atomic.h>
-# define ATOMIC_INC(x) { mtx_lock(&ipf_rw.ipf_lk); (x)++; \
- mtx_unlock(&ipf_rw.ipf_lk); }
-# define ATOMIC_DEC(x) { mtx_lock(&ipf_rw.ipf_lk); (x)--; \
- mtx_unlock(&ipf_rw.ipf_lk); }
-# define ATOMIC_INCL(x) atomic_add_long(&(x), 1)
-# define ATOMIC_INC64(x) ATOMIC_INC(x)
-# define ATOMIC_INC32(x) atomic_add_32(&(x), 1)
-# define ATOMIC_INC16(x) atomic_add_16(&(x), 1)
-# define ATOMIC_DECL(x) atomic_add_long(&(x), -1)
-# define ATOMIC_DEC64(x) ATOMIC_DEC(x)
-# define ATOMIC_DEC32(x) atomic_add_32(&(x), -1)
-# define ATOMIC_DEC16(x) atomic_add_16(&(x), -1)
-# define SPL_X(x) ;
-# define SPL_NET(x) ;
-# define SPL_IMP(x) ;
-extern int in_cksum __P((struct mbuf *, int));
-# endif /* __FreeBSD_version >= 500043 */
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-typedef struct mbuf mb_t;
-# endif /* _KERNEL */
-
-# if __FreeBSD__ < 3
-# include <machine/spl.h>
-# else
-# if __FreeBSD__ == 3
-# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL)
-# define ACTUALLY_LKM_NOT_KERNEL
-# endif
-# endif
-# endif
-
-# if (__FreeBSD_version >= 300000)
-typedef u_long ioctlcmd_t;
-# else
-typedef int ioctlcmd_t;
-# endif
-typedef struct uio uio_t;
-typedef int minor_t;
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-#endif /* __FreeBSD__ */
-
-
-/* ----------------------------------------------------------------------- */
-/* O P E N B S D */
-/* ----------------------------------------------------------------------- */
-#ifdef __OpenBSD__
-# ifdef INET6
-# define USE_INET6
-# endif
-
-# ifdef _KERNEL
-# if !defined(IPFILTER_LKM)
-# include "bpfilter.h"
-# endif
-# if (OpenBSD >= 200311)
-# define SNPRINTF snprintf
-# if defined(USE_INET6)
-# include "netinet6/in6_var.h"
-# include "netinet6/nd6.h"
-# endif
-# endif
-# if (OpenBSD >= 200012)
-# define HAVE_M_PULLDOWN 1
-# endif
-# define COPYIN(a,b,c) copyin((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYOUT(a,b,c) copyout((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define GETKTIME(x) microtime((struct timeval *)x)
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-typedef struct mbuf mb_t;
-# endif /* _KERNEL */
-# if (OpenBSD >= 199603)
-# define IFNAME(x, b) ((struct ifnet *)x)->if_xname
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, \
- ((struct ifnet *)x)->if_xname, \
- LIFNAMSIZ)
-# define CACHE_HASH(x) ((((struct ifnet *)fin->fin_ifp)->if_index)&7)
-# else
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# endif
-
-typedef struct uio uio_t;
-typedef u_long ioctlcmd_t;
-typedef int minor_t;
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-#endif /* __OpenBSD__ */
-
-
-/* ----------------------------------------------------------------------- */
-/* B S D O S */
-/* ----------------------------------------------------------------------- */
-#ifdef _BSDI_VERSION
-# ifdef INET6
-# define USE_INET6
-# endif
-
-# ifdef _KERNEL
-# define GETKTIME(x) microtime((struct timeval *)x)
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-typedef struct mbuf mb_t;
-# endif /* _KERNEL */
-
-# if (_BSDI_VERSION >= 199701)
-typedef u_long ioctlcmd_t;
-# else
-typedef int ioctlcmd_t;
-# endif
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-#endif /* _BSDI_VERSION */
-
-
-/* ----------------------------------------------------------------------- */
-/* S U N O S 4 */
-/* ----------------------------------------------------------------------- */
-#if defined(sun) && !defined(OS_RECOGNISED) /* SunOS4 */
-# ifdef _KERNEL
-# include <sys/kmem_alloc.h>
-# define GETKTIME(x) uniqtime((struct timeval *)x)
-# define MSGDSIZE(x) mbufchainlen(x)
-# define M_LEN(x) (x)->m_len
-# define M_DUPLICATE(x) m_copy((x), 0, M_COPYALL)
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# define GETIFP(n, v) ifunit(n, IFNAMSIZ)
-# define KFREE(x) kmem_free((char *)(x), sizeof(*(x)))
-# define KFREES(x,s) kmem_free((char *)(x), (s))
-# define SLEEP(id, n) sleep((id), PZERO+1)
-# define WAKEUP(id,x) wakeup(id + x)
-# define UIOMOVE(a,b,c,d) uiomove((caddr_t)a,b,c,d)
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-
-extern void m_copydata __P((struct mbuf *, int, int, caddr_t));
-extern void m_copyback __P((struct mbuf *, int, int, caddr_t));
-
-typedef struct mbuf mb_t;
-# endif
-
-typedef struct uio uio_t;
-typedef int ioctlcmd_t;
-typedef int minor_t;
-typedef unsigned int u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-
-#endif /* SunOS 4 */
-
-/* ----------------------------------------------------------------------- */
-/* L I N U X */
-/* ----------------------------------------------------------------------- */
-#if defined(linux) && !defined(OS_RECOGNISED)
-#include <linux/config.h>
-#include <linux/version.h>
-# if LINUX >= 20600
-# define HDR_T_PRIVATE 1
-# endif
-# undef USE_INET6
-# ifdef USE_INET6
-struct ip6_ext {
- u_char ip6e_nxt;
- u_char ip6e_len;
-};
-# endif
-
-# ifdef _KERNEL
-# define IPF_PANIC(x,y) if (x) { printf y; panic("ipf_panic"); }
-# define BCOPYIN(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define BCOPYOUT(a,b,c) bcopy((caddr_t)(a), (caddr_t)(b), (c))
-# define COPYIN(a,b,c) copy_from_user((caddr_t)(b), (caddr_t)(a), (c))
-# define COPYOUT(a,b,c) copy_to_user((caddr_t)(b), (caddr_t)(a), (c))
-# define FREE_MB_T(m) kfree_skb(m)
-# define GETKTIME(x) do_gettimeofday((struct timeval *)x)
-# define SLEEP(x,s) 0, interruptible_sleep_on(x##_linux)
-# define WAKEUP(x,y) wake_up(x##_linux + y)
-# define UIOMOVE(a,b,c,d) uiomove(a,b,c,d)
-# define USE_MUTEXES
-# define KRWLOCK_T rwlock_t
-# define KMUTEX_T spinlock_t
-# define MUTEX_INIT(x,y) spin_lock_init(&(x)->ipf_lk)
-# define MUTEX_ENTER(x) spin_lock(&(x)->ipf_lk)
-# define MUTEX_EXIT(x) spin_unlock(&(x)->ipf_lk)
-# define MUTEX_DESTROY(x) do { } while (0)
-# define MUTEX_NUKE(x) bzero(&(x)->ipf_lk, sizeof((x)->ipf_lk))
-# define READ_ENTER(x) ipf_read_enter(x)
-# define WRITE_ENTER(x) ipf_write_enter(x)
-# define RWLOCK_INIT(x,y) rwlock_init(&(x)->ipf_lk)
-# define RW_DESTROY(x) do { } while (0)
-# define RWLOCK_EXIT(x) ipf_rw_exit(x)
-# define MUTEX_DOWNGRADE(x) ipf_rw_downgrade(x)
-# define ATOMIC_INCL(x) MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_DECL(x) MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_INC64(x) MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_INC32(x) MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_INC16(x) MUTEX_ENTER(&ipf_rw); (x)++; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_DEC64(x) MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_DEC32(x) MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw)
-# define ATOMIC_DEC16(x) MUTEX_ENTER(&ipf_rw); (x)--; \
- MUTEX_EXIT(&ipf_rw)
-# define SPL_IMP(x) do { } while (0)
-# define SPL_NET(x) do { } while (0)
-# define SPL_X(x) do { } while (0)
-# define IFNAME(x) ((struct net_device*)x)->name
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct net_device *)fin->fin_ifp)->ifindex) & 7)
-typedef struct sk_buff mb_t;
-extern void m_copydata __P((mb_t *, int, int, caddr_t));
-extern void m_copyback __P((mb_t *, int, int, caddr_t));
-extern void m_adj __P((mb_t *, int));
-extern mb_t *m_pullup __P((mb_t *, int));
-# define mbuf sk_buff
-
-# define mtod(m, t) ((t)(m)->data)
-# define m_len len
-# define m_next next
-# define M_DUPLICATE(m) skb_clone((m), in_interrupt() ? GFP_ATOMIC : \
- GFP_KERNEL)
-# define MSGDSIZE(m) (m)->len
-# define M_LEN(m) (m)->len
-
-# define splnet(x) ;
-# define printf printk
-# define bcopy(s,d,z) memmove(d, s, z)
-# define bzero(s,z) memset(s, 0, z)
-# define bcmp(a,b,z) memcmp(a, b, z)
-
-# define ifnet net_device
-# define if_xname name
-# define if_unit ifindex
-
-# define KMALLOC(x,t) (x) = (t)kmalloc(sizeof(*(x)), \
- in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
-# define KFREE(x) kfree(x)
-# define KMALLOCS(x,t,s) (x) = (t)kmalloc((s), \
- in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
-# define KFREES(x,s) kfree(x)
-
-# define GETIFP(n,v) dev_get_by_name(n)
-
-# else
-# include <net/ethernet.h>
-
-struct mbuf {
-};
-
-# ifndef _NET_ROUTE_H
-struct rtentry {
-};
-# endif
-
-struct ifnet {
- char if_xname[IFNAMSIZ];
- int if_unit;
- int (* if_output) __P((struct ifnet *, struct mbuf *, struct sockaddr *, struct rtentry *));
- struct ifaddr *if_addrlist;
-};
-# define IFNAME(x) ((struct ifnet *)x)->if_xname
-
-# endif /* _KERNEL */
-
-# define COPYIFNAME(x, b) \
- (void) strncpy(b, \
- ((struct ifnet *)x)->if_xname, \
- LIFNAMSIZ)
-
-# include <linux/fs.h>
-# define FWRITE FMODE_WRITE
-# define FREAD FMODE_READ
-
-# define __USE_MISC 1
-# define __FAVOR_BSD 1
-
-typedef struct uio {
- struct iovec *uio_iov;
- void *uio_file;
- char *uio_buf;
- int uio_iovcnt;
- int uio_offset;
- size_t uio_resid;
- int uio_rw;
-} uio_t;
-
-extern int uiomove __P((caddr_t, size_t, int, struct uio *));
-
-# define UIO_READ 1
-# define UIO_WRITE 2
-
-typedef u_long ioctlcmd_t;
-typedef int minor_t;
-typedef u_int32_t u_32_t;
-# define U_32_T 1
-
-# define OS_RECOGNISED 1
-
-#endif
-
-
-#ifndef OS_RECOGNISED
-#error ip_compat.h does not recognise this platform/OS.
-#endif
-
-
-/* ----------------------------------------------------------------------- */
-/* G E N E R I C */
-/* ----------------------------------------------------------------------- */
-#ifndef OS_RECOGNISED
-#endif
-
-/*
- * For BSD kernels, if bpf is in the kernel, enable ipfilter to use bpf in
- * filter rules.
- */
-#if !defined(IPFILTER_BPF) && ((NBPF > 0) || (NBPFILTER > 0))
-# define IPFILTER_BPF
-#endif
-
-/*
- * Userland locking primitives
- */
-typedef struct {
- char *eMm_owner;
- char *eMm_heldin;
- u_int eMm_magic;
- int eMm_held;
- int eMm_heldat;
-#ifdef __hpux
- char eMm_fill[8];
-#endif
-} eMmutex_t;
-
-typedef struct {
- char *eMrw_owner;
- char *eMrw_heldin;
- u_int eMrw_magic;
- short eMrw_read;
- short eMrw_write;
- int eMrw_heldat;
-#ifdef __hpux
- char eMm_fill[24];
-#endif
-} eMrwlock_t;
-
-typedef union {
-#ifdef KMUTEX_T
- struct {
- KMUTEX_T ipf_slk;
- char *ipf_lname;
- } ipf_lkun_s;
-#endif
- eMmutex_t ipf_emu;
-} ipfmutex_t;
-
-typedef union {
-#ifdef KRWLOCK_T
- struct {
- KRWLOCK_T ipf_slk;
- char *ipf_lname;
- int ipf_sr;
- int ipf_sw;
- u_int ipf_magic;
- } ipf_lkun_s;
-#endif
- eMrwlock_t ipf_emu;
-} ipfrwlock_t;
-
-#define ipf_lk ipf_lkun_s.ipf_slk
-#define ipf_lname ipf_lkun_s.ipf_lname
-#define ipf_isr ipf_lkun_s.ipf_sr
-#define ipf_isw ipf_lkun_s.ipf_sw
-#define ipf_magic ipf_lkun_s.ipf_magic
-
-#if !defined(__GNUC__) || \
- (defined(__FreeBSD_version) && (__FreeBSD_version >= 503000))
-# ifndef INLINE
-# define INLINE
-# endif
-#else
-# define INLINE __inline__
-#endif
-
-#if defined(linux) && defined(_KERNEL)
-extern INLINE void ipf_read_enter __P((ipfrwlock_t *));
-extern INLINE void ipf_write_enter __P((ipfrwlock_t *));
-extern INLINE void ipf_rw_exit __P((ipfrwlock_t *));
-extern INLINE void ipf_rw_downgrade __P((ipfrwlock_t *));
-#endif
-
-/*
- * In a non-kernel environment, there are a lot of macros that need to be
- * filled in to be null-ops or to point to some compatibility function,
- * somewhere in userland.
- */
-#ifndef _KERNEL
-typedef struct mb_s {
- struct mb_s *mb_next;
- int mb_len;
- u_long mb_buf[2048];
-} mb_t;
-# undef m_next
-# define m_next mb_next
-# define MSGDSIZE(x) (x)->mb_len /* XXX - from ipt.c */
-# define M_LEN(x) (x)->mb_len
-# define M_DUPLICATE(x) (x)
-# define GETKTIME(x) gettimeofday((struct timeval *)(x), NULL)
-# define MTOD(m, t) ((t)(m)->mb_buf)
-# define FREE_MB_T(x)
-# define SLEEP(x,y) 1;
-# define WAKEUP(x,y) ;
-# define IPF_PANIC(x,y) ;
-# define PANIC(x,y) ;
-# define SPL_NET(x) ;
-# define SPL_IMP(x) ;
-# define SPL_X(x) ;
-# define KMALLOC(a,b) (a) = (b)malloc(sizeof(*a))
-# define KMALLOCS(a,b,c) (a) = (b)malloc(c)
-# define KFREE(x) free(x)
-# define KFREES(x,s) free(x)
-# define GETIFP(x, v) get_unit(x,v)
-# define COPYIN(a,b,c) (bcopy((a), (b), (c)), 0)
-# define COPYOUT(a,b,c) (bcopy((a), (b), (c)), 0)
-# define BCOPYIN(a,b,c) (bcopy((a), (b), (c)), 0)
-# define BCOPYOUT(a,b,c) (bcopy((a), (b), (c)), 0)
-# define COPYDATA(m, o, l, b) bcopy(MTOD((mb_t *)m, char *) + (o), \
- (b), (l))
-# define COPYBACK(m, o, l, b) bcopy((b), \
- MTOD((mb_t *)m, char *) + (o), \
- (l))
-# define UIOMOVE(a,b,c,d) ipfuiomove(a,b,c,d)
-extern void m_copydata __P((mb_t *, int, int, caddr_t));
-extern int ipfuiomove __P((caddr_t, int, int, struct uio *));
-# ifndef CACHE_HASH
-# define CACHE_HASH(x) ((IFNAME(fin->fin_ifp)[0] + \
- ((struct ifnet *)fin->fin_ifp)->if_unit) & 7)
-# endif
-
-# define MUTEX_DESTROY(x) eMmutex_destroy(&(x)->ipf_emu)
-# define MUTEX_ENTER(x) eMmutex_enter(&(x)->ipf_emu, \
- __FILE__, __LINE__)
-# define MUTEX_EXIT(x) eMmutex_exit(&(x)->ipf_emu)
-# define MUTEX_INIT(x,y) eMmutex_init(&(x)->ipf_emu, y)
-# define MUTEX_NUKE(x) bzero((x), sizeof(*(x)))
-
-# define MUTEX_DOWNGRADE(x) eMrwlock_downgrade(&(x)->ipf_emu, \
- __FILE__, __LINE__)
-# define READ_ENTER(x) eMrwlock_read_enter(&(x)->ipf_emu, \
- __FILE__, __LINE__)
-# define RWLOCK_INIT(x, y) eMrwlock_init(&(x)->ipf_emu, y)
-# define RWLOCK_EXIT(x) eMrwlock_exit(&(x)->ipf_emu)
-# define RW_DESTROY(x) eMrwlock_destroy(&(x)->ipf_emu)
-# define WRITE_ENTER(x) eMrwlock_write_enter(&(x)->ipf_emu, \
- __FILE__, \
- __LINE__)
-
-# define USE_MUTEXES 1
-
-extern void eMmutex_destroy __P((eMmutex_t *));
-extern void eMmutex_enter __P((eMmutex_t *, char *, int));
-extern void eMmutex_exit __P((eMmutex_t *));
-extern void eMmutex_init __P((eMmutex_t *, char *));
-extern void eMrwlock_destroy __P((eMrwlock_t *));
-extern void eMrwlock_exit __P((eMrwlock_t *));
-extern void eMrwlock_init __P((eMrwlock_t *, char *));
-extern void eMrwlock_read_enter __P((eMrwlock_t *, char *, int));
-extern void eMrwlock_write_enter __P((eMrwlock_t *, char *, int));
-extern void eMrwlock_downgrade __P((eMrwlock_t *, char *, int));
-
-#endif
-
-#define MAX_IPV4HDR ((0xf << 2) + sizeof(struct icmp) + sizeof(ip_t) + 8)
-
-#ifndef IP_OFFMASK
-# define IP_OFFMASK 0x1fff
-#endif
-
-
-/*
- * On BSD's use quad_t as a guarantee for getting at least a 64bit sized
- * object.
- */
-#if BSD > 199306
-# define USE_QUAD_T
-# define U_QUAD_T u_quad_t
-# define QUAD_T quad_t
-#else /* BSD > 199306 */
-# define U_QUAD_T u_long
-# define QUAD_T long
-#endif /* BSD > 199306 */
-
-
-#ifdef USE_INET6
-# if defined(__NetBSD__) || defined(__OpenBSD__) || defined(__FreeBSD__) || \
- defined(__osf__) || defined(linux)
-# include <netinet/ip6.h>
-# include <netinet/icmp6.h>
-# if !defined(linux)
-# if defined(_KERNEL) && !defined(__osf__)
-# include <netinet6/ip6_var.h>
-# endif
-# endif
-typedef struct ip6_hdr ip6_t;
-# endif
-#endif
-
-#ifndef MAX
-# define MAX(a,b) (((a) > (b)) ? (a) : (b))
-#endif
-
-#if defined(_KERNEL)
-# ifdef MENTAT
-# define COPYDATA mb_copydata
-# define COPYBACK mb_copyback
-# else
-# define COPYDATA m_copydata
-# define COPYBACK m_copyback
-# endif
-# if (BSD >= 199306) || defined(__FreeBSD__)
-# if (defined(__NetBSD_Version__) && (__NetBSD_Version__ < 105180000)) || \
- defined(__FreeBSD__) || (defined(OpenBSD) && (OpenBSD < 200206)) || \
- defined(_BSDI_VERSION)
-# include <vm/vm.h>
-# endif
-# if !defined(__FreeBSD__) || (defined (__FreeBSD_version) && \
- (__FreeBSD_version >= 300000))
-# if (defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105180000)) || \
- (defined(OpenBSD) && (OpenBSD >= 200111))
-# include <uvm/uvm_extern.h>
-# else
-# include <vm/vm_extern.h>
-extern vm_map_t kmem_map;
-# endif
-# include <sys/proc.h>
-# else /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD_version >= 300000) */
-# include <vm/vm_kern.h>
-# endif /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD_version >= 300000) */
-
-# ifdef IPFILTER_M_IPFILTER
-# include <sys/malloc.h>
-MALLOC_DECLARE(M_IPFILTER);
-# define _M_IPF M_IPFILTER
-# else /* IPFILTER_M_IPFILTER */
-# ifdef M_PFIL
-# define _M_IPF M_PFIL
-# else
-# ifdef M_IPFILTER
-# define _M_IPF M_IPFILTER
-# else
-# define _M_IPF M_TEMP
-# endif /* M_IPFILTER */
-# endif /* M_PFIL */
-# endif /* IPFILTER_M_IPFILTER */
-# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), _M_IPF, M_NOWAIT)
-# define KMALLOCS(a, b, c) MALLOC((a), b, (c), _M_IPF, M_NOWAIT)
-# define KFREE(x) FREE((x), _M_IPF)
-# define KFREES(x,s) FREE((x), _M_IPF)
-# define UIOMOVE(a,b,c,d) uiomove(a,b,d)
-# define SLEEP(id, n) tsleep((id), PPAUSE|PCATCH, n, 0)
-# define WAKEUP(id,x) wakeup(id+x)
-# define GETIFP(n, v) ifunit(n)
-# endif /* (Free)BSD */
-
-# if !defined(USE_MUTEXES) && !defined(SPL_NET)
-# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199407)) || \
- (defined(OpenBSD) && (OpenBSD >= 200006))
-# define SPL_NET(x) x = splsoftnet()
-# else
-# define SPL_IMP(x) x = splimp()
-# define SPL_NET(x) x = splnet()
-# endif /* NetBSD && (NetBSD <= 1991011) && (NetBSD >= 199407) */
-# define SPL_X(x) (void) splx(x)
-# endif /* !USE_MUTEXES */
-
-# ifndef FREE_MB_T
-# define FREE_MB_T(m) m_freem(m)
-# endif
-
-# ifndef MTOD
-# define MTOD(m,t) mtod(m,t)
-# endif
-
-# ifndef COPYIN
-# define COPYIN(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define COPYOUT(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define BCOPYIN(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# define BCOPYOUT(a,b,c) (bcopy((caddr_t)(a), (caddr_t)(b), (c)), 0)
-# endif
-
-# ifndef KMALLOC
-# define KMALLOC(a,b) (a) = (b)new_kmem_alloc(sizeof(*(a)), \
- KMEM_NOSLEEP)
-# define KMALLOCS(a,b,c) (a) = (b)new_kmem_alloc((c), KMEM_NOSLEEP)
-# endif
-
-# ifndef GET_MINOR
-# define GET_MINOR(x) minor(x)
-# endif
-# define PANIC(x,y) if (x) panic y
-#endif /* _KERNEL */
-
-#ifndef IFNAME
-# define IFNAME(x) ((struct ifnet *)x)->if_name
-#endif
-#ifndef COPYIFNAME
-# define NEED_FRGETIFNAME
-extern char *fr_getifname __P((struct ifnet *, char *));
-# define COPYIFNAME(x, b) \
- fr_getifname((struct ifnet *)x, b)
-#endif
-
-#ifndef ASSERT
-# define ASSERT(x)
-#endif
-
-/*
- * Because the ctype(3) posix definition, if used "safely" in code everywhere,
- * would mean all normal code that walks through strings needed casts. Yuck.
- */
-#define ISALNUM(x) isalnum((u_char)(x))
-#define ISALPHA(x) isalpha((u_char)(x))
-#define ISASCII(x) isascii((u_char)(x))
-#define ISDIGIT(x) isdigit((u_char)(x))
-#define ISPRINT(x) isprint((u_char)(x))
-#define ISSPACE(x) isspace((u_char)(x))
-#define ISUPPER(x) isupper((u_char)(x))
-#define ISXDIGIT(x) isxdigit((u_char)(x))
-#define ISLOWER(x) islower((u_char)(x))
-#define TOUPPER(x) toupper((u_char)(x))
-#define TOLOWER(x) tolower((u_char)(x))
-
-/*
- * If mutexes aren't being used, turn all the mutex functions into null-ops.
- */
-#if !defined(USE_MUTEXES)
-# define USE_SPL 1
-# undef RW_DESTROY
-# undef MUTEX_INIT
-# undef MUTEX_NUKE
-# undef MUTEX_DESTROY
-# define MUTEX_ENTER(x) ;
-# define READ_ENTER(x) ;
-# define WRITE_ENTER(x) ;
-# define MUTEX_DOWNGRADE(x) ;
-# define RWLOCK_INIT(x, y) ;
-# define RWLOCK_EXIT(x) ;
-# define RW_DESTROY(x) ;
-# define MUTEX_EXIT(x) ;
-# define MUTEX_INIT(x,y) ;
-# define MUTEX_DESTROY(x) ;
-# define MUTEX_NUKE(x) ;
-#endif /* !USE_MUTEXES */
-#ifndef ATOMIC_INC
-# define ATOMIC_INC(x) (x)++
-# define ATOMIC_DEC(x) (x)--
-#endif
-
-/*
- * If there are no atomic operations for bit sizes defined, define them to all
- * use a generic one that works for all sizes.
- */
-#ifndef ATOMIC_INCL
-# define ATOMIC_INCL ATOMIC_INC
-# define ATOMIC_INC64 ATOMIC_INC
-# define ATOMIC_INC32 ATOMIC_INC
-# define ATOMIC_INC16 ATOMIC_INC
-# define ATOMIC_DECL ATOMIC_DEC
-# define ATOMIC_DEC64 ATOMIC_DEC
-# define ATOMIC_DEC32 ATOMIC_DEC
-# define ATOMIC_DEC16 ATOMIC_DEC
-#endif
-
-#ifndef HDR_T_PRIVATE
-typedef struct tcphdr tcphdr_t;
-typedef struct udphdr udphdr_t;
-#endif
-typedef struct icmp icmphdr_t;
-typedef struct ip ip_t;
-typedef struct ether_header ether_header_t;
-typedef struct tcpiphdr tcpiphdr_t;
-
-#ifndef FR_GROUPLEN
-# define FR_GROUPLEN 16
-#endif
-
-#ifdef offsetof
-# undef offsetof
-#endif
-#ifndef offsetof
-# define offsetof(t,m) (int)((&((t *)0L)->m))
-#endif
-
-/*
- * This set of macros has been brought about because on Tru64 it is not
- * possible to easily assign or examine values in a structure that are
- * bit fields.
- */
-#ifndef IP_V
-# define IP_V(x) (x)->ip_v
-#endif
-#ifndef IP_V_A
-# define IP_V_A(x,y) (x)->ip_v = (y)
-#endif
-#ifndef IP_HL
-# define IP_HL(x) (x)->ip_hl
-#endif
-#ifndef IP_HL_A
-# define IP_HL_A(x,y) (x)->ip_hl = (y)
-#endif
-#ifndef TCP_X2
-# define TCP_X2(x) (x)->th_x2
-#endif
-#ifndef TCP_X2_A
-# define TCP_X2_A(x,y) (x)->th_x2 = (y)
-#endif
-#ifndef TCP_OFF
-# define TCP_OFF(x) (x)->th_off
-#endif
-#ifndef TCP_OFF_A
-# define TCP_OFF_A(x,y) (x)->th_off = (y)
-#endif
-#define IPMINLEN(i, h) ((i)->ip_len >= (IP_HL(i) * 4 + sizeof(struct h)))
-
-
-/*
- * XXX - This is one of those *awful* hacks which nobody likes
- */
-#ifdef ultrix
-#define A_A
-#else
-#define A_A &
-#endif
-
-#define TCPF_ALL (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG|\
- TH_ECN|TH_CWR)
-
-#if (BSD >= 199306) && !defined(m_act)
-# define m_act m_nextpkt
-#endif
-
-/*
- * Security Options for Intenet Protocol (IPSO) as defined in RFC 1108.
- *
- * Basic Option
- *
- * 00000001 - (Reserved 4)
- * 00111101 - Top Secret
- * 01011010 - Secret
- * 10010110 - Confidential
- * 01100110 - (Reserved 3)
- * 11001100 - (Reserved 2)
- * 10101011 - Unclassified
- * 11110001 - (Reserved 1)
- */
-#define IPSO_CLASS_RES4 0x01
-#define IPSO_CLASS_TOPS 0x3d
-#define IPSO_CLASS_SECR 0x5a
-#define IPSO_CLASS_CONF 0x96
-#define IPSO_CLASS_RES3 0x66
-#define IPSO_CLASS_RES2 0xcc
-#define IPSO_CLASS_UNCL 0xab
-#define IPSO_CLASS_RES1 0xf1
-
-#define IPSO_AUTH_GENSER 0x80
-#define IPSO_AUTH_ESI 0x40
-#define IPSO_AUTH_SCI 0x20
-#define IPSO_AUTH_NSA 0x10
-#define IPSO_AUTH_DOE 0x08
-#define IPSO_AUTH_UN 0x06
-#define IPSO_AUTH_FTE 0x01
-
-/*
- * IP option #defines
- */
-#undef IPOPT_RR
-#define IPOPT_RR 7
-#undef IPOPT_ZSU
-#define IPOPT_ZSU 10 /* ZSU */
-#undef IPOPT_MTUP
-#define IPOPT_MTUP 11 /* MTUP */
-#undef IPOPT_MTUR
-#define IPOPT_MTUR 12 /* MTUR */
-#undef IPOPT_ENCODE
-#define IPOPT_ENCODE 15 /* ENCODE */
-#undef IPOPT_TS
-#define IPOPT_TS 68
-#undef IPOPT_TR
-#define IPOPT_TR 82 /* TR */
-#undef IPOPT_SECURITY
-#define IPOPT_SECURITY 130
-#undef IPOPT_LSRR
-#define IPOPT_LSRR 131
-#undef IPOPT_E_SEC
-#define IPOPT_E_SEC 133 /* E-SEC */
-#undef IPOPT_CIPSO
-#define IPOPT_CIPSO 134 /* CIPSO */
-#undef IPOPT_SATID
-#define IPOPT_SATID 136
-#ifndef IPOPT_SID
-# define IPOPT_SID IPOPT_SATID
-#endif
-#undef IPOPT_SSRR
-#define IPOPT_SSRR 137
-#undef IPOPT_ADDEXT
-#define IPOPT_ADDEXT 147 /* ADDEXT */
-#undef IPOPT_VISA
-#define IPOPT_VISA 142 /* VISA */
-#undef IPOPT_IMITD
-#define IPOPT_IMITD 144 /* IMITD */
-#undef IPOPT_EIP
-#define IPOPT_EIP 145 /* EIP */
-#undef IPOPT_RTRALRT
-#define IPOPT_RTRALRT 148 /* RTRALRT */
-#undef IPOPT_SDB
-#define IPOPT_SDB 149
-#undef IPOPT_NSAPA
-#define IPOPT_NSAPA 150
-#undef IPOPT_DPS
-#define IPOPT_DPS 151
-#undef IPOPT_UMP
-#define IPOPT_UMP 152
-#undef IPOPT_FINN
-#define IPOPT_FINN 205 /* FINN */
-
-#ifndef TCPOPT_EOL
-# define TCPOPT_EOL 0
-#endif
-#ifndef TCPOPT_NOP
-# define TCPOPT_NOP 1
-#endif
-#ifndef TCPOPT_MAXSEG
-# define TCPOPT_MAXSEG 2
-#endif
-#ifndef TCPOLEN_MAXSEG
-# define TCPOLEN_MAXSEG 4
-#endif
-#ifndef TCPOPT_WINDOW
-# define TCPOPT_WINDOW 3
-#endif
-#ifndef TCPOLEN_WINDOW
-# define TCPOLEN_WINDOW 3
-#endif
-#ifndef TCPOPT_SACK_PERMITTED
-# define TCPOPT_SACK_PERMITTED 4
-#endif
-#ifndef TCPOLEN_SACK_PERMITTED
-# define TCPOLEN_SACK_PERMITTED 2
-#endif
-#ifndef TCPOPT_SACK
-# define TCPOPT_SACK 5
-#endif
-#ifndef TCPOPT_TIMESTAMP
-# define TCPOPT_TIMESTAMP 8
-#endif
-
-#ifndef ICMP_MINLEN
-# define ICMP_MINLEN 8
-#endif
-#ifndef ICMP_ECHOREPLY
-# define ICMP_ECHOREPLY 0
-#endif
-#ifndef ICMP_UNREACH
-# define ICMP_UNREACH 3
-#endif
-#ifndef ICMP_UNREACH_NET
-# define ICMP_UNREACH_NET 0
-#endif
-#ifndef ICMP_UNREACH_HOST
-# define ICMP_UNREACH_HOST 1
-#endif
-#ifndef ICMP_UNREACH_PROTOCOL
-# define ICMP_UNREACH_PROTOCOL 2
-#endif
-#ifndef ICMP_UNREACH_PORT
-# define ICMP_UNREACH_PORT 3
-#endif
-#ifndef ICMP_UNREACH_NEEDFRAG
-# define ICMP_UNREACH_NEEDFRAG 4
-#endif
-#ifndef ICMP_UNREACH_SRCFAIL
-# define ICMP_UNREACH_SRCFAIL 5
-#endif
-#ifndef ICMP_UNREACH_NET_UNKNOWN
-# define ICMP_UNREACH_NET_UNKNOWN 6
-#endif
-#ifndef ICMP_UNREACH_HOST_UNKNOWN
-# define ICMP_UNREACH_HOST_UNKNOWN 7
-#endif
-#ifndef ICMP_UNREACH_ISOLATED
-# define ICMP_UNREACH_ISOLATED 8
-#endif
-#ifndef ICMP_UNREACH_NET_PROHIB
-# define ICMP_UNREACH_NET_PROHIB 9
-#endif
-#ifndef ICMP_UNREACH_HOST_PROHIB
-# define ICMP_UNREACH_HOST_PROHIB 10
-#endif
-#ifndef ICMP_UNREACH_TOSNET
-# define ICMP_UNREACH_TOSNET 11
-#endif
-#ifndef ICMP_UNREACH_TOSHOST
-# define ICMP_UNREACH_TOSHOST 12
-#endif
-#ifndef ICMP_UNREACH_ADMIN_PROHIBIT
-# define ICMP_UNREACH_ADMIN_PROHIBIT 13
-#endif
-#ifndef ICMP_UNREACH_FILTER
-# define ICMP_UNREACH_FILTER 13
-#endif
-#ifndef ICMP_UNREACH_HOST_PRECEDENCE
-# define ICMP_UNREACH_HOST_PRECEDENCE 14
-#endif
-#ifndef ICMP_UNREACH_PRECEDENCE_CUTOFF
-# define ICMP_UNREACH_PRECEDENCE_CUTOFF 15
-#endif
-#ifndef ICMP_SOURCEQUENCH
-# define ICMP_SOURCEQUENCH 4
-#endif
-#ifndef ICMP_REDIRECT_NET
-# define ICMP_REDIRECT_NET 0
-#endif
-#ifndef ICMP_REDIRECT_HOST
-# define ICMP_REDIRECT_HOST 1
-#endif
-#ifndef ICMP_REDIRECT_TOSNET
-# define ICMP_REDIRECT_TOSNET 2
-#endif
-#ifndef ICMP_REDIRECT_TOSHOST
-# define ICMP_REDIRECT_TOSHOST 3
-#endif
-#ifndef ICMP_ALTHOSTADDR
-# define ICMP_ALTHOSTADDR 6
-#endif
-#ifndef ICMP_TIMXCEED
-# define ICMP_TIMXCEED 11
-#endif
-#ifndef ICMP_TIMXCEED_INTRANS
-# define ICMP_TIMXCEED_INTRANS 0
-#endif
-#ifndef ICMP_TIMXCEED_REASS
-# define ICMP_TIMXCEED_REASS 1
-#endif
-#ifndef ICMP_PARAMPROB
-# define ICMP_PARAMPROB 12
-#endif
-#ifndef ICMP_PARAMPROB_ERRATPTR
-# define ICMP_PARAMPROB_ERRATPTR 0
-#endif
-#ifndef ICMP_PARAMPROB_OPTABSENT
-# define ICMP_PARAMPROB_OPTABSENT 1
-#endif
-#ifndef ICMP_PARAMPROB_LENGTH
-# define ICMP_PARAMPROB_LENGTH 2
-#endif
-#ifndef ICMP_TSTAMP
-# define ICMP_TSTAMP 13
-#endif
-#ifndef ICMP_TSTAMPREPLY
-# define ICMP_TSTAMPREPLY 14
-#endif
-#ifndef ICMP_IREQ
-# define ICMP_IREQ 15
-#endif
-#ifndef ICMP_IREQREPLY
-# define ICMP_IREQREPLY 16
-#endif
-#ifndef ICMP_MASKREQ
-# define ICMP_MASKREQ 17
-#endif
-#ifndef ICMP_MASKREPLY
-# define ICMP_MASKREPLY 18
-#endif
-#ifndef ICMP_TRACEROUTE
-# define ICMP_TRACEROUTE 30
-#endif
-#ifndef ICMP_DATACONVERR
-# define ICMP_DATACONVERR 31
-#endif
-#ifndef ICMP_MOBILE_REDIRECT
-# define ICMP_MOBILE_REDIRECT 32
-#endif
-#ifndef ICMP_IPV6_WHEREAREYOU
-# define ICMP_IPV6_WHEREAREYOU 33
-#endif
-#ifndef ICMP_IPV6_IAMHERE
-# define ICMP_IPV6_IAMHERE 34
-#endif
-#ifndef ICMP_MOBILE_REGREQUEST
-# define ICMP_MOBILE_REGREQUEST 35
-#endif
-#ifndef ICMP_MOBILE_REGREPLY
-# define ICMP_MOBILE_REGREPLY 36
-#endif
-#ifndef ICMP_SKIP
-# define ICMP_SKIP 39
-#endif
-#ifndef ICMP_PHOTURIS
-# define ICMP_PHOTURIS 40
-#endif
-#ifndef ICMP_PHOTURIS_UNKNOWN_INDEX
-# define ICMP_PHOTURIS_UNKNOWN_INDEX 1
-#endif
-#ifndef ICMP_PHOTURIS_AUTH_FAILED
-# define ICMP_PHOTURIS_AUTH_FAILED 2
-#endif
-#ifndef ICMP_PHOTURIS_DECRYPT_FAILED
-# define ICMP_PHOTURIS_DECRYPT_FAILED 3
-#endif
-#ifndef IPVERSION
-# define IPVERSION 4
-#endif
-#ifndef IPOPT_MINOFF
-# define IPOPT_MINOFF 4
-#endif
-#ifndef IPOPT_COPIED
-# define IPOPT_COPIED(x) ((x)&0x80)
-#endif
-#ifndef IPOPT_EOL
-# define IPOPT_EOL 0
-#endif
-#ifndef IPOPT_NOP
-# define IPOPT_NOP 1
-#endif
-#ifndef IP_MF
-# define IP_MF ((u_short)0x2000)
-#endif
-#ifndef ETHERTYPE_IP
-# define ETHERTYPE_IP ((u_short)0x0800)
-#endif
-#ifndef TH_FIN
-# define TH_FIN 0x01
-#endif
-#ifndef TH_SYN
-# define TH_SYN 0x02
-#endif
-#ifndef TH_RST
-# define TH_RST 0x04
-#endif
-#ifndef TH_PUSH
-# define TH_PUSH 0x08
-#endif
-#ifndef TH_ACK
-# define TH_ACK 0x10
-#endif
-#ifndef TH_URG
-# define TH_URG 0x20
-#endif
-#undef TH_ACKMASK
-#define TH_ACKMASK (TH_FIN|TH_SYN|TH_RST|TH_ACK)
-
-#ifndef IPOPT_EOL
-# define IPOPT_EOL 0
-#endif
-#ifndef IPOPT_NOP
-# define IPOPT_NOP 1
-#endif
-#ifndef IPOPT_RR
-# define IPOPT_RR 7
-#endif
-#ifndef IPOPT_TS
-# define IPOPT_TS 68
-#endif
-#ifndef IPOPT_SECURITY
-# define IPOPT_SECURITY 130
-#endif
-#ifndef IPOPT_LSRR
-# define IPOPT_LSRR 131
-#endif
-#ifndef IPOPT_SATID
-# define IPOPT_SATID 136
-#endif
-#ifndef IPOPT_SSRR
-# define IPOPT_SSRR 137
-#endif
-#ifndef IPOPT_SECUR_UNCLASS
-# define IPOPT_SECUR_UNCLASS ((u_short)0x0000)
-#endif
-#ifndef IPOPT_SECUR_CONFID
-# define IPOPT_SECUR_CONFID ((u_short)0xf135)
-#endif
-#ifndef IPOPT_SECUR_EFTO
-# define IPOPT_SECUR_EFTO ((u_short)0x789a)
-#endif
-#ifndef IPOPT_SECUR_MMMM
-# define IPOPT_SECUR_MMMM ((u_short)0xbc4d)
-#endif
-#ifndef IPOPT_SECUR_RESTR
-# define IPOPT_SECUR_RESTR ((u_short)0xaf13)
-#endif
-#ifndef IPOPT_SECUR_SECRET
-# define IPOPT_SECUR_SECRET ((u_short)0xd788)
-#endif
-#ifndef IPOPT_SECUR_TOPSECRET
-# define IPOPT_SECUR_TOPSECRET ((u_short)0x6bc5)
-#endif
-#ifndef IPOPT_OLEN
-# define IPOPT_OLEN 1
-#endif
-#ifndef IPPROTO_HOPOPTS
-# define IPPROTO_HOPOPTS 0
-#endif
-#ifndef IPPROTO_ENCAP
-# define IPPROTO_ENCAP 4
-#endif
-#ifndef IPPROTO_IPV6
-# define IPPROTO_IPV6 41
-#endif
-#ifndef IPPROTO_ROUTING
-# define IPPROTO_ROUTING 43
-#endif
-#ifndef IPPROTO_FRAGMENT
-# define IPPROTO_FRAGMENT 44
-#endif
-#ifndef IPPROTO_GRE
-# define IPPROTO_GRE 47 /* GRE encaps RFC 1701 */
-#endif
-#ifndef IPPROTO_ESP
-# define IPPROTO_ESP 50
-#endif
-#ifndef IPPROTO_AH
-# define IPPROTO_AH 51
-#endif
-#ifndef IPPROTO_ICMPV6
-# define IPPROTO_ICMPV6 58
-#endif
-#ifndef IPPROTO_NONE
-# define IPPROTO_NONE 59
-#endif
-#ifndef IPPROTO_DSTOPTS
-# define IPPROTO_DSTOPTS 60
-#endif
-#ifndef IPPROTO_FRAGMENT
-# define IPPROTO_FRAGMENT 44
-#endif
-#ifndef ICMP_ROUTERADVERT
-# define ICMP_ROUTERADVERT 9
-#endif
-#ifndef ICMP_ROUTERSOLICIT
-# define ICMP_ROUTERSOLICIT 10
-#endif
-#ifndef ICMP6_DST_UNREACH
-# define ICMP6_DST_UNREACH 1
-#endif
-#ifndef ICMP6_PACKET_TOO_BIG
-# define ICMP6_PACKET_TOO_BIG 2
-#endif
-#ifndef ICMP6_TIME_EXCEEDED
-# define ICMP6_TIME_EXCEEDED 3
-#endif
-#ifndef ICMP6_PARAM_PROB
-# define ICMP6_PARAM_PROB 4
-#endif
-
-#ifndef ICMP6_ECHO_REQUEST
-# define ICMP6_ECHO_REQUEST 128
-#endif
-#ifndef ICMP6_ECHO_REPLY
-# define ICMP6_ECHO_REPLY 129
-#endif
-#ifndef ICMP6_MEMBERSHIP_QUERY
-# define ICMP6_MEMBERSHIP_QUERY 130
-#endif
-#ifndef MLD6_LISTENER_QUERY
-# define MLD6_LISTENER_QUERY 130
-#endif
-#ifndef ICMP6_MEMBERSHIP_REPORT
-# define ICMP6_MEMBERSHIP_REPORT 131
-#endif
-#ifndef MLD6_LISTENER_REPORT
-# define MLD6_LISTENER_REPORT 131
-#endif
-#ifndef ICMP6_MEMBERSHIP_REDUCTION
-# define ICMP6_MEMBERSHIP_REDUCTION 132
-#endif
-#ifndef MLD6_LISTENER_DONE
-# define MLD6_LISTENER_DONE 132
-#endif
-#ifndef ND_ROUTER_SOLICIT
-# define ND_ROUTER_SOLICIT 133
-#endif
-#ifndef ND_ROUTER_ADVERT
-# define ND_ROUTER_ADVERT 134
-#endif
-#ifndef ND_NEIGHBOR_SOLICIT
-# define ND_NEIGHBOR_SOLICIT 135
-#endif
-#ifndef ND_NEIGHBOR_ADVERT
-# define ND_NEIGHBOR_ADVERT 136
-#endif
-#ifndef ND_REDIRECT
-# define ND_REDIRECT 137
-#endif
-#ifndef ICMP6_ROUTER_RENUMBERING
-# define ICMP6_ROUTER_RENUMBERING 138
-#endif
-#ifndef ICMP6_WRUREQUEST
-# define ICMP6_WRUREQUEST 139
-#endif
-#ifndef ICMP6_WRUREPLY
-# define ICMP6_WRUREPLY 140
-#endif
-#ifndef ICMP6_FQDN_QUERY
-# define ICMP6_FQDN_QUERY 139
-#endif
-#ifndef ICMP6_FQDN_REPLY
-# define ICMP6_FQDN_REPLY 140
-#endif
-#ifndef ICMP6_NI_QUERY
-# define ICMP6_NI_QUERY 139
-#endif
-#ifndef ICMP6_NI_REPLY
-# define ICMP6_NI_REPLY 140
-#endif
-#ifndef MLD6_MTRACE_RESP
-# define MLD6_MTRACE_RESP 200
-#endif
-#ifndef MLD6_MTRACE
-# define MLD6_MTRACE 201
-#endif
-#ifndef ICMP6_HADISCOV_REQUEST
-# define ICMP6_HADISCOV_REQUEST 202
-#endif
-#ifndef ICMP6_HADISCOV_REPLY
-# define ICMP6_HADISCOV_REPLY 203
-#endif
-#ifndef ICMP6_MOBILEPREFIX_SOLICIT
-# define ICMP6_MOBILEPREFIX_SOLICIT 204
-#endif
-#ifndef ICMP6_MOBILEPREFIX_ADVERT
-# define ICMP6_MOBILEPREFIX_ADVERT 205
-#endif
-#ifndef ICMP6_MAXTYPE
-# define ICMP6_MAXTYPE 205
-#endif
-
-#ifndef ICMP6_DST_UNREACH_NOROUTE
-# define ICMP6_DST_UNREACH_NOROUTE 0
-#endif
-#ifndef ICMP6_DST_UNREACH_ADMIN
-# define ICMP6_DST_UNREACH_ADMIN 1
-#endif
-#ifndef ICMP6_DST_UNREACH_NOTNEIGHBOR
-# define ICMP6_DST_UNREACH_NOTNEIGHBOR 2
-#endif
-#ifndef ICMP6_DST_UNREACH_BEYONDSCOPE
-# define ICMP6_DST_UNREACH_BEYONDSCOPE 2
-#endif
-#ifndef ICMP6_DST_UNREACH_ADDR
-# define ICMP6_DST_UNREACH_ADDR 3
-#endif
-#ifndef ICMP6_DST_UNREACH_NOPORT
-# define ICMP6_DST_UNREACH_NOPORT 4
-#endif
-#ifndef ICMP6_TIME_EXCEED_TRANSIT
-# define ICMP6_TIME_EXCEED_TRANSIT 0
-#endif
-#ifndef ICMP6_TIME_EXCEED_REASSEMBLY
-# define ICMP6_TIME_EXCEED_REASSEMBLY 1
-#endif
-
-#ifndef ICMP6_NI_SUCCESS
-# define ICMP6_NI_SUCCESS 0
-#endif
-#ifndef ICMP6_NI_REFUSED
-# define ICMP6_NI_REFUSED 1
-#endif
-#ifndef ICMP6_NI_UNKNOWN
-# define ICMP6_NI_UNKNOWN 2
-#endif
-
-#ifndef ICMP6_ROUTER_RENUMBERING_COMMAND
-# define ICMP6_ROUTER_RENUMBERING_COMMAND 0
-#endif
-#ifndef ICMP6_ROUTER_RENUMBERING_RESULT
-# define ICMP6_ROUTER_RENUMBERING_RESULT 1
-#endif
-#ifndef ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET
-# define ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET 255
-#endif
-
-#ifndef ICMP6_PARAMPROB_HEADER
-# define ICMP6_PARAMPROB_HEADER 0
-#endif
-#ifndef ICMP6_PARAMPROB_NEXTHEADER
-# define ICMP6_PARAMPROB_NEXTHEADER 1
-#endif
-#ifndef ICMP6_PARAMPROB_OPTION
-# define ICMP6_PARAMPROB_OPTION 2
-#endif
-
-#ifndef ICMP6_NI_SUBJ_IPV6
-# define ICMP6_NI_SUBJ_IPV6 0
-#endif
-#ifndef ICMP6_NI_SUBJ_FQDN
-# define ICMP6_NI_SUBJ_FQDN 1
-#endif
-#ifndef ICMP6_NI_SUBJ_IPV4
-# define ICMP6_NI_SUBJ_IPV4 2
-#endif
-
-/*
- * ECN is a new addition to TCP - RFC 2481
- */
-#ifndef TH_ECN
-# define TH_ECN 0x40
-#endif
-#ifndef TH_CWR
-# define TH_CWR 0x80
-#endif
-#define TH_ECNALL (TH_ECN|TH_CWR)
-
-/*
- * TCP States
- */
-#define IPF_TCPS_CLOSED 0 /* closed */
-#define IPF_TCPS_LISTEN 1 /* listening for connection */
-#define IPF_TCPS_SYN_SENT 2 /* active, have sent syn */
-#define IPF_TCPS_SYN_RECEIVED 3 /* have send and received syn */
-#define IPF_TCPS_HALF_ESTAB 4 /* for connections not fully "up" */
-/* states < IPF_TCPS_ESTABLISHED are those where connections not established */
-#define IPF_TCPS_ESTABLISHED 5 /* established */
-#define IPF_TCPS_CLOSE_WAIT 6 /* rcvd fin, waiting for close */
-/* states > IPF_TCPS_CLOSE_WAIT are those where user has closed */
-#define IPF_TCPS_FIN_WAIT_1 7 /* have closed, sent fin */
-#define IPF_TCPS_CLOSING 8 /* closed xchd FIN; await FIN ACK */
-#define IPF_TCPS_LAST_ACK 9 /* had fin and close; await FIN ACK */
-/* states > IPF_TCPS_CLOSE_WAIT && < IPF_TCPS_FIN_WAIT_2 await ACK of FIN */
-#define IPF_TCPS_FIN_WAIT_2 10 /* have closed, fin is acked */
-#define IPF_TCPS_TIME_WAIT 11 /* in 2*msl quiet wait after close */
-#define IPF_TCP_NSTATES 12
-
-#define TCP_MSL 120
-
-#undef ICMP_MAX_UNREACH
-#define ICMP_MAX_UNREACH 14
-#undef ICMP_MAXTYPE
-#define ICMP_MAXTYPE 18
-
-#ifndef IFNAMSIZ
-#define IFNAMSIZ 16
-#endif
-
-#ifndef LOG_FTP
-# define LOG_FTP (11<<3)
-#endif
-#ifndef LOG_AUTHPRIV
-# define LOG_AUTHPRIV (10<<3)
-#endif
-#ifndef LOG_AUDIT
-# define LOG_AUDIT (13<<3)
-#endif
-#ifndef LOG_NTP
-# define LOG_NTP (12<<3)
-#endif
-#ifndef LOG_SECURITY
-# define LOG_SECURITY (13<<3)
-#endif
-#ifndef LOG_LFMT
-# define LOG_LFMT (14<<3)
-#endif
-#ifndef LOG_CONSOLE
-# define LOG_CONSOLE (14<<3)
-#endif
-
-/*
- * ICMP error replies have an IP header (20 bytes), 8 bytes of ICMP data,
- * another IP header and then 64 bits of data, totalling 56. Of course,
- * the last 64 bits is dependant on that being available.
- */
-#define ICMPERR_ICMPHLEN 8
-#define ICMPERR_IPICMPHLEN (20 + 8)
-#define ICMPERR_MINPKTLEN (20 + 8 + 20)
-#define ICMPERR_MAXPKTLEN (20 + 8 + 20 + 8)
-#define ICMP6ERR_MINPKTLEN (40 + 8)
-#define ICMP6ERR_IPICMPHLEN (40 + 8 + 40)
-
-#ifndef MIN
-# define MIN(a,b) (((a)<(b))?(a):(b))
-#endif
-
-#ifdef IPF_DEBUG
-# define DPRINT(x) printf x
-#else
-# define DPRINT(x)
-#endif
-
-#endif /* __IP_COMPAT_H__ */
diff --git a/contrib/ipfilter/ip_fil.h b/contrib/ipfilter/ip_fil.h
deleted file mode 100644
index 2aacb3f0af78..000000000000
--- a/contrib/ipfilter/ip_fil.h
+++ /dev/null
@@ -1,1368 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2001, 2003 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- *
- * @(#)ip_fil.h 1.35 6/5/96
- * Id: ip_fil.h,v 2.170.2.18 2005/03/28 10:47:52 darrenr Exp
- */
-
-#ifndef __IP_FIL_H__
-#define __IP_FIL_H__
-
-#ifndef SOLARIS
-# define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
-#endif
-
-#ifndef __P
-# ifdef __STDC__
-# define __P(x) x
-# else
-# define __P(x) ()
-# endif
-#endif
-
-#if defined(__STDC__) || defined(__GNUC__)
-# define SIOCADAFR _IOW('r', 60, struct ipfobj)
-# define SIOCRMAFR _IOW('r', 61, struct ipfobj)
-# define SIOCSETFF _IOW('r', 62, u_int)
-# define SIOCGETFF _IOR('r', 63, u_int)
-# define SIOCGETFS _IOWR('r', 64, struct ipfobj)
-# define SIOCIPFFL _IOWR('r', 65, int)
-# define SIOCIPFFB _IOR('r', 66, int)
-# define SIOCADIFR _IOW('r', 67, struct ipfobj)
-# define SIOCRMIFR _IOW('r', 68, struct ipfobj)
-# define SIOCSWAPA _IOR('r', 69, u_int)
-# define SIOCINAFR _IOW('r', 70, struct ipfobj)
-# define SIOCINIFR _IOW('r', 71, struct ipfobj)
-# define SIOCFRENB _IOW('r', 72, u_int)
-# define SIOCFRSYN _IOW('r', 73, u_int)
-# define SIOCFRZST _IOWR('r', 74, struct ipfobj)
-# define SIOCZRLST _IOWR('r', 75, struct ipfobj)
-# define SIOCAUTHW _IOWR('r', 76, struct ipfobj)
-# define SIOCAUTHR _IOWR('r', 77, struct ipfobj)
-# define SIOCATHST _IOWR('r', 78, struct ipfobj)
-# define SIOCSTLCK _IOWR('r', 79, u_int)
-# define SIOCSTPUT _IOWR('r', 80, struct ipfobj)
-# define SIOCSTGET _IOWR('r', 81, struct ipfobj)
-# define SIOCSTGSZ _IOWR('r', 82, struct ipfobj)
-# define SIOCGFRST _IOWR('r', 83, struct ipfobj)
-# define SIOCSETLG _IOWR('r', 84, int)
-# define SIOCGETLG _IOWR('r', 85, int)
-# define SIOCFUNCL _IOWR('r', 86, struct ipfunc_resolve)
-# define SIOCIPFGETNEXT _IOWR('r', 87, struct ipfobj)
-# define SIOCIPFGET _IOWR('r', 88, struct ipfobj)
-# define SIOCIPFSET _IOWR('r', 89, struct ipfobj)
-# define SIOCIPFL6 _IOWR('r', 90, int)
-#else
-# define SIOCADAFR _IOW(r, 60, struct ipfobj)
-# define SIOCRMAFR _IOW(r, 61, struct ipfobj)
-# define SIOCSETFF _IOW(r, 62, u_int)
-# define SIOCGETFF _IOR(r, 63, u_int)
-# define SIOCGETFS _IOWR(r, 64, struct ipfobj)
-# define SIOCIPFFL _IOWR(r, 65, int)
-# define SIOCIPFFB _IOR(r, 66, int)
-# define SIOCADIFR _IOW(r, 67, struct ipfobj)
-# define SIOCRMIFR _IOW(r, 68, struct ipfobj)
-# define SIOCSWAPA _IOR(r, 69, u_int)
-# define SIOCINAFR _IOW(r, 70, struct ipfobj)
-# define SIOCINIFR _IOW(r, 71, struct ipfobj)
-# define SIOCFRENB _IOW(r, 72, u_int)
-# define SIOCFRSYN _IOW(r, 73, u_int)
-# define SIOCFRZST _IOWR(r, 74, struct ipfobj)
-# define SIOCZRLST _IOWR(r, 75, struct ipfobj)
-# define SIOCAUTHW _IOWR(r, 76, struct ipfobj)
-# define SIOCAUTHR _IOWR(r, 77, struct ipfobj)
-# define SIOCATHST _IOWR(r, 78, struct ipfobj)
-# define SIOCSTLCK _IOWR(r, 79, u_int)
-# define SIOCSTPUT _IOWR(r, 80, struct ipfobj)
-# define SIOCSTGET _IOWR(r, 81, struct ipfobj)
-# define SIOCSTGSZ _IOWR(r, 82, struct ipfobj)
-# define SIOCGFRST _IOWR(r, 83, struct ipfobj)
-# define SIOCSETLG _IOWR(r, 84, int)
-# define SIOCGETLG _IOWR(r, 85, int)
-# define SIOCFUNCL _IOWR(r, 86, struct ipfunc_resolve)
-# define SIOCIPFGETNEXT _IOWR(r, 87, struct ipfobj)
-# define SIOCIPFGET _IOWR(r, 88, struct ipfobj)
-# define SIOCIPFSET _IOWR(r, 89, struct ipfobj)
-# define SIOCIPFL6 _IOWR(r, 90, int)
-#endif
-#define SIOCADDFR SIOCADAFR
-#define SIOCDELFR SIOCRMAFR
-#define SIOCINSFR SIOCINAFR
-
-
-struct ipscan;
-struct ifnet;
-
-
-typedef int (* lookupfunc_t) __P((void *, int, void *));
-
-/*
- * i6addr is used as a container for both IPv4 and IPv6 addresses, as well
- * as other types of objects, depending on its qualifier.
- */
-#ifdef USE_INET6
-typedef union i6addr {
- u_32_t i6[4];
- struct in_addr in4;
- struct in6_addr in6;
- void *vptr[2];
- lookupfunc_t lptr[2];
-} i6addr_t;
-#else
-typedef union i6addr {
- u_32_t i6[4];
- struct in_addr in4;
- void *vptr[2];
- lookupfunc_t lptr[2];
-} i6addr_t;
-#endif
-
-#define in4_addr in4.s_addr
-#define iplookupnum i6[0]
-#define iplookuptype i6[1]
-/*
- * NOTE: These DO overlap the above on 64bit systems and this IS recognised.
- */
-#define iplookupptr vptr[0]
-#define iplookupfunc lptr[1]
-
-#define I60(x) (((i6addr_t *)(x))->i6[0])
-#define I61(x) (((i6addr_t *)(x))->i6[1])
-#define I62(x) (((i6addr_t *)(x))->i6[2])
-#define I63(x) (((i6addr_t *)(x))->i6[3])
-#define HI60(x) ntohl(((i6addr_t *)(x))->i6[0])
-#define HI61(x) ntohl(((i6addr_t *)(x))->i6[1])
-#define HI62(x) ntohl(((i6addr_t *)(x))->i6[2])
-#define HI63(x) ntohl(((i6addr_t *)(x))->i6[3])
-
-#define IP6_EQ(a,b) ((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
- (I61(a) == I61(b)) && (I60(a) == I60(b)))
-#define IP6_NEQ(a,b) ((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
- (I61(a) != I61(b)) || (I60(a) != I60(b)))
-#define IP6_ISZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
-#define IP6_NOTZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
-#define IP6_GT(a,b) (HI60(a) > HI60(b) || (HI60(a) == HI60(b) && \
- (HI61(a) > HI61(b) || (HI61(a) == HI61(b) && \
- (HI62(a) > HI62(b) || (HI62(a) == HI62(b) && \
- HI63(a) > HI63(b)))))))
-#define IP6_LT(a,b) (HI60(a) < HI60(b) || (HI60(a) == HI60(b) && \
- (HI61(a) < HI61(b) || (HI61(a) == HI61(b) && \
- (HI62(a) < HI62(b) || (HI62(a) == HI62(b) && \
- HI63(a) < HI63(b)))))))
-#define NLADD(n,x) htonl(ntohl(n) + (x))
-#define IP6_INC(a) \
- { i6addr_t *_i6 = (i6addr_t *)(a); \
- _i6->i6[0] = NLADD(_i6->i6[0], 1); \
- if (_i6->i6[0] == 0) { \
- _i6->i6[0] = NLADD(_i6->i6[1], 1); \
- if (_i6->i6[1] == 0) { \
- _i6->i6[0] = NLADD(_i6->i6[2], 1); \
- if (_i6->i6[2] == 0) { \
- _i6->i6[0] = NLADD(_i6->i6[3], 1); \
- } \
- } \
- } \
- }
-#define IP6_ADD(a,x,d) \
- { i6addr_t *_s = (i6addr_t *)(a); \
- i6addr_t *_d = (i6addr_t *)(d); \
- _d->i6[0] = NLADD(_s->i6[0], x); \
- if (ntohl(_d->i6[0]) < ntohl(_s->i6[0])) { \
- _d->i6[1] = NLADD(_d->i6[1], 1); \
- if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
- _d->i6[2] = NLADD(_d->i6[2], 1); \
- if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
- _d->i6[3] = NLADD(_d->i6[3], 1); \
- } \
- } \
- } \
- }
-#define IP6_AND(a,b,d) { i6addr_t *_s1 = (i6addr_t *)(a); \
- i6addr_t *_s2 = (i6addr_t *)(d); \
- i6addr_t *_d = (i6addr_t *)(d); \
- _d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
- _d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
- _d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
- _d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
- }
-#define IP6_MERGE(a,b,c) \
- { i6addr_t *_d, *_s1, *_s2; \
- _d = (i6addr_t *)(a); \
- _s1 = (i6addr_t *)(b); \
- _s2 = (i6addr_t *)(c); \
- _d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
- _d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
- _d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
- _d->i6[2] |= _s1->i6[3] & ~_s2->i6[3]; \
- }
-
-
-typedef struct fr_ip {
- u_32_t fi_v:4; /* IP version */
- u_32_t fi_xx:4; /* spare */
- u_32_t fi_tos:8; /* IP packet TOS */
- u_32_t fi_ttl:8; /* IP packet TTL */
- u_32_t fi_p:8; /* IP packet protocol */
- u_32_t fi_optmsk; /* bitmask composed from IP options */
- i6addr_t fi_src; /* source address from packet */
- i6addr_t fi_dst; /* destination address from packet */
- u_short fi_secmsk; /* bitmask composed from IP security options */
- u_short fi_auth; /* authentication code from IP sec. options */
- u_32_t fi_flx; /* packet flags */
- u_32_t fi_tcpmsk; /* TCP options set/reset */
- u_32_t fi_res1; /* RESERVED */
-} fr_ip_t;
-
-/*
- * For use in fi_flx
- */
-#define FI_TCPUDP 0x0001 /* TCP/UCP implied comparison*/
-#define FI_OPTIONS 0x0002
-#define FI_FRAG 0x0004
-#define FI_SHORT 0x0008
-#define FI_NATED 0x0010
-#define FI_MULTICAST 0x0020
-#define FI_BROADCAST 0x0040
-#define FI_MBCAST 0x0080
-#define FI_STATE 0x0100
-#define FI_BADNAT 0x0200
-#define FI_BAD 0x0400
-#define FI_OOW 0x0800 /* Out of state window, else match */
-#define FI_ICMPERR 0x1000
-#define FI_FRAGBODY 0x2000
-#define FI_BADSRC 0x4000
-#define FI_LOWTTL 0x8000
-#define FI_CMP 0xcfe3 /* Not FI_FRAG,FI_NATED,FI_FRAGTAIL */
-#define FI_ICMPCMP 0x0003 /* Flags we can check for ICMP error packets */
-#define FI_WITH 0xeffe /* Not FI_TCPUDP */
-#define FI_V6EXTHDR 0x10000
-#define FI_COALESCE 0x20000
-#define FI_NOCKSUM 0x20000000 /* don't do a L4 checksum validation */
-#define FI_DONTCACHE 0x40000000 /* don't cache the result */
-#define FI_IGNORE 0x80000000
-
-#define fi_saddr fi_src.in4.s_addr
-#define fi_daddr fi_dst.in4.s_addr
-#define fi_srcnum fi_src.iplookupnum
-#define fi_dstnum fi_dst.iplookupnum
-#define fi_srctype fi_src.iplookuptype
-#define fi_dsttype fi_dst.iplookuptype
-#define fi_srcptr fi_src.iplookupptr
-#define fi_dstptr fi_dst.iplookupptr
-#define fi_srcfunc fi_src.iplookupfunc
-#define fi_dstfunc fi_dst.iplookupfunc
-
-
-/*
- * These are both used by the state and NAT code to indicate that one port or
- * the other should be treated as a wildcard.
- * NOTE: When updating, check bit masks in ip_state.h and update there too.
- */
-#define SI_W_SPORT 0x00000100
-#define SI_W_DPORT 0x00000200
-#define SI_WILDP (SI_W_SPORT|SI_W_DPORT)
-#define SI_W_SADDR 0x00000400
-#define SI_W_DADDR 0x00000800
-#define SI_WILDA (SI_W_SADDR|SI_W_DADDR)
-#define SI_NEWFR 0x00001000
-#define SI_CLONE 0x00002000
-#define SI_CLONED 0x00004000
-
-
-typedef struct fr_info {
- void *fin_ifp; /* interface packet is `on' */
- fr_ip_t fin_fi; /* IP Packet summary */
- union {
- u_short fid_16[2]; /* TCP/UDP ports, ICMP code/type */
- u_32_t fid_32;
- } fin_dat;
- int fin_out; /* in or out ? 1 == out, 0 == in */
- int fin_rev; /* state only: 1 = reverse */
- u_short fin_hlen; /* length of IP header in bytes */
- u_char fin_tcpf; /* TCP header flags (SYN, ACK, etc) */
- u_char fin_icode; /* ICMP error to return */
- u_32_t fin_rule; /* rule # last matched */
- char fin_group[FR_GROUPLEN]; /* group number, -1 for none */
- struct frentry *fin_fr; /* last matching rule */
- void *fin_dp; /* start of data past IP header */
- int fin_dlen; /* length of data portion of packet */
- int fin_plen;
- int fin_ipoff; /* # bytes from buffer start to hdr */
- u_short fin_id; /* IP packet id field */
- u_short fin_off;
- int fin_depth; /* Group nesting depth */
- int fin_error; /* Error code to return */
- void *fin_nat;
- void *fin_state;
- void *fin_nattag;
- ip_t *fin_ip;
- mb_t **fin_mp; /* pointer to pointer to mbuf */
- mb_t *fin_m; /* pointer to mbuf */
-#ifdef MENTAT
- mb_t *fin_qfm; /* pointer to mblk where pkt starts */
- void *fin_qpi;
-#endif
-#ifdef __sgi
- void *fin_hbuf;
-#endif
-} fr_info_t;
-
-#define fin_v fin_fi.fi_v
-#define fin_p fin_fi.fi_p
-#define fin_flx fin_fi.fi_flx
-#define fin_optmsk fin_fi.fi_optmsk
-#define fin_secmsk fin_fi.fi_secmsk
-#define fin_auth fin_fi.fi_auth
-#define fin_src fin_fi.fi_src.in4
-#define fin_src6 fin_fi.fi_src.in6
-#define fin_saddr fin_fi.fi_saddr
-#define fin_dst fin_fi.fi_dst.in4
-#define fin_dst6 fin_fi.fi_dst.in6
-#define fin_daddr fin_fi.fi_daddr
-#define fin_data fin_dat.fid_16
-#define fin_sport fin_dat.fid_16[0]
-#define fin_dport fin_dat.fid_16[1]
-#define fin_ports fin_dat.fid_32
-
-#define IPF_IN 0
-#define IPF_OUT 1
-
-typedef struct frentry *(*ipfunc_t) __P((fr_info_t *, u_32_t *));
-typedef int (*ipfuncinit_t) __P((struct frentry *));
-
-typedef struct ipfunc_resolve {
- char ipfu_name[32];
- ipfunc_t ipfu_addr;
- ipfuncinit_t ipfu_init;
-} ipfunc_resolve_t;
-
-/*
- * Size for compares on fr_info structures
- */
-#define FI_CSIZE offsetof(fr_info_t, fin_icode)
-#define FI_LCSIZE offsetof(fr_info_t, fin_dp)
-
-/*
- * Size for copying cache fr_info structure
- */
-#define FI_COPYSIZE offsetof(fr_info_t, fin_dp)
-
-/*
- * Structure for holding IPFilter's tag information
- */
-#define IPFTAG_LEN 16
-typedef struct {
- union {
- u_32_t iptu_num[4];
- char iptu_tag[IPFTAG_LEN];
- } ipt_un;
- int ipt_not;
-} ipftag_t;
-
-#define ipt_tag ipt_un.iptu_tag
-#define ipt_num ipt_un.iptu_num
-
-
-/*
- * This structure is used to hold information about the next hop for where
- * to forward a packet.
- */
-typedef struct frdest {
- void *fd_ifp;
- i6addr_t fd_ip6;
- char fd_ifname[LIFNAMSIZ];
-} frdest_t;
-
-#define fd_ip fd_ip6.in4
-
-
-/*
- * This structure holds information about a port comparison.
- */
-typedef struct frpcmp {
- int frp_cmp; /* data for port comparisons */
- u_short frp_port; /* top port for <> and >< */
- u_short frp_top; /* top port for <> and >< */
-} frpcmp_t;
-
-#define FR_NONE 0
-#define FR_EQUAL 1
-#define FR_NEQUAL 2
-#define FR_LESST 3
-#define FR_GREATERT 4
-#define FR_LESSTE 5
-#define FR_GREATERTE 6
-#define FR_OUTRANGE 7
-#define FR_INRANGE 8
-#define FR_INCRANGE 9
-
-/*
- * Structure containing all the relevant TCP things that can be checked in
- * a filter rule.
- */
-typedef struct frtuc {
- u_char ftu_tcpfm; /* tcp flags mask */
- u_char ftu_tcpf; /* tcp flags */
- frpcmp_t ftu_src;
- frpcmp_t ftu_dst;
-} frtuc_t;
-
-#define ftu_scmp ftu_src.frp_cmp
-#define ftu_dcmp ftu_dst.frp_cmp
-#define ftu_sport ftu_src.frp_port
-#define ftu_dport ftu_dst.frp_port
-#define ftu_stop ftu_src.frp_top
-#define ftu_dtop ftu_dst.frp_top
-
-#define FR_TCPFMAX 0x3f
-
-/*
- * This structure makes up what is considered to be the IPFilter specific
- * matching components of a filter rule, as opposed to the data structures
- * used to define the result which are in frentry_t and not here.
- */
-typedef struct fripf {
- fr_ip_t fri_ip;
- fr_ip_t fri_mip; /* mask structure */
-
- u_short fri_icmpm; /* data for ICMP packets (mask) */
- u_short fri_icmp;
-
- frtuc_t fri_tuc;
- int fri_satype; /* addres type */
- int fri_datype; /* addres type */
- int fri_sifpidx; /* doing dynamic addressing */
- int fri_difpidx; /* index into fr_ifps[] to use when */
-} fripf_t;
-
-#define fri_dstnum fri_ip.fi_dstnum
-#define fri_srcnum fri_mip.fi_srcnum
-#define fri_dstptr fri_ip.fi_dstptr
-#define fri_srcptr fri_mip.fi_srcptr
-
-#define FRI_NORMAL 0 /* Normal address */
-#define FRI_DYNAMIC 1 /* dynamic address */
-#define FRI_LOOKUP 2 /* address is a pool # */
-#define FRI_RANGE 3 /* address/mask is a range */
-#define FRI_NETWORK 4 /* network address from if */
-#define FRI_BROADCAST 5 /* broadcast address from if */
-#define FRI_PEERADDR 6 /* Peer address for P-to-P */
-#define FRI_NETMASKED 7 /* network address with netmask from if */
-
-
-typedef struct frentry * (* frentfunc_t) __P((fr_info_t *));
-
-typedef struct frentry {
- ipfmutex_t fr_lock;
- struct frentry *fr_next;
- struct frentry **fr_grp;
- struct ipscan *fr_isc;
- void *fr_ifas[4];
- void *fr_ptr; /* for use with fr_arg */
- char *fr_comment; /* text comment for rule */
- int fr_ref; /* reference count - for grouping */
- int fr_statecnt; /* state count - for limit rules */
- /*
- * These are only incremented when a packet matches this rule and
- * it is the last match
- */
- U_QUAD_T fr_hits;
- U_QUAD_T fr_bytes;
-
- /*
- * For PPS rate limiting
- */
- struct timeval fr_lastpkt;
- int fr_curpps;
-
- union {
- void *fru_data;
- caddr_t fru_caddr;
- fripf_t *fru_ipf;
- frentfunc_t fru_func;
- } fr_dun;
-
- /*
- * Fields after this may not change whilst in the kernel.
- */
- ipfunc_t fr_func; /* call this function */
- int fr_dsize;
- int fr_pps;
- int fr_statemax; /* max reference count */
- int fr_flineno; /* line number from conf file */
- u_32_t fr_type;
- u_32_t fr_flags; /* per-rule flags && options (see below) */
- u_32_t fr_logtag; /* user defined log tag # */
- u_32_t fr_collect; /* collection number */
- u_int fr_arg; /* misc. numeric arg for rule */
- u_int fr_loglevel; /* syslog log facility + priority */
- u_int fr_age[2]; /* non-TCP timeouts */
- u_char fr_v;
- u_char fr_icode; /* return ICMP code */
- char fr_group[FR_GROUPLEN]; /* group to which this rule belongs */
- char fr_grhead[FR_GROUPLEN]; /* group # which this rule starts */
- ipftag_t fr_nattag;
- char fr_ifnames[4][LIFNAMSIZ];
- char fr_isctag[16];
- frdest_t fr_tifs[2]; /* "to"/"reply-to" interface */
- frdest_t fr_dif; /* duplicate packet interface */
- /*
- * This must be last and will change after loaded into the kernel.
- */
- u_int fr_cksum; /* checksum on filter rules for performance */
-} frentry_t;
-
-#define fr_caddr fr_dun.fru_caddr
-#define fr_data fr_dun.fru_data
-#define fr_dfunc fr_dun.fru_func
-#define fr_ipf fr_dun.fru_ipf
-#define fr_ip fr_ipf->fri_ip
-#define fr_mip fr_ipf->fri_mip
-#define fr_icmpm fr_ipf->fri_icmpm
-#define fr_icmp fr_ipf->fri_icmp
-#define fr_tuc fr_ipf->fri_tuc
-#define fr_satype fr_ipf->fri_satype
-#define fr_datype fr_ipf->fri_datype
-#define fr_sifpidx fr_ipf->fri_sifpidx
-#define fr_difpidx fr_ipf->fri_difpidx
-#define fr_proto fr_ip.fi_p
-#define fr_mproto fr_mip.fi_p
-#define fr_ttl fr_ip.fi_ttl
-#define fr_mttl fr_mip.fi_ttl
-#define fr_tos fr_ip.fi_tos
-#define fr_mtos fr_mip.fi_tos
-#define fr_tcpfm fr_tuc.ftu_tcpfm
-#define fr_tcpf fr_tuc.ftu_tcpf
-#define fr_scmp fr_tuc.ftu_scmp
-#define fr_dcmp fr_tuc.ftu_dcmp
-#define fr_dport fr_tuc.ftu_dport
-#define fr_sport fr_tuc.ftu_sport
-#define fr_stop fr_tuc.ftu_stop
-#define fr_dtop fr_tuc.ftu_dtop
-#define fr_dst fr_ip.fi_dst.in4
-#define fr_daddr fr_ip.fi_dst.in4.s_addr
-#define fr_src fr_ip.fi_src.in4
-#define fr_saddr fr_ip.fi_src.in4.s_addr
-#define fr_dmsk fr_mip.fi_dst.in4
-#define fr_dmask fr_mip.fi_dst.in4.s_addr
-#define fr_smsk fr_mip.fi_src.in4
-#define fr_smask fr_mip.fi_src.in4.s_addr
-#define fr_dstnum fr_ip.fi_dstnum
-#define fr_srcnum fr_ip.fi_srcnum
-#define fr_dsttype fr_ip.fi_dsttype
-#define fr_srctype fr_ip.fi_srctype
-#define fr_dstptr fr_mip.fi_dstptr
-#define fr_srcptr fr_mip.fi_srcptr
-#define fr_dstfunc fr_mip.fi_dstfunc
-#define fr_srcfunc fr_mip.fi_srcfunc
-#define fr_optbits fr_ip.fi_optmsk
-#define fr_optmask fr_mip.fi_optmsk
-#define fr_secbits fr_ip.fi_secmsk
-#define fr_secmask fr_mip.fi_secmsk
-#define fr_authbits fr_ip.fi_auth
-#define fr_authmask fr_mip.fi_auth
-#define fr_flx fr_ip.fi_flx
-#define fr_mflx fr_mip.fi_flx
-#define fr_ifname fr_ifnames[0]
-#define fr_oifname fr_ifnames[2]
-#define fr_ifa fr_ifas[0]
-#define fr_oifa fr_ifas[2]
-#define fr_tif fr_tifs[0]
-#define fr_rif fr_tifs[1]
-
-#define FR_NOLOGTAG 0
-
-#ifndef offsetof
-#define offsetof(t,m) (int)((&((t *)0L)->m))
-#endif
-#define FR_CMPSIZ (sizeof(struct frentry) - \
- offsetof(struct frentry, fr_func))
-
-/*
- * fr_type
- */
-#define FR_T_NONE 0
-#define FR_T_IPF 1 /* IPF structures */
-#define FR_T_BPFOPC 2 /* BPF opcode */
-#define FR_T_CALLFUNC 3 /* callout to function in fr_func only */
-#define FR_T_COMPIPF 4 /* compiled C code */
-#define FR_T_BUILTIN 0x80000000 /* rule is in kernel space */
-
-/*
- * fr_flags
- */
-#define FR_CALL 0x00000 /* call rule */
-#define FR_BLOCK 0x00001 /* do not allow packet to pass */
-#define FR_PASS 0x00002 /* allow packet to pass */
-#define FR_AUTH 0x00003 /* use authentication */
-#define FR_PREAUTH 0x00004 /* require preauthentication */
-#define FR_ACCOUNT 0x00005 /* Accounting rule */
-#define FR_SKIP 0x00006 /* skip rule */
-#define FR_DIVERT 0x00007 /* divert rule */
-#define FR_CMDMASK 0x0000f
-#define FR_LOG 0x00010 /* Log */
-#define FR_LOGB 0x00011 /* Log-fail */
-#define FR_LOGP 0x00012 /* Log-pass */
-#define FR_LOGMASK (FR_LOG|FR_CMDMASK)
-#define FR_CALLNOW 0x00020 /* call another function (fr_func) if matches */
-#define FR_NOTSRCIP 0x00040
-#define FR_NOTDSTIP 0x00080
-#define FR_QUICK 0x00100 /* match & stop processing list */
-#define FR_KEEPFRAG 0x00200 /* keep fragment information */
-#define FR_KEEPSTATE 0x00400 /* keep `connection' state information */
-#define FR_FASTROUTE 0x00800 /* bypass normal routing */
-#define FR_RETRST 0x01000 /* Return TCP RST packet - reset connection */
-#define FR_RETICMP 0x02000 /* Return ICMP unreachable packet */
-#define FR_FAKEICMP 0x03000 /* Return ICMP unreachable with fake source */
-#define FR_OUTQUE 0x04000 /* outgoing packets */
-#define FR_INQUE 0x08000 /* ingoing packets */
-#define FR_LOGBODY 0x10000 /* Log the body */
-#define FR_LOGFIRST 0x20000 /* Log the first byte if state held */
-#define FR_LOGORBLOCK 0x40000 /* block the packet if it can't be logged */
-#define FR_DUP 0x80000 /* duplicate packet */
-#define FR_FRSTRICT 0x100000 /* strict frag. cache */
-#define FR_STSTRICT 0x200000 /* strict keep state */
-#define FR_NEWISN 0x400000 /* new ISN for outgoing TCP */
-#define FR_NOICMPERR 0x800000 /* do not match ICMP errors in state */
-#define FR_STATESYNC 0x1000000 /* synchronize state to slave */
-#define FR_NOMATCH 0x8000000 /* no match occured */
- /* 0x10000000 FF_LOGPASS */
- /* 0x20000000 FF_LOGBLOCK */
- /* 0x40000000 FF_LOGNOMATCH */
- /* 0x80000000 FF_BLOCKNONIP */
-#define FR_COPIED 0x40000000 /* copied from user space */
-#define FR_INACTIVE 0x80000000 /* only used when flush'ing rules */
-
-#define FR_RETMASK (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
-#define FR_ISBLOCK(x) (((x) & FR_CMDMASK) == FR_BLOCK)
-#define FR_ISPASS(x) (((x) & FR_CMDMASK) == FR_PASS)
-#define FR_ISAUTH(x) (((x) & FR_CMDMASK) == FR_AUTH)
-#define FR_ISPREAUTH(x) (((x) & FR_CMDMASK) == FR_PREAUTH)
-#define FR_ISACCOUNT(x) (((x) & FR_CMDMASK) == FR_ACCOUNT)
-#define FR_ISSKIP(x) (((x) & FR_CMDMASK) == FR_SKIP)
-#define FR_ISNOMATCH(x) ((x) & FR_NOMATCH)
-#define FR_INOUT (FR_INQUE|FR_OUTQUE)
-
-/*
- * recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
- */
-#define FF_LOGPASS 0x10000000
-#define FF_LOGBLOCK 0x20000000
-#define FF_LOGNOMATCH 0x40000000
-#define FF_LOGGING (FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
-#define FF_BLOCKNONIP 0x80000000 /* Solaris2 Only */
-
-
-/*
- * Structure that passes information on what/how to flush to the kernel.
- */
-typedef struct ipfflush {
- int ipflu_how;
- int ipflu_arg;
-} ipfflush_t;
-
-
-/*
- *
- */
-typedef struct ipfgetctl {
- u_int ipfg_min; /* min value */
- u_int ipfg_current; /* current value */
- u_int ipfg_max; /* max value */
- u_int ipfg_default; /* default value */
- u_int ipfg_steps; /* value increments */
- char ipfg_name[40]; /* tag name for this control */
-} ipfgetctl_t;
-
-typedef struct ipfsetctl {
- int ipfs_which; /* 0 = min 1 = current 2 = max 3 = default */
- u_int ipfs_value; /* min value */
- char ipfs_name[40]; /* tag name for this control */
-} ipfsetctl_t;
-
-
-/*
- * Some of the statistics below are in their own counters, but most are kept
- * in this single structure so that they can all easily be collected and
- * copied back as required.
- */
-typedef struct filterstats {
- u_long fr_pass; /* packets allowed */
- u_long fr_block; /* packets denied */
- u_long fr_nom; /* packets which don't match any rule */
- u_long fr_short; /* packets which are short */
- u_long fr_ppkl; /* packets allowed and logged */
- u_long fr_bpkl; /* packets denied and logged */
- u_long fr_npkl; /* packets unmatched and logged */
- u_long fr_pkl; /* packets logged */
- u_long fr_skip; /* packets to be logged but buffer full */
- u_long fr_ret; /* packets for which a return is sent */
- u_long fr_acct; /* packets for which counting was performed */
- u_long fr_bnfr; /* bad attempts to allocate fragment state */
- u_long fr_nfr; /* new fragment state kept */
- u_long fr_cfr; /* add new fragment state but complete pkt */
- u_long fr_bads; /* bad attempts to allocate packet state */
- u_long fr_ads; /* new packet state kept */
- u_long fr_chit; /* cached hit */
- u_long fr_tcpbad; /* TCP checksum check failures */
- u_long fr_pull[2]; /* good and bad pullup attempts */
- u_long fr_badsrc; /* source received doesn't match route */
- u_long fr_badttl; /* TTL in packet doesn't reach minimum */
- u_long fr_bad; /* bad IP packets to the filter */
- u_long fr_ipv6; /* IPv6 packets in/out */
- u_long fr_ppshit; /* dropped because of pps ceiling */
- u_long fr_ipud; /* IP id update failures */
-} filterstats_t;
-
-/*
- * Log structure. Each packet header logged is prepended by one of these.
- * Following this in the log records read from the device will be an ipflog
- * structure which is then followed by any packet data.
- */
-typedef struct iplog {
- u_32_t ipl_magic;
- u_int ipl_count;
- struct timeval ipl_time;
- size_t ipl_dsize;
- struct iplog *ipl_next;
-} iplog_t;
-
-#define ipl_sec ipl_time.tv_sec
-#define ipl_usec ipl_time.tv_usec
-
-#define IPL_MAGIC 0x49504c4d /* 'IPLM' */
-#define IPL_MAGIC_NAT 0x49504c4e /* 'IPLN' */
-#define IPL_MAGIC_STATE 0x49504c53 /* 'IPLS' */
-#define IPLOG_SIZE sizeof(iplog_t)
-
-typedef struct ipflog {
-#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
- (defined(OpenBSD) && (OpenBSD >= 199603))
-#else
- u_int fl_unit;
-#endif
- u_32_t fl_rule;
- u_32_t fl_flags;
- u_32_t fl_lflags;
- u_32_t fl_logtag;
- ipftag_t fl_nattag;
- u_short fl_plen; /* extra data after hlen */
- u_short fl_loglevel; /* syslog log level */
- char fl_group[FR_GROUPLEN];
- u_char fl_hlen; /* length of IP headers saved */
- u_char fl_dir;
- u_char fl_xxx[2]; /* pad */
- char fl_ifname[LIFNAMSIZ];
-} ipflog_t;
-
-#ifndef IPF_LOGGING
-# define IPF_LOGGING 0
-#endif
-#ifndef IPF_DEFAULT_PASS
-# define IPF_DEFAULT_PASS FR_PASS
-#endif
-
-#define DEFAULT_IPFLOGSIZE 8192
-#ifndef IPFILTER_LOGSIZE
-# define IPFILTER_LOGSIZE DEFAULT_IPFLOGSIZE
-#else
-# if IPFILTER_LOGSIZE < DEFAULT_IPFLOGSIZE
-# error IPFILTER_LOGSIZE too small. Must be >= DEFAULT_IPFLOGSIZE
-# endif
-#endif
-
-#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */
-
-/*
- * Device filenames for reading log information. Use ipf on Solaris2 because
- * ipl is already a name used by something else.
- */
-#ifndef IPL_NAME
-# if SOLARIS
-# define IPL_NAME "/dev/ipf"
-# else
-# define IPL_NAME "/dev/ipl"
-# endif
-#endif
-/*
- * Pathnames for various IP Filter control devices. Used by LKM
- * and userland, so defined here.
- */
-#define IPNAT_NAME "/dev/ipnat"
-#define IPSTATE_NAME "/dev/ipstate"
-#define IPAUTH_NAME "/dev/ipauth"
-#define IPSYNC_NAME "/dev/ipsync"
-#define IPSCAN_NAME "/dev/ipscan"
-#define IPLOOKUP_NAME "/dev/iplookup"
-
-#define IPL_LOGIPF 0 /* Minor device #'s for accessing logs */
-#define IPL_LOGNAT 1
-#define IPL_LOGSTATE 2
-#define IPL_LOGAUTH 3
-#define IPL_LOGSYNC 4
-#define IPL_LOGSCAN 5
-#define IPL_LOGLOOKUP 6
-#define IPL_LOGCOUNT 7
-#define IPL_LOGMAX 7
-#define IPL_LOGSIZE IPL_LOGMAX + 1
-#define IPL_LOGALL -1
-#define IPL_LOGNONE -2
-
-/*
- * For SIOCGETFS
- */
-typedef struct friostat {
- struct filterstats f_st[2];
- struct frentry *f_ipf[2][2];
- struct frentry *f_acct[2][2];
- struct frentry *f_ipf6[2][2];
- struct frentry *f_acct6[2][2];
- struct frentry *f_auth;
- struct frgroup *f_groups[IPL_LOGSIZE][2];
- u_long f_froute[2];
- u_long f_ticks;
- int f_locks[IPL_LOGMAX];
- size_t f_kmutex_sz;
- size_t f_krwlock_sz;
- int f_defpass; /* default pass - from fr_pass */
- int f_active; /* 1 or 0 - active rule set */
- int f_running; /* 1 if running, else 0 */
- int f_logging; /* 1 if enabled, else 0 */
- int f_features;
- char f_version[32]; /* version string */
-} friostat_t;
-
-#define f_fin f_ipf[0]
-#define f_fin6 f_ipf6[0]
-#define f_fout f_ipf[1]
-#define f_fout6 f_ipf6[1]
-#define f_acctin f_acct[0]
-#define f_acctin6 f_acct6[0]
-#define f_acctout f_acct[1]
-#define f_acctout6 f_acct6[1]
-
-#define IPF_FEAT_LKM 0x001
-#define IPF_FEAT_LOG 0x002
-#define IPF_FEAT_LOOKUP 0x004
-#define IPF_FEAT_BPF 0x008
-#define IPF_FEAT_COMPILED 0x010
-#define IPF_FEAT_CKSUM 0x020
-#define IPF_FEAT_SYNC 0x040
-#define IPF_FEAT_SCAN 0x080
-#define IPF_FEAT_IPV6 0x100
-
-typedef struct optlist {
- u_short ol_val;
- int ol_bit;
-} optlist_t;
-
-
-/*
- * Group list structure.
- */
-typedef struct frgroup {
- struct frgroup *fg_next;
- struct frentry *fg_head;
- struct frentry *fg_start;
- u_32_t fg_flags;
- int fg_ref;
- char fg_name[FR_GROUPLEN];
-} frgroup_t;
-
-#define FG_NAME(g) (*(g)->fg_name == '\0' ? "" : (g)->fg_name)
-
-
-/*
- * Used by state and NAT tables
- */
-typedef struct icmpinfo {
- u_short ici_id;
- u_short ici_seq;
- u_char ici_type;
-} icmpinfo_t;
-
-typedef struct udpinfo {
- u_short us_sport;
- u_short us_dport;
-} udpinfo_t;
-
-
-typedef struct tcpdata {
- u_32_t td_end;
- u_32_t td_maxend;
- u_32_t td_maxwin;
- u_32_t td_winscale;
- u_32_t td_maxseg;
- int td_winflags;
-} tcpdata_t;
-
-#define TCP_WSCALE_MAX 14
-
-#define TCP_WSCALE_SEEN 0x00000001
-#define TCP_WSCALE_FIRST 0x00000002
-
-
-typedef struct tcpinfo {
- u_short ts_sport;
- u_short ts_dport;
- tcpdata_t ts_data[2];
-} tcpinfo_t;
-
-
-struct grebits {
- u_32_t grb_C:1;
- u_32_t grb_R:1;
- u_32_t grb_K:1;
- u_32_t grb_S:1;
- u_32_t grb_s:1;
- u_32_t grb_recur:1;
- u_32_t grb_A:1;
- u_32_t grb_flags:3;
- u_32_t grb_ver:3;
- u_short grb_ptype;
-};
-
-typedef struct grehdr {
- union {
- struct grebits gru_bits;
- u_short gru_flags;
- } gr_un;
- u_short gr_len;
- u_short gr_call;
-} grehdr_t;
-
-#define gr_flags gr_un.gru_flags
-#define gr_bits gr_un.gru_bits
-#define gr_ptype gr_bits.grb_ptype
-#define gr_C gr_bits.grb_C
-#define gr_R gr_bits.grb_R
-#define gr_K gr_bits.grb_K
-#define gr_S gr_bits.grb_S
-#define gr_s gr_bits.grb_s
-#define gr_recur gr_bits.grb_recur
-#define gr_A gr_bits.grb_A
-#define gr_ver gr_bits.grb_ver
-
-
-typedef struct greinfo {
- u_short gs_call[2];
- u_short gs_flags;
- u_short gs_ptype;
-} greinfo_t;
-
-#define GRE_REV(x) ((ntohs(x) >> 13) & 7)
-
-
-/*
- * Timeout tail queue list member
- */
-typedef struct ipftqent {
- struct ipftqent **tqe_pnext;
- struct ipftqent *tqe_next;
- struct ipftq *tqe_ifq;
- void *tqe_parent; /* pointer back to NAT/state struct */
- u_long tqe_die; /* when this entriy is to die */
- u_long tqe_touched;
- int tqe_flags;
- int tqe_state[2]; /* current state of this entry */
-} ipftqent_t;
-
-#define TQE_RULEBASED 0x00000001
-
-
-/*
- * Timeout tail queue head for IPFilter
- */
-typedef struct ipftq {
- ipfmutex_t ifq_lock;
- u_int ifq_ttl;
- ipftqent_t *ifq_head;
- ipftqent_t **ifq_tail;
- struct ipftq *ifq_next;
- struct ipftq **ifq_pnext;
- int ifq_ref;
- u_int ifq_flags;
-} ipftq_t;
-
-#define IFQF_USER 0x01 /* User defined aging */
-#define IFQF_DELETE 0x02 /* Marked for deletion */
-#define IFQF_PROXY 0x04 /* Timeout queue in use by a proxy */
-
-#define IPF_HZ_MULT 1
-#define IPF_HZ_DIVIDE 2 /* How many times a second ipfilter */
- /* checks its timeout queues. */
-#define IPF_TTLVAL(x) (((x) / IPF_HZ_MULT) * IPF_HZ_DIVIDE)
-
-/*
- * Structure to define address for pool lookups.
- */
-typedef struct {
- u_char adf_len;
- i6addr_t adf_addr;
-} addrfamily_t;
-
-
-/*
- * Object structure description. For passing through in ioctls.
- */
-typedef struct ipfobj {
- u_32_t ipfo_rev; /* IPFilter version number */
- u_32_t ipfo_size; /* size of object at ipfo_ptr */
- void *ipfo_ptr; /* pointer to object */
- int ipfo_type; /* type of object being pointed to */
- int ipfo_offset; /* bytes from ipfo_ptr where to start */
- u_char ipfo_xxxpad[32]; /* reserved for future use */
-} ipfobj_t;
-
-#define IPFOBJ_FRENTRY 0 /* struct frentry */
-#define IPFOBJ_IPFSTAT 1 /* struct friostat */
-#define IPFOBJ_IPFINFO 2 /* struct fr_info */
-#define IPFOBJ_AUTHSTAT 3 /* struct fr_authstat */
-#define IPFOBJ_FRAGSTAT 4 /* struct ipfrstat */
-#define IPFOBJ_IPNAT 5 /* struct ipnat */
-#define IPFOBJ_NATSTAT 6 /* struct natstat */
-#define IPFOBJ_STATESAVE 7 /* struct ipstate_save */
-#define IPFOBJ_NATSAVE 8 /* struct nat_save */
-#define IPFOBJ_NATLOOKUP 9 /* struct natlookup */
-#define IPFOBJ_IPSTATE 10 /* struct ipstate */
-#define IPFOBJ_STATESTAT 11 /* struct ips_stat */
-#define IPFOBJ_FRAUTH 12 /* struct frauth */
-#define IPFOBJ_TUNEABLE 13 /* struct ipftune */
-
-
-typedef union ipftunevalptr {
- void *ipftp_void;
- u_long *ipftp_long;
- u_int *ipftp_int;
- u_short *ipftp_short;
- u_char *ipftp_char;
-} ipftunevalptr_t;
-
-typedef struct ipftuneable {
- ipftunevalptr_t ipft_una;
- char *ipft_name;
- u_long ipft_min;
- u_long ipft_max;
- int ipft_sz;
- int ipft_flags;
- struct ipftuneable *ipft_next;
-} ipftuneable_t;
-
-#define ipft_addr ipft_una.ipftp_void
-#define ipft_plong ipft_una.ipftp_long
-#define ipft_pint ipft_una.ipftp_int
-#define ipft_pshort ipft_una.ipftp_short
-#define ipft_pchar ipft_una.ipftp_char
-
-#define IPFT_RDONLY 1 /* read-only */
-#define IPFT_WRDISABLED 2 /* write when disabled only */
-
-typedef union ipftuneval {
- u_long ipftu_long;
- u_int ipftu_int;
- u_short ipftu_short;
- u_char ipftu_char;
-} ipftuneval_t;
-
-typedef struct ipftune {
- void *ipft_cookie;
- ipftuneval_t ipft_un;
- u_long ipft_min;
- u_long ipft_max;
- int ipft_sz;
- int ipft_flags;
- char ipft_name[80];
-} ipftune_t;
-
-#define ipft_vlong ipft_un.ipftu_long
-#define ipft_vint ipft_un.ipftu_int
-#define ipft_vshort ipft_un.ipftu_short
-#define ipft_vchar ipft_un.ipftu_char
-
-
-/*
-** HPUX Port
-*/
-#ifdef __hpux
-/* HP-UX locking sequence deadlock detection module lock MAJOR ID */
-# define IPF_SMAJ 0 /* temp assignment XXX, not critical */
-#endif
-
-#if !defined(CDEV_MAJOR) && defined (__FreeBSD_version) && \
- (__FreeBSD_version >= 220000)
-# define CDEV_MAJOR 79
-#endif
-
-/*
- * Post NetBSD 1.2 has the PFIL interface for packet filters. This turns
- * on those hooks. We don't need any special mods in non-IP Filter code
- * with this!
- */
-#if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
- (defined(NetBSD1_2) && NetBSD1_2 > 1) || \
- (defined(__FreeBSD__) && (__FreeBSD_version >= 500043))
-# if (NetBSD >= 199905)
-# define PFIL_HOOKS
-# endif
-# ifdef PFIL_HOOKS
-# define NETBSD_PF
-# endif
-#endif
-
-#ifndef _KERNEL
-extern int fr_check __P((struct ip *, int, void *, int, mb_t **));
-extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-extern int ipf_log __P((void));
-extern struct ifnet *get_unit __P((char *, int));
-extern char *get_ifname __P((struct ifnet *));
-# if defined(__NetBSD__) || defined(__OpenBSD__) || \
- (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
-extern int iplioctl __P((int, ioctlcmd_t, caddr_t, int));
-# else
-extern int iplioctl __P((int, ioctlcmd_t, caddr_t, int));
-# endif
-extern int iplopen __P((dev_t, int));
-extern int iplclose __P((dev_t, int));
-extern void m_freem __P((mb_t *));
-#else /* #ifndef _KERNEL */
-# if defined(__NetBSD__) && defined(PFIL_HOOKS)
-extern void ipfilterattach __P((int));
-# endif
-extern int ipl_enable __P((void));
-extern int ipl_disable __P((void));
-# ifdef MENTAT
-extern int fr_check __P((struct ip *, int, void *, int, void *,
- mblk_t **));
-# if SOLARIS
-# if SOLARIS2 >= 7
-extern int iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
-# else
-extern int iplioctl __P((dev_t, int, int *, int, cred_t *, int *));
-# endif
-extern int iplopen __P((dev_t *, int, int, cred_t *));
-extern int iplclose __P((dev_t, int, int, cred_t *));
-extern int iplread __P((dev_t, uio_t *, cred_t *));
-extern int iplwrite __P((dev_t, uio_t *, cred_t *));
-# endif
-# ifdef __hpux
-extern int iplopen __P((dev_t, int, intptr_t, int));
-extern int iplclose __P((dev_t, int, int));
-extern int iplioctl __P((dev_t, int, caddr_t, int));
-extern int iplread __P((dev_t, uio_t *));
-extern int iplwrite __P((dev_t, uio_t *));
-extern int iplselect __P((dev_t, int));
-# endif
-extern int ipfsync __P((void));
-extern int fr_qout __P((queue_t *, mblk_t *));
-# else /* MENTAT */
-extern int fr_check __P((struct ip *, int, void *, int, mb_t **));
-extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-extern size_t mbufchainlen __P((mb_t *));
-# ifdef __sgi
-# include <sys/cred.h>
-extern int iplioctl __P((dev_t, int, caddr_t, int, cred_t *, int *));
-extern int iplopen __P((dev_t *, int, int, cred_t *));
-extern int iplclose __P((dev_t, int, int, cred_t *));
-extern int iplread __P((dev_t, uio_t *, cred_t *));
-extern int iplwrite __P((dev_t, uio_t *, cred_t *));
-extern int ipfsync __P((void));
-extern int ipfilter_sgi_attach __P((void));
-extern void ipfilter_sgi_detach __P((void));
-extern void ipfilter_sgi_intfsync __P((void));
-# else
-# ifdef IPFILTER_LKM
-extern int iplidentify __P((char *));
-# endif
-# if (_BSDI_VERSION >= 199510) || (__FreeBSD_version >= 220000) || \
- (NetBSD >= 199511) || defined(__OpenBSD__)
-# if defined(__NetBSD__) || (_BSDI_VERSION >= 199701) || \
- defined(__OpenBSD__) || (__FreeBSD_version >= 300000)
-# if (__FreeBSD_version >= 500024)
-# if (__FreeBSD_version >= 502116)
-extern int iplioctl __P((struct cdev*, u_long, caddr_t, int, struct thread *));
-# else
-extern int iplioctl __P((dev_t, u_long, caddr_t, int, struct thread *));
-# endif /* __FreeBSD_version >= 502116 */
-# else
-extern int iplioctl __P((dev_t, u_long, caddr_t, int, struct proc *));
-# endif /* __FreeBSD_version >= 500024 */
-# else
-extern int iplioctl __P((dev_t, int, caddr_t, int, struct proc *));
-# endif
-# if (__FreeBSD_version >= 500024)
-# if (__FreeBSD_version >= 502116)
-extern int iplopen __P((struct cdev*, int, int, struct thread *));
-extern int iplclose __P((struct cdev*, int, int, struct thread *));
-# else
-extern int iplopen __P((dev_t, int, int, struct thread *));
-extern int iplclose __P((dev_t, int, int, struct thread *));
-# endif /* __FreeBSD_version >= 502116 */
-# else
-extern int iplopen __P((dev_t, int, int, struct proc *));
-extern int iplclose __P((dev_t, int, int, struct proc *));
-# endif /* __FreeBSD_version >= 500024 */
-# else
-# ifdef linux
-extern int iplioctl __P((struct inode *, struct file *, u_int, u_long));
-# else
-extern int iplopen __P((dev_t, int));
-extern int iplclose __P((dev_t, int));
-extern int iplioctl __P((dev_t, int, caddr_t, int));
-# endif
-# endif /* (_BSDI_VERSION >= 199510) */
-# if BSD >= 199306
-# if (__FreeBSD_version >= 502116)
-extern int iplread __P((struct cdev*, struct uio *, int));
-extern int iplwrite __P((struct cdev*, struct uio *, int));
-# else
-extern int iplread __P((dev_t, struct uio *, int));
-extern int iplwrite __P((dev_t, struct uio *, int));
-# endif /* __FreeBSD_version >= 502116 */
-# else
-# ifndef linux
-extern int iplread __P((dev_t, struct uio *));
-extern int iplwrite __P((dev_t, struct uio *));
-# endif
-# endif /* BSD >= 199306 */
-# endif /* __ sgi */
-# endif /* MENTAT */
-
-#endif /* #ifndef _KERNEL */
-
-extern ipfmutex_t ipl_mutex, ipf_authmx, ipf_rw, ipf_hostmap;
-extern ipfmutex_t ipf_timeoutlock, ipf_stinsert, ipf_natio, ipf_nat_new;
-extern ipfrwlock_t ipf_mutex, ipf_global, ip_poolrw, ipf_ipidfrag;
-extern ipfrwlock_t ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth;
-
-extern char *memstr __P((char *, char *, int, int));
-extern int count4bits __P((u_32_t));
-extern int frrequest __P((int, ioctlcmd_t, caddr_t, int, int));
-extern char *getifname __P((struct ifnet *));
-extern int iplattach __P((void));
-extern int ipldetach __P((void));
-extern u_short ipf_cksum __P((u_short *, int));
-extern int copyinptr __P((void *, void *, size_t));
-extern int copyoutptr __P((void *, void *, size_t));
-extern int fr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *));
-extern int fr_inobj __P((void *, void *, int));
-extern int fr_inobjsz __P((void *, void *, int, int));
-extern int fr_ioctlswitch __P((int, void *, ioctlcmd_t, int));
-extern int fr_ipftune __P((ioctlcmd_t, void *));
-extern int fr_outobj __P((void *, void *, int));
-extern int fr_outobjsz __P((void *, void *, int, int));
-extern void *fr_pullup __P((mb_t *, fr_info_t *, int));
-extern void fr_resolvedest __P((struct frdest *, int));
-extern int fr_resolvefunc __P((void *));
-extern void *fr_resolvenic __P((char *, int));
-extern int fr_send_icmp_err __P((int, fr_info_t *, int));
-extern int fr_send_reset __P((fr_info_t *));
-#if (__FreeBSD_version < 490000) || !defined(_KERNEL)
-extern int ppsratecheck __P((struct timeval *, int *, int));
-#endif
-extern ipftq_t *fr_addtimeoutqueue __P((ipftq_t **, u_int));
-extern void fr_deletequeueentry __P((ipftqent_t *));
-extern int fr_deletetimeoutqueue __P((ipftq_t *));
-extern void fr_freetimeoutqueue __P((ipftq_t *));
-extern void fr_movequeue __P((ipftqent_t *, ipftq_t *, ipftq_t *));
-extern void fr_queueappend __P((ipftqent_t *, ipftq_t *, void *));
-extern void fr_queueback __P((ipftqent_t *));
-extern void fr_queuefront __P((ipftqent_t *));
-extern void fr_checkv4sum __P((fr_info_t *));
-extern int fr_checkl4sum __P((fr_info_t *));
-extern int fr_ifpfillv4addr __P((int, struct sockaddr_in *,
- struct sockaddr_in *, struct in_addr *,
- struct in_addr *));
-extern int fr_coalesce __P((fr_info_t *));
-#ifdef USE_INET6
-extern void fr_checkv6sum __P((fr_info_t *));
-extern int fr_ifpfillv6addr __P((int, struct sockaddr_in6 *,
- struct sockaddr_in6 *, struct in_addr *,
- struct in_addr *));
-#endif
-
-extern int fr_addipftune __P((ipftuneable_t *));
-extern int fr_delipftune __P((ipftuneable_t *));
-
-extern int frflush __P((minor_t, int, int));
-extern void frsync __P((void *));
-extern frgroup_t *fr_addgroup __P((char *, void *, u_32_t, minor_t, int));
-extern int fr_derefrule __P((frentry_t **));
-extern void fr_delgroup __P((char *, minor_t, int));
-extern frgroup_t *fr_findgroup __P((char *, minor_t, int, frgroup_t ***));
-
-extern int fr_loginit __P((void));
-extern int ipflog_clear __P((minor_t));
-extern int ipflog_read __P((minor_t, uio_t *));
-extern int ipflog __P((fr_info_t *, u_int));
-extern int ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
-extern void fr_logunload __P((void));
-
-extern frentry_t *fr_acctpkt __P((fr_info_t *, u_32_t *));
-extern int fr_copytolog __P((int, char *, int));
-extern u_short fr_cksum __P((mb_t *, ip_t *, int, void *));
-extern void fr_deinitialise __P((void));
-extern frentry_t *fr_dolog __P((fr_info_t *, u_32_t *));
-extern frentry_t *fr_dstgrpmap __P((fr_info_t *, u_32_t *));
-extern void fr_fixskip __P((frentry_t **, frentry_t *, int));
-extern void fr_forgetifp __P((void *));
-extern frentry_t *fr_getrulen __P((int, char *, u_32_t));
-extern void fr_getstat __P((struct friostat *));
-extern int fr_icmp4errortype __P((int));
-extern int fr_ifpaddr __P((int, int, void *,
- struct in_addr *, struct in_addr *));
-extern int fr_initialise __P((void));
-extern void fr_lock __P((caddr_t, int *));
-extern int fr_makefrip __P((int, ip_t *, fr_info_t *));
-extern int fr_matchtag __P((ipftag_t *, ipftag_t *));
-extern int fr_matchicmpqueryreply __P((int, icmpinfo_t *,
- struct icmp *, int));
-extern u_32_t fr_newisn __P((fr_info_t *));
-extern u_short fr_nextipid __P((fr_info_t *));
-extern int fr_rulen __P((int, frentry_t *));
-extern int fr_scanlist __P((fr_info_t *, u_32_t));
-extern frentry_t *fr_srcgrpmap __P((fr_info_t *, u_32_t *));
-extern int fr_tcpudpchk __P((fr_info_t *, frtuc_t *));
-extern int fr_verifysrc __P((fr_info_t *fin));
-extern int fr_zerostats __P((char *));
-
-extern int fr_running;
-extern u_long fr_frouteok[2];
-extern int fr_pass;
-extern int fr_flags;
-extern int fr_active;
-extern int fr_chksrc;
-extern int fr_minttl;
-extern int fr_refcnt;
-extern int fr_control_forwarding;
-extern int fr_update_ipid;
-extern int nat_logging;
-extern int ipstate_logging;
-extern int ipl_suppress;
-extern int ipl_buffer_sz;
-extern int ipl_logmax;
-extern int ipl_logall;
-extern int ipl_logsize;
-extern u_long fr_ticks;
-extern fr_info_t frcache[2][8];
-extern char ipfilter_version[];
-extern iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1];
-extern int iplused[IPL_LOGMAX + 1];
-extern struct frentry *ipfilter[2][2], *ipacct[2][2];
-#ifdef USE_INET6
-extern struct frentry *ipfilter6[2][2], *ipacct6[2][2];
-extern int icmptoicmp6types[ICMP_MAXTYPE+1];
-extern int icmptoicmp6unreach[ICMP_MAX_UNREACH];
-extern int icmpreplytype6[ICMP6_MAXTYPE + 1];
-#endif
-extern int icmpreplytype4[ICMP_MAXTYPE + 1];
-extern struct frgroup *ipfgroups[IPL_LOGSIZE][2];
-extern struct filterstats frstats[];
-extern frentry_t *ipfrule_match __P((fr_info_t *));
-extern u_char ipf_iss_secret[32];
-extern ipftuneable_t ipf_tuneables[];
-
-#endif /* __IP_FIL_H__ */
diff --git a/contrib/ipfilter/ip_fil_freebsd.c b/contrib/ipfilter/ip_fil_freebsd.c
deleted file mode 100644
index 3b36b93117a8..000000000000
--- a/contrib/ipfilter/ip_fil_freebsd.c
+++ /dev/null
@@ -1,1692 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2003 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)Id: ip_fil_freebsd.c,v 2.53.2.25 2005/02/01 03:15:56 darrenr Exp";
-#endif
-
-#if defined(KERNEL) || defined(_KERNEL)
-# undef KERNEL
-# undef _KERNEL
-# define KERNEL 1
-# define _KERNEL 1
-#endif
-#if defined(__FreeBSD_version) && (__FreeBSD_version >= 400000) && \
- !defined(KLD_MODULE) && !defined(IPFILTER_LKM)
-# include "opt_inet6.h"
-#endif
-#if defined(__FreeBSD_version) && (__FreeBSD_version >= 440000) && \
- !defined(KLD_MODULE) && !defined(IPFILTER_LKM)
-# include "opt_random_ip_id.h"
-#endif
-#include <sys/param.h>
-#if defined(__FreeBSD__) && !defined(__FreeBSD_version)
-# if defined(IPFILTER_LKM)
-# ifndef __FreeBSD_cc_version
-# include <osreldate.h>
-# else
-# if __FreeBSD_cc_version < 430000
-# include <osreldate.h>
-# endif
-# endif
-# endif
-#endif
-#include <sys/errno.h>
-#include <sys/types.h>
-#include <sys/file.h>
-#if __FreeBSD_version >= 220000
-# include <sys/fcntl.h>
-# include <sys/filio.h>
-#else
-# include <sys/ioctl.h>
-#endif
-#include <sys/time.h>
-#include <sys/systm.h>
-#if (__FreeBSD_version >= 300000)
-# include <sys/dirent.h>
-#else
-# include <sys/dir.h>
-#endif
-#if !defined(__hpux)
-# include <sys/mbuf.h>
-#endif
-#include <sys/protosw.h>
-#include <sys/socket.h>
-
-#include <net/if.h>
-#if __FreeBSD_version >= 300000
-# include <net/if_var.h>
-# if !defined(IPFILTER_LKM)
-# include "opt_ipfilter.h"
-# endif
-#endif
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/tcp.h>
-#if defined(__osf__)
-# include <netinet/tcp_timer.h>
-#endif
-#include <netinet/udp.h>
-#include <netinet/tcpip.h>
-#include <netinet/ip_icmp.h>
-#ifndef _KERNEL
-# include "netinet/ipf.h"
-#endif
-#include "netinet/ip_compat.h"
-#ifdef USE_INET6
-# include <netinet/icmp6.h>
-#endif
-#include "netinet/ip_fil.h"
-#include "netinet/ip_nat.h"
-#include "netinet/ip_frag.h"
-#include "netinet/ip_state.h"
-#include "netinet/ip_proxy.h"
-#include "netinet/ip_auth.h"
-#ifdef IPFILTER_SYNC
-#include "netinet/ip_sync.h"
-#endif
-#ifdef IPFILTER_SCAN
-#include "netinet/ip_scan.h"
-#endif
-#include "netinet/ip_pool.h"
-#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
-# include <sys/malloc.h>
-#endif
-#include <sys/kernel.h>
-#ifdef CSUM_DATA_VALID
-#include <machine/in_cksum.h>
-#endif
-extern int ip_optcopy __P((struct ip *, struct ip *));
-
-#if (__FreeBSD_version > 460000)
-extern int path_mtu_discovery;
-#endif
-
-# ifdef IPFILTER_M_IPFILTER
-MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures");
-# endif
-
-
-#if !defined(__osf__)
-extern struct protosw inetsw[];
-#endif
-
-static int (*fr_savep) __P((ip_t *, int, void *, int, struct mbuf **));
-static int fr_send_ip __P((fr_info_t *, mb_t *, mb_t **));
-# ifdef USE_MUTEXES
-ipfmutex_t ipl_mutex, ipf_authmx, ipf_rw, ipf_stinsert;
-ipfmutex_t ipf_nat_new, ipf_natio, ipf_timeoutlock;
-ipfrwlock_t ipf_mutex, ipf_global, ipf_ipidfrag;
-ipfrwlock_t ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth;
-# endif
-int ipf_locks_done = 0;
-
-#if (__FreeBSD_version >= 300000)
-struct callout_handle fr_slowtimer_ch;
-#endif
-
-#if (__FreeBSD_version >= 500011)
-# include <sys/conf.h>
-# if defined(NETBSD_PF)
-# include <net/pfil.h>
-# include <netinet/ipprotosw.h>
-/*
- * We provide the fr_checkp name just to minimize changes later.
- */
-int (*fr_checkp) __P((ip_t *ip, int hlen, void *ifp, int out, mb_t **mp));
-# endif /* NETBSD_PF */
-#endif /* __FreeBSD_version >= 500011 */
-
-
-#if (__FreeBSD_version >= 501108) && defined(_KERNEL)
-
-static int
-fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
-{
- struct ip *ip = mtod(*mp, struct ip *);
- return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
-}
-
-# ifdef USE_INET6
-# include <netinet/ip6.h>
-
-static int
-fr_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
-{
- return (fr_check(mtod(*mp, struct ip *), sizeof(struct ip6_hdr),
- ifp, (dir == PFIL_OUT), mp));
-}
-# endif
-#endif /* __FreeBSD_version >= 501108 */
-#if defined(IPFILTER_LKM)
-int iplidentify(s)
-char *s;
-{
- if (strcmp(s, "ipl") == 0)
- return 1;
- return 0;
-}
-#endif /* IPFILTER_LKM */
-
-
-int iplattach()
-{
-#ifdef USE_SPL
- int s;
-#endif
-#if defined(NETBSD_PF) && (__FreeBSD_version >= 500011)
- int error = 0;
-# if __FreeBSD_version >= 501108
- struct pfil_head *ph_inet;
-# ifdef USE_INET6
- struct pfil_head *ph_inet6;
-# endif
-# endif
-#endif
-
- SPL_NET(s);
- if (fr_running > 0) {
- SPL_X(s);
- return EBUSY;
- }
-
- MUTEX_INIT(&ipf_rw, "ipf rw mutex");
- RWLOCK_INIT(&ipf_global, "ipf filter load/unload mutex");
- MUTEX_INIT(&ipf_timeoutlock, "ipf timeout queue mutex");
- RWLOCK_INIT(&ipf_mutex, "ipf filter rwlock");
- RWLOCK_INIT(&ipf_ipidfrag, "ipf IP NAT-Frag rwlock");
- ipf_locks_done = 1;
-
- if (fr_initialise() < 0) {
- SPL_X(s);
- return EIO;
- }
-
-
-# ifdef NETBSD_PF
-# if __FreeBSD_version >= 500011
-# if __FreeBSD_version >= 501108
- ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
-# ifdef USE_INET6
- ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
-# endif
- if (ph_inet == NULL
-# ifdef USE_INET6
- && ph_inet6 == NULL
-# endif
- )
- return ENODEV;
-
- if (ph_inet != NULL)
- error = pfil_add_hook((void *)fr_check_wrapper, NULL,
- PFIL_IN|PFIL_OUT, ph_inet);
- else
- error = 0;
-# else
- error = pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
- &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
-# endif
- if (error) {
-# ifdef USE_INET6
- goto pfil_error;
-# else
- fr_deinitialise();
- SPL_X(s);
- return error;
-# endif
- }
-# else
- pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
-# endif
-# ifdef USE_INET6
-# if __FreeBSD_version >= 501108
- if (ph_inet6 != NULL)
- error = pfil_add_hook((void *)fr_check_wrapper6, NULL,
- PFIL_IN|PFIL_OUT, ph_inet6);
- else
- error = 0;
- if (error) {
- pfil_remove_hook((void *)fr_check_wrapper6, NULL,
- PFIL_IN|PFIL_OUT, ph_inet6);
-# else
- error = pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
- &inet6sw[ip6_protox[IPPROTO_IPV6]].pr_pfh);
- if (error) {
- pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
- &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
-# endif
-pfil_error:
- fr_deinitialise();
- SPL_X(s);
- return error;
- }
-# endif
-# endif
- if (fr_checkp != fr_check) {
- fr_savep = fr_checkp;
- fr_checkp = fr_check;
- }
-
- bzero((char *)frcache, sizeof(frcache));
- fr_running = 1;
-
- if (fr_control_forwarding & 1)
- ipforwarding = 1;
-
- SPL_X(s);
-#if (__FreeBSD_version >= 300000)
- fr_slowtimer_ch = timeout(fr_slowtimer, NULL,
- (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT);
-#else
- timeout(fr_slowtimer, NULL, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT);
-#endif
- return 0;
-}
-
-
-/*
- * Disable the filter by removing the hooks from the IP input/output
- * stream.
- */
-int ipldetach()
-{
-#ifdef USE_SPL
- int s;
-#endif
-#if defined(NETBSD_PF) && (__FreeBSD_version >= 500011)
- int error = 0;
-# if __FreeBSD_version >= 501108
- struct pfil_head *ph_inet;
-# ifdef USE_INET6
- struct pfil_head *ph_inet6;
-# endif
-# endif
-#endif
-
- if (fr_control_forwarding & 2)
- ipforwarding = 0;
-
- SPL_NET(s);
-
-#if (__FreeBSD_version >= 300000)
- if (fr_slowtimer_ch.callout != NULL)
- untimeout(fr_slowtimer, NULL, fr_slowtimer_ch);
- bzero(&fr_slowtimer_ch, sizeof(fr_slowtimer_ch));
-#else
- untimeout(fr_slowtimer, NULL);
-#endif /* FreeBSD */
-
-#ifndef NETBSD_PF
- if (fr_checkp != NULL)
- fr_checkp = fr_savep;
- fr_savep = NULL;
-#endif
-
-#ifdef NETBSD_PF
-# if (__FreeBSD_version >= 500011)
-# if (__FreeBSD_version >= 501108)
- ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
- if (ph_inet != NULL)
- error = pfil_remove_hook((void *)fr_check_wrapper, NULL,
- PFIL_IN|PFIL_OUT, ph_inet);
- else
- error = 0;
-# else
- error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
- &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
-# endif
- if (error) {
- SPL_X(s);
- return error;
- }
-# else
- pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
-# endif
-# ifdef USE_INET6
-# if (__FreeBSD_version >= 501108)
- ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
- if (ph_inet6 != NULL)
- error = pfil_remove_hook((void *)fr_check_wrapper6, NULL,
- PFIL_IN|PFIL_OUT, ph_inet6);
- else
- error = 0;
-# else
- error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
- &inet6sw[ip6_protox[IPPROTO_IPV6]].pr_pfh);
-# endif
- if (error) {
- SPL_X(s);
- return error;
- }
-# endif
-#endif
- fr_deinitialise();
-
- fr_running = -2;
-
- (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
- (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE);
-
- if (ipf_locks_done == 1) {
- MUTEX_DESTROY(&ipf_timeoutlock);
- MUTEX_DESTROY(&ipf_rw);
- RW_DESTROY(&ipf_mutex);
- RW_DESTROY(&ipf_ipidfrag);
- RW_DESTROY(&ipf_global);
- ipf_locks_done = 0;
- }
-
- SPL_X(s);
-
- return 0;
-}
-
-
-/*
- * Filter ioctl interface.
- */
-int iplioctl(dev, cmd, data, mode
-# if defined(_KERNEL) && ((BSD >= 199506) || (__FreeBSD_version >= 220000))
-, p)
-# if (__FreeBSD_version >= 500024)
-struct thread *p;
-# else
-struct proc *p;
-# endif /* __FreeBSD_version >= 500024 */
-# else
-)
-# endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 502116)
-struct cdev *dev;
-#else
-dev_t dev;
-#endif
-ioctlcmd_t cmd;
-caddr_t data;
-int mode;
-{
-#ifdef USE_SPL
- int s;
-#endif
- int error = 0, unit = 0, tmp;
- friostat_t fio;
-
-#if (BSD >= 199306) && defined(_KERNEL)
- if ((securelevel >= 2) && (mode & FWRITE))
- return EPERM;
-#endif
-
- unit = GET_MINOR(dev);
- if ((IPL_LOGMAX < unit) || (unit < 0))
- return ENXIO;
-
- if (fr_running <= 0) {
- if (unit != IPL_LOGIPF)
- return EIO;
- if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
- cmd != SIOCIPFSET && cmd != SIOCFRENB &&
- cmd != SIOCGETFS && cmd != SIOCGETFF)
- return EIO;
- }
-
- SPL_NET(s);
-
- error = fr_ioctlswitch(unit, data, cmd, mode);
- if (error != -1) {
- SPL_X(s);
- return error;
- }
- error = 0;
-
- switch (cmd)
- {
- case FIONREAD :
-#ifdef IPFILTER_LOG
- BCOPYOUT(&iplused[IPL_LOGIPF], (caddr_t)data,
- sizeof(iplused[IPL_LOGIPF]));
-#endif
- break;
- case SIOCFRENB :
- if (!(mode & FWRITE))
- error = EPERM;
- else {
- BCOPYIN(data, &tmp, sizeof(tmp));
- if (tmp) {
- if (fr_running > 0)
- error = 0;
- else
- error = iplattach();
- if (error == 0)
- fr_running = 1;
- else
- (void) ipldetach();
- } else {
- error = ipldetach();
- if (error == 0)
- fr_running = -1;
- }
- }
- break;
- case SIOCIPFSET :
- if (!(mode & FWRITE)) {
- error = EPERM;
- break;
- }
- case SIOCIPFGETNEXT :
- case SIOCIPFGET :
- error = fr_ipftune(cmd, data);
- break;
- case SIOCSETFF :
- if (!(mode & FWRITE))
- error = EPERM;
- else
- BCOPYIN(data, &fr_flags, sizeof(fr_flags));
- break;
- case SIOCGETFF :
- BCOPYOUT(&fr_flags, data, sizeof(fr_flags));
- break;
- case SIOCFUNCL :
- error = fr_resolvefunc(data);
- break;
- case SIOCINAFR :
- case SIOCRMAFR :
- case SIOCADAFR :
- case SIOCZRLST :
- if (!(mode & FWRITE))
- error = EPERM;
- else
- error = frrequest(unit, cmd, data, fr_active, 1);
- break;
- case SIOCINIFR :
- case SIOCRMIFR :
- case SIOCADIFR :
- if (!(mode & FWRITE))
- error = EPERM;
- else
- error = frrequest(unit, cmd, data, 1 - fr_active, 1);
- break;
- case SIOCSWAPA :
- if (!(mode & FWRITE))
- error = EPERM;
- else {
- bzero((char *)frcache, sizeof(frcache[0]) * 2);
- *(u_int *)data = fr_active;
- fr_active = 1 - fr_active;
- }
- break;
- case SIOCGETFS :
- fr_getstat(&fio);
- error = fr_outobj(data, &fio, IPFOBJ_IPFSTAT);
- break;
- case SIOCFRZST :
- if (!(mode & FWRITE))
- error = EPERM;
- else
- error = fr_zerostats(data);
- break;
- case SIOCIPFFL :
- if (!(mode & FWRITE))
- error = EPERM;
- else {
- BCOPYIN(data, &tmp, sizeof(tmp));
- tmp = frflush(unit, 4, tmp);
- BCOPYOUT(&tmp, data, sizeof(tmp));
- }
- break;
-#ifdef USE_INET6
- case SIOCIPFL6 :
- if (!(mode & FWRITE))
- error = EPERM;
- else {
- BCOPYIN(data, &tmp, sizeof(tmp));
- tmp = frflush(unit, 6, tmp);
- BCOPYOUT(&tmp, data, sizeof(tmp));
- }
- break;
-#endif
- case SIOCSTLCK :
- BCOPYIN(data, &tmp, sizeof(tmp));
- fr_state_lock = tmp;
- fr_nat_lock = tmp;
- fr_frag_lock = tmp;
- fr_auth_lock = tmp;
- break;
-#ifdef IPFILTER_LOG
- case SIOCIPFFB :
- if (!(mode & FWRITE))
- error = EPERM;
- else
- *(int *)data = ipflog_clear(unit);
- break;
-#endif /* IPFILTER_LOG */
- case SIOCGFRST :
- error = fr_outobj(data, fr_fragstats(), IPFOBJ_FRAGSTAT);
- break;
- case SIOCFRSYN :
- if (!(mode & FWRITE))
- error = EPERM;
- else {
- frsync(NULL);
- }
- break;
- default :
- error = EINVAL;
- break;
- }
- SPL_X(s);
- return error;
-}
-
-
-#if 0
-void fr_forgetifp(ifp)
-void *ifp;
-{
- register frentry_t *f;
-
- WRITE_ENTER(&ipf_mutex);
- for (f = ipacct[0][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipacct[1][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipfilter[0][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipfilter[1][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
-#ifdef USE_INET6
- for (f = ipacct6[0][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipacct6[1][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipfilter6[0][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
- for (f = ipfilter6[1][fr_active]; (f != NULL); f = f->fr_next)
- if (f->fr_ifa == ifp)
- f->fr_ifa = (void *)-1;
-#endif
- RWLOCK_EXIT(&ipf_mutex);
- fr_natsync(ifp);
-}
-#endif
-
-
-/*
- * routines below for saving IP headers to buffer
- */
-int iplopen(dev, flags
-#if ((BSD >= 199506) || (__FreeBSD_version >= 220000)) && defined(_KERNEL)
-, devtype, p)
-int devtype;
-# if (__FreeBSD_version >= 500024)
-struct thread *p;
-# else
-struct proc *p;
-# endif /* __FreeBSD_version >= 500024 */
-#else
-)
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 502116)
-struct cdev *dev;
-#else
-dev_t dev;
-#endif
-int flags;
-{
- u_int min = GET_MINOR(dev);
-
- if (IPL_LOGMAX < min)
- min = ENXIO;
- else
- min = 0;
- return min;
-}
-
-
-int iplclose(dev, flags
-#if ((BSD >= 199506) || (__FreeBSD_version >= 220000)) && defined(_KERNEL)
-, devtype, p)
-int devtype;
-# if (__FreeBSD_version >= 500024)
-struct thread *p;
-# else
-struct proc *p;
-# endif /* __FreeBSD_version >= 500024 */
-#else
-)
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 502116)
-struct cdev *dev;
-#else
-dev_t dev;
-#endif
-int flags;
-{
- u_int min = GET_MINOR(dev);
-
- if (IPL_LOGMAX < min)
- min = ENXIO;
- else
- min = 0;
- return min;
-}
-
-/*
- * iplread/ipllog
- * both of these must operate with at least splnet() lest they be
- * called during packet processing and cause an inconsistancy to appear in
- * the filter lists.
- */
-#if (BSD >= 199306)
-int iplread(dev, uio, ioflag)
-int ioflag;
-#else
-int iplread(dev, uio)
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 502116)
-struct cdev *dev;
-#else
-dev_t dev;
-#endif
-register struct uio *uio;
-{
-
-# ifdef IPFILTER_SYNC
- if (GET_MINOR(dev) == IPL_LOGSYNC)
- return ipfsync_read(uio);
-# endif
-
-#ifdef IPFILTER_LOG
- return ipflog_read(GET_MINOR(dev), uio);
-#else
- return ENXIO;
-#endif
-}
-
-
-/*
- * iplwrite
- * both of these must operate with at least splnet() lest they be
- * called during packet processing and cause an inconsistancy to appear in
- * the filter lists.
- */
-#if (BSD >= 199306)
-int iplwrite(dev, uio, ioflag)
-int ioflag;
-#else
-int iplwrite(dev, uio)
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 502116)
-struct cdev *dev;
-#else
-dev_t dev;
-#endif
-register struct uio *uio;
-{
-
-#ifdef IPFILTER_SYNC
- if (GET_MINOR(dev) == IPL_LOGSYNC)
- return ipfsync_write(uio);
-#endif
- return ENXIO;
-}
-
-
-/*
- * fr_send_reset - this could conceivably be a call to tcp_respond(), but that
- * requires a large amount of setting up and isn't any more efficient.
- */
-int fr_send_reset(fin)
-fr_info_t *fin;
-{
- struct tcphdr *tcp, *tcp2;
- int tlen = 0, hlen;
- struct mbuf *m;
-#ifdef USE_INET6
- ip6_t *ip6;
-#endif
- ip_t *ip;
-
- tcp = fin->fin_dp;
- if (tcp->th_flags & TH_RST)
- return -1; /* feedback loop */
-
-#ifndef IPFILTER_CKSUM
- if (fr_checkl4sum(fin) == -1)
- return -1;
-#endif
-
- tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
- ((tcp->th_flags & TH_SYN) ? 1 : 0) +
- ((tcp->th_flags & TH_FIN) ? 1 : 0);
-
-#ifdef USE_INET6
- hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t);
-#else
- hlen = sizeof(ip_t);
-#endif
-#ifdef MGETHDR
- MGETHDR(m, M_DONTWAIT, MT_HEADER);
-#else
- MGET(m, M_DONTWAIT, MT_HEADER);
-#endif
- if (m == NULL)
- return -1;
- if (sizeof(*tcp2) + hlen > MLEN) {
- MCLGET(m, M_DONTWAIT);
- if ((m->m_flags & M_EXT) == 0) {
- FREE_MB_T(m);
- return -1;
- }
- }
-
- m->m_len = sizeof(*tcp2) + hlen;
-#if (BSD >= 199103)
- m->m_data += max_linkhdr;
- m->m_pkthdr.len = m->m_len;
- m->m_pkthdr.rcvif = (struct ifnet *)0;
-#endif
- ip = mtod(m, struct ip *);
- bzero((char *)ip, hlen);
-#ifdef USE_INET6
- ip6 = (ip6_t *)ip;
-#endif
- tcp2 = (struct tcphdr *)((char *)ip + hlen);
- tcp2->th_sport = tcp->th_dport;
- tcp2->th_dport = tcp->th_sport;
-
- if (tcp->th_flags & TH_ACK) {
- tcp2->th_seq = tcp->th_ack;
- tcp2->th_flags = TH_RST;
- tcp2->th_ack = 0;
- } else {
- tcp2->th_seq = 0;
- tcp2->th_ack = ntohl(tcp->th_seq);
- tcp2->th_ack += tlen;
- tcp2->th_ack = htonl(tcp2->th_ack);
- tcp2->th_flags = TH_RST|TH_ACK;
- }
- TCP_X2_A(tcp2, 0);
- TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
- tcp2->th_win = tcp->th_win;
- tcp2->th_sum = 0;
- tcp2->th_urp = 0;
-
-#ifdef USE_INET6
- if (fin->fin_v == 6) {
- ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
- ip6->ip6_plen = htons(sizeof(struct tcphdr));
- ip6->ip6_nxt = IPPROTO_TCP;
- ip6->ip6_hlim = 0;
- ip6->ip6_src = fin->fin_dst6;
- ip6->ip6_dst = fin->fin_src6;
- tcp2->th_sum = in6_cksum(m, IPPROTO_TCP,
- sizeof(*ip6), sizeof(*tcp2));
- return fr_send_ip(fin, m, &m);
- }
-#endif
- ip->ip_p = IPPROTO_TCP;
- ip->ip_len = htons(sizeof(struct tcphdr));
- ip->ip_src.s_addr = fin->fin_daddr;
- ip->ip_dst.s_addr = fin->fin_saddr;
- tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2));
- ip->ip_len = hlen + sizeof(*tcp2);
- return fr_send_ip(fin, m, &m);
-}
-
-
-static int fr_send_ip(fin, m, mpp)
-fr_info_t *fin;
-mb_t *m, **mpp;
-{
- fr_info_t fnew;
- ip_t *ip, *oip;
- int hlen;
-
- ip = mtod(m, ip_t *);
- bzero((char *)&fnew, sizeof(fnew));
-
- IP_V_A(ip, fin->fin_v);
- switch (fin->fin_v)
- {
- case 4 :
- fnew.fin_v = 4;
- oip = fin->fin_ip;
- IP_HL_A(ip, sizeof(*oip) >> 2);
- ip->ip_tos = oip->ip_tos;
- ip->ip_id = fin->fin_ip->ip_id;
-#if (__FreeBSD_version > 460000)
- ip->ip_off = path_mtu_discovery ? IP_DF : 0;
-#else
- ip->ip_off = 0;
-#endif
- ip->ip_ttl = ip_defttl;
- ip->ip_sum = 0;
- hlen = sizeof(*oip);
- break;
-#ifdef USE_INET6
- case 6 :
- {
- ip6_t *ip6 = (ip6_t *)ip;
-
- ip6->ip6_vfc = 0x60;
- ip6->ip6_hlim = IPDEFTTL;
-
- fnew.fin_v = 6;
- hlen = sizeof(*ip6);
- break;
- }
-#endif
- default :
- return EINVAL;
- }
-#ifdef IPSEC
- m->m_pkthdr.rcvif = NULL;
-#endif
-
- fnew.fin_ifp = fin->fin_ifp;
- fnew.fin_flx = FI_NOCKSUM;
- fnew.fin_m = m;
- fnew.fin_ip = ip;
- fnew.fin_mp = mpp;
- fnew.fin_hlen = hlen;
- fnew.fin_dp = (char *)ip + hlen;
- (void) fr_makefrip(hlen, ip, &fnew);
-
- return fr_fastroute(m, mpp, &fnew, NULL);
-}
-
-
-int fr_send_icmp_err(type, fin, dst)
-int type;
-fr_info_t *fin;
-int dst;
-{
- int err, hlen, xtra, iclen, ohlen, avail, code;
- struct in_addr dst4;
- struct icmp *icmp;
- struct mbuf *m;
- void *ifp;
-#ifdef USE_INET6
- ip6_t *ip6;
- struct in6_addr dst6;
-#endif
- ip_t *ip, *ip2;
-
- if ((type < 0) || (type > ICMP_MAXTYPE))
- return -1;
-
- code = fin->fin_icode;
-#ifdef USE_INET6
- if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int)))
- return -1;
-#endif
-
-#ifndef IPFILTER_CKSUM
- if (fr_checkl4sum(fin) == -1)
- return -1;
-#endif
-#ifdef MGETHDR
- MGETHDR(m, M_DONTWAIT, MT_HEADER);
-#else
- MGET(m, M_DONTWAIT, MT_HEADER);
-#endif
- if (m == NULL)
- return -1;
- avail = MHLEN;
-
- xtra = 0;
- hlen = 0;
- ohlen = 0;
- ifp = fin->fin_ifp;
- if (fin->fin_v == 4) {
- if ((fin->fin_p == IPPROTO_ICMP) &&
- !(fin->fin_flx & FI_SHORT))
- switch (ntohs(fin->fin_data[0]) >> 8)
- {
- case ICMP_ECHO :
- case ICMP_TSTAMP :
- case ICMP_IREQ :
- case ICMP_MASKREQ :
- break;
- default :
- FREE_MB_T(m);
- return 0;
- }
-
- if (dst == 0) {
- if (fr_ifpaddr(4, FRI_NORMAL, ifp,
- &dst4, NULL) == -1) {
- FREE_MB_T(m);
- return -1;
- }
- } else
- dst4.s_addr = fin->fin_daddr;
-
- hlen = sizeof(ip_t);
- ohlen = fin->fin_hlen;
- if (fin->fin_hlen < fin->fin_plen)
- xtra = MIN(fin->fin_dlen, 8);
- else
- xtra = 0;
- }
-
-#ifdef USE_INET6
- else if (fin->fin_v == 6) {
- hlen = sizeof(ip6_t);
- ohlen = sizeof(ip6_t);
- type = icmptoicmp6types[type];
- if (type == ICMP6_DST_UNREACH)
- code = icmptoicmp6unreach[code];
-
- if (hlen + sizeof(*icmp) + max_linkhdr +
- fin->fin_plen > avail) {
- MCLGET(m, M_DONTWAIT);
- if ((m->m_flags & M_EXT) == 0) {
- FREE_MB_T(m);
- return -1;
- }
- avail = MCLBYTES;
- }
- xtra = MIN(fin->fin_plen,
- avail - hlen - sizeof(*icmp) - max_linkhdr);
- if (dst == 0) {
- if (fr_ifpaddr(6, FRI_NORMAL, ifp,
- (struct in_addr *)&dst6, NULL) == -1) {
- FREE_MB_T(m);
- return -1;
- }
- } else
- dst6 = fin->fin_dst6;
- }
-#endif
- else {
- FREE_MB_T(m);
- return -1;
- }
-
- iclen = hlen + sizeof(*icmp);
- avail -= (max_linkhdr + iclen);
- if (avail < 0) {
- FREE_MB_T(m);
- return -1;
- }
- if (xtra > avail)
- xtra = avail;
- iclen += xtra;
- m->m_data += max_linkhdr;
- m->m_pkthdr.rcvif = (struct ifnet *)0;
- m->m_pkthdr.len = iclen;
- m->m_len = iclen;
- ip = mtod(m, ip_t *);
- icmp = (struct icmp *)((char *)ip + hlen);
- ip2 = (ip_t *)&icmp->icmp_ip;
-
- icmp->icmp_type = type;
- icmp->icmp_code = fin->fin_icode;
- icmp->icmp_cksum = 0;
-#ifdef icmp_nextmtu
- if (type == ICMP_UNREACH &&
- fin->fin_icode == ICMP_UNREACH_NEEDFRAG && ifp)
- icmp->icmp_nextmtu = htons(((struct ifnet *)ifp)->if_mtu);
-#endif
-
- bcopy((char *)fin->fin_ip, (char *)ip2, ohlen);
-
-#ifdef USE_INET6
- ip6 = (ip6_t *)ip;
- if (fin->fin_v == 6) {
- ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
- ip6->ip6_plen = htons(iclen - hlen);
- ip6->ip6_nxt = IPPROTO_ICMPV6;
- ip6->ip6_hlim = 0;
- ip6->ip6_src = dst6;
- ip6->ip6_dst = fin->fin_src6;
- if (xtra > 0)
- bcopy((char *)fin->fin_ip + ohlen,
- (char *)&icmp->icmp_ip + ohlen, xtra);
- icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6,
- sizeof(*ip6), iclen - hlen);
- } else
-#endif
- {
- ip2->ip_len = htons(ip2->ip_len);
- ip2->ip_off = htons(ip2->ip_off);
- ip->ip_p = IPPROTO_ICMP;
- ip->ip_src.s_addr = dst4.s_addr;
- ip->ip_dst.s_addr = fin->fin_saddr;
-
- if (xtra > 0)
- bcopy((char *)fin->fin_ip + ohlen,
- (char *)&icmp->icmp_ip + ohlen, xtra);
- icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
- sizeof(*icmp) + 8);
- ip->ip_len = iclen;
- ip->ip_p = IPPROTO_ICMP;
- }
- err = fr_send_ip(fin, m, &m);
- return err;
-}
-
-
-#if !defined(IPFILTER_LKM) && (__FreeBSD_version < 300000)
-# if (BSD < 199306)
-int iplinit __P((void));
-
-int
-# else
-void iplinit __P((void));
-
-void
-# endif
-iplinit()
-{
- if (iplattach() != 0)
- printf("IP Filter failed to attach\n");
- ip_init();
-}
-#endif /* __FreeBSD_version < 300000 */
-
-
-int fr_fastroute(m0, mpp, fin, fdp)
-mb_t *m0, **mpp;
-fr_info_t *fin;
-frdest_t *fdp;
-{
- register struct ip *ip, *mhip;
- register struct mbuf *m = m0;
- register struct route *ro;
- int len, off, error = 0, hlen, code;
- struct ifnet *ifp, *sifp;
- struct sockaddr_in *dst;
- struct route iproute;
- u_short ip_off;
- frentry_t *fr;
-
-#ifdef M_WRITABLE
- /*
- * HOT FIX/KLUDGE:
- *
- * If the mbuf we're about to send is not writable (because of
- * a cluster reference, for example) we'll need to make a copy
- * of it since this routine modifies the contents.
- *
- * If you have non-crappy network hardware that can transmit data
- * from the mbuf, rather than making a copy, this is gonna be a
- * problem.
- */
- if (M_WRITABLE(m) == 0) {
- if ((m0 = m_dup(m, M_DONTWAIT)) != 0) {
- FREE_MB_T(m);
- m = m0;
- *mpp = m;
- } else {
- error = ENOBUFS;
- FREE_MB_T(m);
- *mpp = NULL;
- fr_frouteok[1]++;
- }
- }
-#endif
-
-#ifdef USE_INET6
- if (fin->fin_v == 6) {
- /*
- * currently "to <if>" and "to <if>:ip#" are not supported
- * for IPv6
- */
-#if (__FreeBSD_version >= 490000)
- return ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
-#else
- return ip6_output(m0, NULL, NULL, 0, NULL, NULL);
-#endif
- }
-#endif
-
- hlen = fin->fin_hlen;
- ip = mtod(m0, struct ip *);
-
- /*
- * Route packet.
- */
- ro = &iproute;
- bzero((caddr_t)ro, sizeof (*ro));
- dst = (struct sockaddr_in *)&ro->ro_dst;
- dst->sin_family = AF_INET;
- dst->sin_addr = ip->ip_dst;
-
- fr = fin->fin_fr;
- if (fdp != NULL)
- ifp = fdp->fd_ifp;
- else
- ifp = fin->fin_ifp;
-
- if ((ifp == NULL) && (!fr || !(fr->fr_flags & FR_FASTROUTE))) {
- error = -2;
- goto bad;
- }
-
- /*
- * In case we're here due to "to <if>" being used with "keep state",
- * check that we're going in the correct direction.
- */
- if ((fr != NULL) && (fin->fin_rev != 0)) {
- if ((ifp != NULL) && (fdp == &fr->fr_tif))
- return -1;
- }
- if (fdp != NULL) {
- if (fdp->fd_ip.s_addr != 0)
- dst->sin_addr = fdp->fd_ip;
- }
-
- dst->sin_len = sizeof(*dst);
- rtalloc(ro);
-
- if ((ifp == NULL) && (ro->ro_rt != NULL))
- ifp = ro->ro_rt->rt_ifp;
-
- if ((ro->ro_rt == NULL) || (ifp == NULL)) {
- if (in_localaddr(ip->ip_dst))
- error = EHOSTUNREACH;
- else
- error = ENETUNREACH;
- goto bad;
- }
- if (ro->ro_rt->rt_flags & RTF_GATEWAY)
- dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
- if (ro->ro_rt)
- ro->ro_rt->rt_use++;
-
- /*
- * For input packets which are being "fastrouted", they won't
- * go back through output filtering and miss their chance to get
- * NAT'd and counted.
- */
- if (fin->fin_out == 0) {
- sifp = fin->fin_ifp;
- fin->fin_ifp = ifp;
- fin->fin_out = 1;
- (void) fr_acctpkt(fin, NULL);
- fin->fin_fr = NULL;
- if (!fr || !(fr->fr_flags & FR_RETMASK)) {
- u_32_t pass;
-
- (void) fr_checkstate(fin, &pass);
- }
-
- switch (fr_checknatout(fin, NULL))
- {
- case 0 :
- break;
- case 1 :
- ip->ip_sum = 0;
- break;
- case -1 :
- error = -1;
- goto done;
- break;
- }
-
- fin->fin_ifp = sifp;
- fin->fin_out = 0;
- } else
- ip->ip_sum = 0;
- /*
- * If small enough for interface, can just send directly.
- */
- if (ip->ip_len <= ifp->if_mtu) {
- ip->ip_len = htons(ip->ip_len);
- ip->ip_off = htons(ip->ip_off);
-
- if (!ip->ip_sum)
- ip->ip_sum = in_cksum(m, hlen);
- error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
- ro->ro_rt);
- goto done;
- }
- /*
- * Too large for interface; fragment if possible.
- * Must be able to put at least 8 bytes per fragment.
- */
- ip_off = ntohs(ip->ip_off);
- if (ip_off & IP_DF) {
- error = EMSGSIZE;
- goto bad;
- }
- len = (ifp->if_mtu - hlen) &~ 7;
- if (len < 8) {
- error = EMSGSIZE;
- goto bad;
- }
-
- {
- int mhlen, firstlen = len;
- struct mbuf **mnext = &m->m_act;
-
- /*
- * Loop through length of segment after first fragment,
- * make new header and copy data of each part and link onto chain.
- */
- m0 = m;
- mhlen = sizeof (struct ip);
- for (off = hlen + len; off < ip->ip_len; off += len) {
-#ifdef MGETHDR
- MGETHDR(m, M_DONTWAIT, MT_HEADER);
-#else
- MGET(m, M_DONTWAIT, MT_HEADER);
-#endif
- if (m == 0) {
- m = m0;
- error = ENOBUFS;
- goto bad;
- }
- m->m_data += max_linkhdr;
- mhip = mtod(m, struct ip *);
- bcopy((char *)ip, (char *)mhip, sizeof(*ip));
- if (hlen > sizeof (struct ip)) {
- mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
- IP_HL_A(mhip, mhlen >> 2);
- }
- m->m_len = mhlen;
- mhip->ip_off = ((off - hlen) >> 3) + ip_off;
- if (off + len >= ip->ip_len)
- len = ip->ip_len - off;
- else
- mhip->ip_off |= IP_MF;
- mhip->ip_len = htons((u_short)(len + mhlen));
- m->m_next = m_copy(m0, off, len);
- if (m->m_next == 0) {
- error = ENOBUFS; /* ??? */
- goto sendorfree;
- }
- m->m_pkthdr.len = mhlen + len;
- m->m_pkthdr.rcvif = NULL;
- mhip->ip_off = htons((u_short)mhip->ip_off);
- mhip->ip_sum = 0;
- mhip->ip_sum = in_cksum(m, mhlen);
- *mnext = m;
- mnext = &m->m_act;
- }
- /*
- * Update first fragment by trimming what's been copied out
- * and updating header, then send each fragment (in order).
- */
- m_adj(m0, hlen + firstlen - ip->ip_len);
- ip->ip_len = htons((u_short)(hlen + firstlen));
- ip->ip_off = htons((u_short)IP_MF);
- ip->ip_sum = 0;
- ip->ip_sum = in_cksum(m0, hlen);
-sendorfree:
- for (m = m0; m; m = m0) {
- m0 = m->m_act;
- m->m_act = 0;
- if (error == 0)
- error = (*ifp->if_output)(ifp, m,
- (struct sockaddr *)dst, ro->ro_rt);
- else
- FREE_MB_T(m);
- }
- }
-done:
- if (!error)
- fr_frouteok[0]++;
- else
- fr_frouteok[1]++;
-
- if (ro->ro_rt) {
- RTFREE(ro->ro_rt);
- }
- *mpp = NULL;
- return 0;
-bad:
- if (error == EMSGSIZE) {
- sifp = fin->fin_ifp;
- code = fin->fin_icode;
- fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
- fin->fin_ifp = ifp;
- (void) fr_send_icmp_err(ICMP_UNREACH, fin, 1);
- fin->fin_ifp = sifp;
- fin->fin_icode = code;
- }
- FREE_MB_T(m);
- goto done;
-}
-
-
-int fr_verifysrc(fin)
-fr_info_t *fin;
-{
- struct sockaddr_in *dst;
- struct route iproute;
-
- bzero((char *)&iproute, sizeof(iproute));
- dst = (struct sockaddr_in *)&iproute.ro_dst;
- dst->sin_len = sizeof(*dst);
- dst->sin_family = AF_INET;
- dst->sin_addr = fin->fin_src;
- rtalloc(&iproute);
- if (iproute.ro_rt == NULL)
- return 0;
- return (fin->fin_ifp == iproute.ro_rt->rt_ifp);
-}
-
-
-/*
- * return the first IP Address associated with an interface
- */
-int fr_ifpaddr(v, atype, ifptr, inp, inpmask)
-int v, atype;
-void *ifptr;
-struct in_addr *inp, *inpmask;
-{
-#ifdef USE_INET6
- struct in6_addr *inp6 = NULL;
-#endif
- struct sockaddr *sock, *mask;
- struct sockaddr_in *sin;
- struct ifaddr *ifa;
- struct ifnet *ifp;
-
- if ((ifptr == NULL) || (ifptr == (void *)-1))
- return -1;
-
- sin = NULL;
- ifp = ifptr;
-
- if (v == 4)
- inp->s_addr = 0;
-#ifdef USE_INET6
- else if (v == 6)
- bzero((char *)inp, sizeof(struct in6_addr));
-#endif
-#if (__FreeBSD_version >= 300000)
- ifa = TAILQ_FIRST(&ifp->if_addrhead);
-#else
- ifa = ifp->if_addrlist;
-#endif /* __FreeBSD_version >= 300000 */
-
- sock = ifa->ifa_addr;
- while (sock != NULL && ifa != NULL) {
- sin = (struct sockaddr_in *)sock;
- if ((v == 4) && (sin->sin_family == AF_INET))
- break;
-#ifdef USE_INET6
- if ((v == 6) && (sin->sin_family == AF_INET6)) {
- inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
- if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
- !IN6_IS_ADDR_LOOPBACK(inp6))
- break;
- }
-#endif
-#if (__FreeBSD_version >= 300000)
- ifa = TAILQ_NEXT(ifa, ifa_link);
-#else
- ifa = ifa->ifa_next;
-#endif /* __FreeBSD_version >= 300000 */
- if (ifa != NULL)
- sock = ifa->ifa_addr;
- }
-
- if (ifa == NULL || sin == NULL)
- return -1;
-
- mask = ifa->ifa_netmask;
- if (atype == FRI_BROADCAST)
- sock = ifa->ifa_broadaddr;
- else if (atype == FRI_PEERADDR)
- sock = ifa->ifa_dstaddr;
-
-#ifdef USE_INET6
- if (v == 6) {
- return fr_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock,
- (struct sockaddr_in6 *)mask,
- inp, inpmask);
- }
-#endif
- return fr_ifpfillv4addr(atype, (struct sockaddr_in *)sock,
- (struct sockaddr_in *)mask, inp, inpmask);
-}
-
-
-u_32_t fr_newisn(fin)
-fr_info_t *fin;
-{
- u_32_t newiss;
-#if (__FreeBSD_version >= 400000)
- newiss = arc4random();
-#else
- static iss_seq_off = 0;
- u_char hash[16];
- MD5_CTX ctx;
-
- /*
- * Compute the base value of the ISS. It is a hash
- * of (saddr, sport, daddr, dport, secret).
- */
- MD5Init(&ctx);
-
- MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src,
- sizeof(fin->fin_fi.fi_src));
- MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst,
- sizeof(fin->fin_fi.fi_dst));
- MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat));
-
- MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret));
-
- MD5Final(hash, &ctx);
-
- memcpy(&newiss, hash, sizeof(newiss));
-
- /*
- * Now increment our "timer", and add it in to
- * the computed value.
- *
- * XXX Use `addin'?
- * XXX TCP_ISSINCR too large to use?
- */
- iss_seq_off += 0x00010000;
- newiss += iss_seq_off;
-#endif
- return newiss;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_nextipid */
-/* Returns: int - 0 == success, -1 == error (packet should be droppped) */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Returns the next IPv4 ID to use for this packet. */
-/* ------------------------------------------------------------------------ */
-u_short fr_nextipid(fin)
-fr_info_t *fin;
-{
-#ifndef RANDOM_IP_ID
- static u_short ipid = 0;
- u_short id;
-
- MUTEX_ENTER(&ipf_rw);
- id = ipid++;
- MUTEX_EXIT(&ipf_rw);
-#else
- u_short id;
-
- id = ip_randomid();
-#endif
-
- return id;
-}
-
-
-INLINE void fr_checkv4sum(fin)
-fr_info_t *fin;
-{
-#ifdef CSUM_DATA_VALID
- int manual = 0;
- u_short sum;
- ip_t *ip;
- mb_t *m;
-
- if ((fin->fin_flx & FI_NOCKSUM) != 0)
- return;
-
- m = fin->fin_m;
- if (m == NULL) {
- manual = 1;
- goto skipauto;
- }
- ip = fin->fin_ip;
-
- if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
- if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
- sum = m->m_pkthdr.csum_data;
- else
- sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
- htonl(m->m_pkthdr.csum_data +
- fin->fin_ip->ip_len + fin->fin_p));
- sum ^= 0xffff;
- if (sum != 0)
- fin->fin_flx |= FI_BAD;
- } else
- manual = 1;
-skipauto:
-# ifdef IPFILTER_CKSUM
- if (manual != 0)
- if (fr_checkl4sum(fin) == -1)
- fin->fin_flx |= FI_BAD;
-# else
- ;
-# endif
-#else
-# ifdef IPFILTER_CKSUM
- if (fr_checkl4sum(fin) == -1)
- fin->fin_flx |= FI_BAD;
-# endif
-#endif
-}
-
-
-#ifdef USE_INET6
-INLINE void fr_checkv6sum(fin)
-fr_info_t *fin;
-{
-# ifdef IPFILTER_CKSUM
- if (fr_checkl4sum(fin) == -1)
- fin->fin_flx |= FI_BAD;
-# endif
-}
-#endif /* USE_INET6 */
-
-
-size_t mbufchainlen(m0)
-struct mbuf *m0;
-{
- size_t len;
-
- if ((m0->m_flags & M_PKTHDR) != 0) {
- len = m0->m_pkthdr.len;
- } else {
- struct mbuf *m;
-
- for (m = m0, len = 0; m != NULL; m = m->m_next)
- len += m->m_len;
- }
- return len;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_pullup */
-/* Returns: NULL == pullup failed, else pointer to protocol header */
-/* Parameters: m(I) - pointer to buffer where data packet starts */
-/* fin(I) - pointer to packet information */
-/* len(I) - number of bytes to pullup */
-/* */
-/* Attempt to move at least len bytes (from the start of the buffer) into a */
-/* single buffer for ease of access. Operating system native functions are */
-/* used to manage buffers - if necessary. If the entire packet ends up in */
-/* a single buffer, set the FI_COALESCE flag even though fr_coalesce() has */
-/* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */
-/* and ONLY if the pullup succeeds. */
-/* */
-/* We assume that 'min' is a pointer to a buffer that is part of the chain */
-/* of buffers that starts at *fin->fin_mp. */
-/* ------------------------------------------------------------------------ */
-void *fr_pullup(min, fin, len)
-mb_t *min;
-fr_info_t *fin;
-int len;
-{
- int out = fin->fin_out, dpoff, ipoff;
- mb_t *m = min;
- char *ip;
-
- if (m == NULL)
- return NULL;
-
- ip = (char *)fin->fin_ip;
- if ((fin->fin_flx & FI_COALESCE) != 0)
- return ip;
-
- ipoff = fin->fin_ipoff;
- if (fin->fin_dp != NULL)
- dpoff = (char *)fin->fin_dp - (char *)ip;
- else
- dpoff = 0;
-
- if (M_LEN(m) < len) {
-#ifdef MHLEN
- /*
- * Assume that M_PKTHDR is set and just work with what is left
- * rather than check..
- * Should not make any real difference, anyway.
- */
- if (len > MHLEN)
-#else
- if (len > MLEN)
-#endif
- {
-#ifdef HAVE_M_PULLDOWN
- if (m_pulldown(m, 0, len, NULL) == NULL)
- m = NULL;
-#else
- FREE_MB_T(*fin->fin_mp);
- m = NULL;
-#endif
- } else
- {
- m = m_pullup(m, len);
- }
- *fin->fin_mp = m;
- fin->fin_m = m;
- if (m == NULL) {
- ATOMIC_INCL(frstats[out].fr_pull[1]);
- return NULL;
- }
- ip = MTOD(m, char *) + ipoff;
- }
-
- ATOMIC_INCL(frstats[out].fr_pull[0]);
- fin->fin_ip = (ip_t *)ip;
- if (fin->fin_dp != NULL)
- fin->fin_dp = (char *)fin->fin_ip + dpoff;
-
- if (len == fin->fin_plen)
- fin->fin_flx |= FI_COALESCE;
- return ip;
-}
diff --git a/contrib/ipfilter/ip_frag.c b/contrib/ipfilter/ip_frag.c
deleted file mode 100644
index 087ca19e72c3..000000000000
--- a/contrib/ipfilter/ip_frag.c
+++ /dev/null
@@ -1,858 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2003 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-#if defined(KERNEL) || defined(_KERNEL)
-# undef KERNEL
-# undef _KERNEL
-# define KERNEL 1
-# define _KERNEL 1
-#endif
-#include <sys/errno.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/file.h>
-#ifdef __hpux
-# include <sys/timeout.h>
-#endif
-#if !defined(_KERNEL)
-# include <stdio.h>
-# include <string.h>
-# include <stdlib.h>
-# define _KERNEL
-# ifdef __OpenBSD__
-struct file;
-# endif
-# include <sys/uio.h>
-# undef _KERNEL
-#endif
-#if defined(_KERNEL) && (__FreeBSD_version >= 220000)
-# include <sys/filio.h>
-# include <sys/fcntl.h>
-#else
-# include <sys/ioctl.h>
-#endif
-#if !defined(linux)
-# include <sys/protosw.h>
-#endif
-#include <sys/socket.h>
-#if defined(_KERNEL)
-# include <sys/systm.h>
-# if !defined(__SVR4) && !defined(__svr4__)
-# include <sys/mbuf.h>
-# endif
-#endif
-#if !defined(__SVR4) && !defined(__svr4__)
-# if defined(_KERNEL) && !defined(__sgi)
-# include <sys/kernel.h>
-# endif
-#else
-# include <sys/byteorder.h>
-# ifdef _KERNEL
-# include <sys/dditypes.h>
-# endif
-# include <sys/stream.h>
-# include <sys/kmem.h>
-#endif
-#include <net/if.h>
-#ifdef sun
-# include <net/af.h>
-#endif
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#if !defined(linux)
-# include <netinet/ip_var.h>
-#endif
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
-#include <netinet/ip_icmp.h>
-#include "netinet/ip_compat.h"
-#include <netinet/tcpip.h>
-#include "netinet/ip_fil.h"
-#include "netinet/ip_nat.h"
-#include "netinet/ip_frag.h"
-#include "netinet/ip_state.h"
-#include "netinet/ip_auth.h"
-#include "netinet/ip_proxy.h"
-#if (__FreeBSD_version >= 300000)
-# include <sys/malloc.h>
-# if defined(_KERNEL)
-# ifndef IPFILTER_LKM
-# include <sys/libkern.h>
-# include <sys/systm.h>
-# endif
-extern struct callout_handle fr_slowtimer_ch;
-# endif
-#endif
-#if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
-# include <sys/callout.h>
-extern struct callout fr_slowtimer_ch;
-#endif
-#if defined(__OpenBSD__)
-# include <sys/timeout.h>
-extern struct timeout fr_slowtimer_ch;
-#endif
-/* END OF INCLUDES */
-
-#if !defined(lint)
-static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)Id: ip_frag.c,v 2.77 2004/01/27 00:24:54 darrenr Exp";
-#endif
-
-
-static ipfr_t *ipfr_list = NULL;
-static ipfr_t **ipfr_tail = &ipfr_list;
-static ipfr_t **ipfr_heads;
-
-static ipfr_t *ipfr_natlist = NULL;
-static ipfr_t **ipfr_nattail = &ipfr_natlist;
-static ipfr_t **ipfr_nattab;
-
-static ipfr_t *ipfr_ipidlist = NULL;
-static ipfr_t **ipfr_ipidtail = &ipfr_ipidlist;
-static ipfr_t **ipfr_ipidtab;
-
-static ipfrstat_t ipfr_stats;
-static int ipfr_inuse = 0;
-int ipfr_size = IPFT_SIZE;
-
-int fr_ipfrttl = 120; /* 60 seconds */
-int fr_frag_lock = 0;
-int fr_frag_init = 0;
-u_long fr_ticks = 0;
-
-
-static ipfr_t *ipfr_newfrag __P((fr_info_t *, u_32_t, ipfr_t **));
-static ipfr_t *fr_fraglookup __P((fr_info_t *, ipfr_t **));
-static void fr_fragdelete __P((ipfr_t *, ipfr_t ***));
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fraginit */
-/* Returns: int - 0 == success, -1 == error */
-/* Parameters: Nil */
-/* */
-/* Initialise the hash tables for the fragment cache lookups. */
-/* ------------------------------------------------------------------------ */
-int fr_fraginit()
-{
- KMALLOCS(ipfr_heads, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
- if (ipfr_heads == NULL)
- return -1;
- bzero((char *)ipfr_heads, ipfr_size * sizeof(ipfr_t *));
-
- KMALLOCS(ipfr_nattab, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
- if (ipfr_nattab == NULL)
- return -1;
- bzero((char *)ipfr_nattab, ipfr_size * sizeof(ipfr_t *));
-
- KMALLOCS(ipfr_ipidtab, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
- if (ipfr_ipidtab == NULL)
- return -1;
- bzero((char *)ipfr_ipidtab, ipfr_size * sizeof(ipfr_t *));
-
- RWLOCK_INIT(&ipf_frag, "ipf fragment rwlock");
- fr_frag_init = 1;
-
- return 0;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fragunload */
-/* Returns: Nil */
-/* Parameters: Nil */
-/* */
-/* Free all memory allocated whilst running and from initialisation. */
-/* ------------------------------------------------------------------------ */
-void fr_fragunload()
-{
- if (fr_frag_init == 1) {
- fr_fragclear();
-
- RW_DESTROY(&ipf_frag);
- fr_frag_init = 0;
- }
-
- if (ipfr_heads != NULL)
- KFREES(ipfr_heads, ipfr_size * sizeof(ipfr_t *));
- ipfr_heads = NULL;
-
- if (ipfr_nattab != NULL)
- KFREES(ipfr_nattab, ipfr_size * sizeof(ipfr_t *));
- ipfr_nattab = NULL;
-
- if (ipfr_ipidtab != NULL)
- KFREES(ipfr_ipidtab, ipfr_size * sizeof(ipfr_t *));
- ipfr_ipidtab = NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fragstats */
-/* Returns: ipfrstat_t* - pointer to struct with current frag stats */
-/* Parameters: Nil */
-/* */
-/* Updates ipfr_stats with current information and returns a pointer to it */
-/* ------------------------------------------------------------------------ */
-ipfrstat_t *fr_fragstats()
-{
- ipfr_stats.ifs_table = ipfr_heads;
- ipfr_stats.ifs_nattab = ipfr_nattab;
- ipfr_stats.ifs_inuse = ipfr_inuse;
- return &ipfr_stats;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: ipfr_newfrag */
-/* Returns: ipfr_t * - pointer to fragment cache state info or NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* table(I) - pointer to frag table to add to */
-/* */
-/* Add a new entry to the fragment cache, registering it as having come */
-/* through this box, with the result of the filter operation. */
-/* ------------------------------------------------------------------------ */
-static ipfr_t *ipfr_newfrag(fin, pass, table)
-fr_info_t *fin;
-u_32_t pass;
-ipfr_t *table[];
-{
- ipfr_t *fra, frag;
- u_int idx, off;
- ip_t *ip;
-
- if (ipfr_inuse >= IPFT_SIZE)
- return NULL;
-
- if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
- return NULL;
-
- ip = fin->fin_ip;
-
- if (pass & FR_FRSTRICT)
- if ((ip->ip_off & IP_OFFMASK) != 0)
- return NULL;
-
- frag.ipfr_p = ip->ip_p;
- idx = ip->ip_p;
- frag.ipfr_id = ip->ip_id;
- idx += ip->ip_id;
- frag.ipfr_tos = ip->ip_tos;
- frag.ipfr_src.s_addr = ip->ip_src.s_addr;
- idx += ip->ip_src.s_addr;
- frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
- idx += ip->ip_dst.s_addr;
- frag.ipfr_ifp = fin->fin_ifp;
- idx *= 127;
- idx %= IPFT_SIZE;
-
- frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
- frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
- frag.ipfr_auth = fin->fin_fi.fi_auth;
-
- /*
- * first, make sure it isn't already there...
- */
- for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
- if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
- IPFR_CMPSZ)) {
- ipfr_stats.ifs_exists++;
- return NULL;
- }
-
- /*
- * allocate some memory, if possible, if not, just record that we
- * failed to do so.
- */
- KMALLOC(fra, ipfr_t *);
- if (fra == NULL) {
- ipfr_stats.ifs_nomem++;
- return NULL;
- }
-
- if ((fra->ipfr_rule = fin->fin_fr) != NULL)
- fin->fin_fr->fr_ref++;
-
- /*
- * Insert the fragment into the fragment table, copy the struct used
- * in the search using bcopy rather than reassign each field.
- * Set the ttl to the default.
- */
- if ((fra->ipfr_hnext = table[idx]) != NULL)
- table[idx]->ipfr_hprev = &fra->ipfr_hnext;
- fra->ipfr_hprev = table + idx;
- fra->ipfr_data = NULL;
- table[idx] = fra;
- bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
- fra->ipfr_ttl = fr_ticks + fr_ipfrttl;
-
- /*
- * Compute the offset of the expected start of the next packet.
- */
- off = ip->ip_off & IP_OFFMASK;
- if (off == 0)
- fra->ipfr_seen0 = 1;
- fra->ipfr_off = off + (fin->fin_dlen >> 3);
- fra->ipfr_pass = pass;
- ipfr_stats.ifs_new++;
- ipfr_inuse++;
- return fra;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_newfrag */
-/* Returns: int - 0 == success, -1 == error */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Add a new entry to the fragment cache table based on the current packet */
-/* ------------------------------------------------------------------------ */
-int fr_newfrag(fin, pass)
-u_32_t pass;
-fr_info_t *fin;
-{
- ipfr_t *fra;
-
- if ((fin->fin_v != 4) || (fr_frag_lock != 0))
- return -1;
-
- WRITE_ENTER(&ipf_frag);
- fra = ipfr_newfrag(fin, pass, ipfr_heads);
- if (fra != NULL) {
- *ipfr_tail = fra;
- fra->ipfr_prev = ipfr_tail;
- ipfr_tail = &fra->ipfr_next;
- if (ipfr_list == NULL)
- ipfr_list = fra;
- fra->ipfr_next = NULL;
- }
- RWLOCK_EXIT(&ipf_frag);
- return fra ? 0 : -1;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_nat_newfrag */
-/* Returns: int - 0 == success, -1 == error */
-/* Parameters: fin(I) - pointer to packet information */
-/* nat(I) - pointer to NAT structure */
-/* */
-/* Create a new NAT fragment cache entry based on the current packet and */
-/* the NAT structure for this "session". */
-/* ------------------------------------------------------------------------ */
-int fr_nat_newfrag(fin, pass, nat)
-fr_info_t *fin;
-u_32_t pass;
-nat_t *nat;
-{
- ipfr_t *fra;
-
- if ((fin->fin_v != 4) || (fr_frag_lock != 0))
- return 0;
-
- WRITE_ENTER(&ipf_natfrag);
- fra = ipfr_newfrag(fin, pass, ipfr_nattab);
- if (fra != NULL) {
- fra->ipfr_data = nat;
- nat->nat_data = fra;
- *ipfr_nattail = fra;
- fra->ipfr_prev = ipfr_nattail;
- ipfr_nattail = &fra->ipfr_next;
- fra->ipfr_next = NULL;
- }
- RWLOCK_EXIT(&ipf_natfrag);
- return fra ? 0 : -1;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ipid_newfrag */
-/* Returns: int - 0 == success, -1 == error */
-/* Parameters: fin(I) - pointer to packet information */
-/* ipid(I) - new IP ID for this fragmented packet */
-/* */
-/* Create a new fragment cache entry for this packet and store, as a data */
-/* pointer, the new IP ID value. */
-/* ------------------------------------------------------------------------ */
-int fr_ipid_newfrag(fin, ipid)
-fr_info_t *fin;
-u_32_t ipid;
-{
- ipfr_t *fra;
-
- if ((fin->fin_v != 4) || (fr_frag_lock))
- return 0;
-
- WRITE_ENTER(&ipf_ipidfrag);
- fra = ipfr_newfrag(fin, 0, ipfr_ipidtab);
- if (fra != NULL) {
- fra->ipfr_data = (void *)ipid;
- *ipfr_ipidtail = fra;
- fra->ipfr_prev = ipfr_ipidtail;
- ipfr_ipidtail = &fra->ipfr_next;
- fra->ipfr_next = NULL;
- }
- RWLOCK_EXIT(&ipf_ipidfrag);
- return fra ? 0 : -1;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fraglookup */
-/* Returns: ipfr_t * - pointer to ipfr_t structure if there's a */
-/* matching entry in the frag table, else NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* table(I) - pointer to fragment cache table to search */
-/* */
-/* Check the fragment cache to see if there is already a record of this */
-/* packet with its filter result known. */
-/* ------------------------------------------------------------------------ */
-static ipfr_t *fr_fraglookup(fin, table)
-fr_info_t *fin;
-ipfr_t *table[];
-{
- ipfr_t *f, frag;
- u_int idx;
- ip_t *ip;
-
- if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
- return NULL;
-
- /*
- * For fragments, we record protocol, packet id, TOS and both IP#'s
- * (these should all be the same for all fragments of a packet).
- *
- * build up a hash value to index the table with.
- */
- ip = fin->fin_ip;
- frag.ipfr_p = ip->ip_p;
- idx = ip->ip_p;
- frag.ipfr_id = ip->ip_id;
- idx += ip->ip_id;
- frag.ipfr_tos = ip->ip_tos;
- frag.ipfr_src.s_addr = ip->ip_src.s_addr;
- idx += ip->ip_src.s_addr;
- frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
- idx += ip->ip_dst.s_addr;
- frag.ipfr_ifp = fin->fin_ifp;
- idx *= 127;
- idx %= IPFT_SIZE;
-
- frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
- frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
- frag.ipfr_auth = fin->fin_fi.fi_auth;
-
- /*
- * check the table, careful to only compare the right amount of data
- */
- for (f = table[idx]; f; f = f->ipfr_hnext)
- if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
- IPFR_CMPSZ)) {
- u_short off;
-
- /*
- * We don't want to let short packets match because
- * they could be compromising the security of other
- * rules that want to match on layer 4 fields (and
- * can't because they have been fragmented off.)
- * Why do this check here? The counter acts as an
- * indicator of this kind of attack, whereas if it was
- * elsewhere, it wouldn't know if other matching
- * packets had been seen.
- */
- if (fin->fin_flx & FI_SHORT) {
- ATOMIC_INCL(ipfr_stats.ifs_short);
- continue;
- }
-
- /*
- * XXX - We really need to be guarding against the
- * retransmission of (src,dst,id,offset-range) here
- * because a fragmented packet is never resent with
- * the same IP ID# (or shouldn't).
- */
- off = ip->ip_off & IP_OFFMASK;
- if (f->ipfr_seen0) {
- if (off == 0) {
- ATOMIC_INCL(ipfr_stats.ifs_retrans0);
- continue;
- }
- } else if (off == 0)
- f->ipfr_seen0 = 1;
-
- if (f != table[idx]) {
- ipfr_t **fp;
-
- /*
- * Move fragment info. to the top of the list
- * to speed up searches. First, delink...
- */
- fp = f->ipfr_hprev;
- (*fp) = f->ipfr_hnext;
- if (f->ipfr_hnext != NULL)
- f->ipfr_hnext->ipfr_hprev = fp;
- /*
- * Then put back at the top of the chain.
- */
- f->ipfr_hnext = table[idx];
- table[idx]->ipfr_hprev = &f->ipfr_hnext;
- f->ipfr_hprev = table + idx;
- table[idx] = f;
- }
-
- /*
- * If we've follwed the fragments, and this is the
- * last (in order), shrink expiration time.
- */
- if (off == f->ipfr_off) {
- if (!(ip->ip_off & IP_MF))
- f->ipfr_ttl = fr_ticks + 1;
- f->ipfr_off = (fin->fin_dlen >> 3) + off;
- } else if (f->ipfr_pass & FR_FRSTRICT)
- continue;
- ATOMIC_INCL(ipfr_stats.ifs_hits);
- return f;
- }
- return NULL;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_nat_knownfrag */
-/* Returns: nat_t* - pointer to 'parent' NAT structure if frag table */
-/* match found, else NULL */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Functional interface for NAT lookups of the NAT fragment cache */
-/* ------------------------------------------------------------------------ */
-nat_t *fr_nat_knownfrag(fin)
-fr_info_t *fin;
-{
- nat_t *nat;
- ipfr_t *ipf;
-
- if ((fin->fin_v != 4) || (fr_frag_lock) || !ipfr_natlist)
- return NULL;
- READ_ENTER(&ipf_natfrag);
- ipf = fr_fraglookup(fin, ipfr_nattab);
- if (ipf != NULL) {
- nat = ipf->ipfr_data;
- /*
- * This is the last fragment for this packet.
- */
- if ((ipf->ipfr_ttl == fr_ticks + 1) && (nat != NULL)) {
- nat->nat_data = NULL;
- ipf->ipfr_data = NULL;
- }
- } else
- nat = NULL;
- RWLOCK_EXIT(&ipf_natfrag);
- return nat;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_ipid_knownfrag */
-/* Returns: u_32_t - IPv4 ID for this packet if match found, else */
-/* return 0xfffffff to indicate no match. */
-/* Parameters: fin(I) - pointer to packet information */
-/* */
-/* Functional interface for IP ID lookups of the IP ID fragment cache */
-/* ------------------------------------------------------------------------ */
-u_32_t fr_ipid_knownfrag(fin)
-fr_info_t *fin;
-{
- ipfr_t *ipf;
- u_32_t id;
-
- if ((fin->fin_v != 4) || (fr_frag_lock) || !ipfr_ipidlist)
- return 0xffffffff;
-
- READ_ENTER(&ipf_ipidfrag);
- ipf = fr_fraglookup(fin, ipfr_ipidtab);
- if (ipf != NULL)
- id = (u_32_t)ipf->ipfr_data;
- else
- id = 0xffffffff;
- RWLOCK_EXIT(&ipf_ipidfrag);
- return id;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_knownfrag */
-/* Returns: frentry_t* - pointer to filter rule if a match is found in */
-/* the frag cache table, else NULL. */
-/* Parameters: fin(I) - pointer to packet information */
-/* passp(O) - pointer to where to store rule flags resturned */
-/* */
-/* Functional interface for normal lookups of the fragment cache. If a */
-/* match is found, return the rule pointer and flags from the rule, except */
-/* that if FR_LOGFIRST is set, reset FR_LOG. */
-/* ------------------------------------------------------------------------ */
-frentry_t *fr_knownfrag(fin, passp)
-fr_info_t *fin;
-u_32_t *passp;
-{
- frentry_t *fr = NULL;
- ipfr_t *fra;
- u_32_t pass;
-
- if ((fin->fin_v != 4) || (fr_frag_lock) || (ipfr_list == NULL))
- return NULL;
-
- READ_ENTER(&ipf_frag);
- fra = fr_fraglookup(fin, ipfr_heads);
- if (fra != NULL) {
- fr = fra->ipfr_rule;
- fin->fin_fr = fr;
- if (fr != NULL) {
- pass = fr->fr_flags;
- if ((pass & FR_LOGFIRST) != 0)
- pass &= ~(FR_LOGFIRST|FR_LOG);
- *passp = pass;
- }
- }
- RWLOCK_EXIT(&ipf_frag);
- return fr;
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_forget */
-/* Returns: Nil */
-/* Parameters: ptr(I) - pointer to data structure */
-/* */
-/* Search through all of the fragment cache entries and wherever a pointer */
-/* is found to match ptr, reset it to NULL. */
-/* ------------------------------------------------------------------------ */
-void fr_forget(ptr)
-void *ptr;
-{
- ipfr_t *fr;
-
- WRITE_ENTER(&ipf_frag);
- for (fr = ipfr_list; fr; fr = fr->ipfr_next)
- if (fr->ipfr_data == ptr)
- fr->ipfr_data = NULL;
- RWLOCK_EXIT(&ipf_frag);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_forgetnat */
-/* Returns: Nil */
-/* Parameters: ptr(I) - pointer to data structure */
-/* */
-/* Search through all of the fragment cache entries for NAT and wherever a */
-/* pointer is found to match ptr, reset it to NULL. */
-/* ------------------------------------------------------------------------ */
-void fr_forgetnat(ptr)
-void *ptr;
-{
- ipfr_t *fr;
-
- WRITE_ENTER(&ipf_natfrag);
- for (fr = ipfr_natlist; fr; fr = fr->ipfr_next)
- if (fr->ipfr_data == ptr)
- fr->ipfr_data = NULL;
- RWLOCK_EXIT(&ipf_natfrag);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fragdelete */
-/* Returns: Nil */
-/* Parameters: fra(I) - pointer to fragment structure to delete */
-/* tail(IO) - pointer to the pointer to the tail of the frag */
-/* list */
-/* */
-/* Remove a fragment cache table entry from the table & list. Also free */
-/* the filter rule it is associated with it if it is no longer used as a */
-/* result of decreasing the reference count. */
-/* ------------------------------------------------------------------------ */
-static void fr_fragdelete(fra, tail)
-ipfr_t *fra, ***tail;
-{
- frentry_t *fr;
-
- fr = fra->ipfr_rule;
- if (fr != NULL)
- (void)fr_derefrule(&fr);
-
- if (fra->ipfr_next)
- fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
- *fra->ipfr_prev = fra->ipfr_next;
- if (*tail == &fra->ipfr_next)
- *tail = fra->ipfr_prev;
-
- if (fra->ipfr_hnext)
- fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
- *fra->ipfr_hprev = fra->ipfr_hnext;
- KFREE(fra);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fragclear */
-/* Returns: Nil */
-/* Parameters: Nil */
-/* */
-/* Free memory in use by fragment state information kept. Do the normal */
-/* fragment state stuff first and then the NAT-fragment table. */
-/* ------------------------------------------------------------------------ */
-void fr_fragclear()
-{
- ipfr_t *fra;
- nat_t *nat;
-
- WRITE_ENTER(&ipf_frag);
- while ((fra = ipfr_list) != NULL)
- fr_fragdelete(fra, &ipfr_tail);
- ipfr_tail = &ipfr_list;
- RWLOCK_EXIT(&ipf_frag);
-
- WRITE_ENTER(&ipf_nat);
- WRITE_ENTER(&ipf_natfrag);
- while ((fra = ipfr_natlist) != NULL) {
- nat = fra->ipfr_data;
- if (nat != NULL) {
- if (nat->nat_data == fra)
- nat->nat_data = NULL;
- }
- fr_fragdelete(fra, &ipfr_nattail);
- }
- ipfr_nattail = &ipfr_natlist;
- RWLOCK_EXIT(&ipf_natfrag);
- RWLOCK_EXIT(&ipf_nat);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_fragexpire */
-/* Returns: Nil */
-/* Parameters: Nil */
-/* */
-/* Expire entries in the fragment cache table that have been there too long */
-/* ------------------------------------------------------------------------ */
-void fr_fragexpire()
-{
- ipfr_t **fp, *fra;
- nat_t *nat;
-#if defined(USE_SPL) && defined(_KERNEL)
- int s;
-#endif
-
- if (fr_frag_lock)
- return;
-
- SPL_NET(s);
- WRITE_ENTER(&ipf_frag);
- /*
- * Go through the entire table, looking for entries to expire,
- * which is indicated by the ttl being less than or equal to fr_ticks.
- */
- for (fp = &ipfr_list; ((fra = *fp) != NULL); ) {
- if (fra->ipfr_ttl > fr_ticks)
- break;
- fr_fragdelete(fra, &ipfr_tail);
- ipfr_stats.ifs_expire++;
- ipfr_inuse--;
- }
- RWLOCK_EXIT(&ipf_frag);
-
- WRITE_ENTER(&ipf_ipidfrag);
- for (fp = &ipfr_ipidlist; ((fra = *fp) != NULL); ) {
- if (fra->ipfr_ttl > fr_ticks)
- break;
- fr_fragdelete(fra, &ipfr_ipidtail);
- ipfr_stats.ifs_expire++;
- ipfr_inuse--;
- }
- RWLOCK_EXIT(&ipf_ipidfrag);
-
- /*
- * Same again for the NAT table, except that if the structure also
- * still points to a NAT structure, and the NAT structure points back
- * at the one to be free'd, NULL the reference from the NAT struct.
- * NOTE: We need to grab both mutex's early, and in this order so as
- * to prevent a deadlock if both try to expire at the same time.
- */
- WRITE_ENTER(&ipf_nat);
- WRITE_ENTER(&ipf_natfrag);
- for (fp = &ipfr_natlist; ((fra = *fp) != NULL); ) {
- if (fra->ipfr_ttl > fr_ticks)
- break;
- nat = fra->ipfr_data;
- if (nat != NULL) {
- if (nat->nat_data == fra)
- nat->nat_data = NULL;
- }
- fr_fragdelete(fra, &ipfr_nattail);
- ipfr_stats.ifs_expire++;
- ipfr_inuse--;
- }
- RWLOCK_EXIT(&ipf_natfrag);
- RWLOCK_EXIT(&ipf_nat);
- SPL_X(s);
-}
-
-
-/* ------------------------------------------------------------------------ */
-/* Function: fr_slowtimer */
-/* Returns: Nil */
-/* Parameters: Nil */
-/* */
-/* Slowly expire held state for fragments. Timeouts are set * in */
-/* expectation of this being called twice per second. */
-/* ------------------------------------------------------------------------ */
-#if !defined(_KERNEL) || (!SOLARIS && !defined(__hpux) && !defined(__sgi) && \
- !defined(__osf__))
-# if defined(_KERNEL) && ((BSD >= 199103) || defined(__sgi))
-void fr_slowtimer __P((void *ptr))
-# else
-int fr_slowtimer()
-# endif
-{
- READ_ENTER(&ipf_global);
-
- fr_fragexpire();
- fr_timeoutstate();
- fr_natexpire();
- fr_authexpire();
- fr_ticks++;
- if (fr_running <= 0)
- goto done;
-# ifdef _KERNEL
-# if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
- callout_reset(&fr_slowtimer_ch, hz / 2, fr_slowtimer, NULL);
-# else
-# if defined(__OpenBSD__)
- timeout_add(&fr_slowtimer_ch, hz/2);
-# else
-# if (__FreeBSD_version >= 300000)
- fr_slowtimer_ch = timeout(fr_slowtimer, NULL, hz/2);
-# else
-# ifdef linux
- ;
-# else
- timeout(fr_slowtimer, NULL, hz/2);
-# endif
-# endif /* FreeBSD */
-# endif /* OpenBSD */
-# endif /* NetBSD */
-# endif
-done:
- RWLOCK_EXIT(&ipf_global);
-# if (BSD < 199103) || !defined(_KERNEL)
- return 0;
-# endif
-}
-#endif /* !SOLARIS && !defined(__hpux) && !defined(__sgi) */
diff --git a/contrib/ipfilter/ip_frag.h b/contrib/ipfilter/ip_frag.h
deleted file mode 100644
index 786a08821086..000000000000
--- a/contrib/ipfilter/ip_frag.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1993-2001 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- *
- * @(#)ip_frag.h 1.5 3/24/96
- * Id: ip_frag.h,v 2.23.2.1 2004/03/29 16:21:56 darrenr Exp
- */
-
-#ifndef __IP_FRAG_H__
-#define __IP_FRAG_H__
-
-#define IPFT_SIZE 257
-
-typedef struct ipfr {
- struct ipfr *ipfr_hnext, **ipfr_hprev;
- struct ipfr *ipfr_next, **ipfr_prev;
- void *ipfr_data;
- void *ipfr_ifp;
- struct in_addr ipfr_src;
- struct in_addr ipfr_dst;
- u_32_t ipfr_optmsk;
- u_short ipfr_secmsk;
- u_short ipfr_auth;
- u_short ipfr_id;
- u_char ipfr_p;
- u_char ipfr_tos;
- u_32_t ipfr_pass;
- u_short ipfr_off;
- u_char ipfr_ttl;
- u_char ipfr_seen0;
- frentry_t *ipfr_rule;
-} ipfr_t;
-
-
-typedef struct ipfrstat {
- u_long ifs_exists; /* add & already exists */
- u_long ifs_nomem;
- u_long ifs_new;
- u_long ifs_hits;
- u_long ifs_expire;
- u_long ifs_inuse;
- u_long ifs_retrans0;
- u_long ifs_short;
- struct ipfr **ifs_table;
- struct ipfr **ifs_nattab;
-} ipfrstat_t;
-
-#define IPFR_CMPSZ (offsetof(ipfr_t, ipfr_pass) - \
- offsetof(ipfr_t, ipfr_ifp))
-
-extern int ipfr_size;
-extern int fr_ipfrttl;
-extern int fr_frag_lock;
-extern int fr_fraginit __P((void));
-extern void fr_fragunload __P((void));
-extern ipfrstat_t *fr_fragstats __P((void));
-
-extern int fr_newfrag __P((fr_info_t *, u_32_t));
-extern frentry_t *fr_knownfrag __P((fr_info_t *, u_32_t *));
-
-extern int fr_nat_newfrag __P((fr_info_t *, u_32_t, struct nat *));
-extern nat_t *fr_nat_knownfrag __P((fr_info_t *));
-
-extern int fr_ipid_newfrag __P((fr_info_t *, u_32_t));
-extern u_32_t fr_ipid_knownfrag __P((fr_info_t *));
-
-extern void fr_forget __P((void *));
-extern void fr_forgetnat __P((void *));
-extern void fr_fragclear __P((void));
-extern void fr_fragexpire __P((void));
-
-#if defined(_KERNEL) && ((BSD >= 199306) || SOLARIS || defined(__sgi) \
- || defined(__osf__) || (defined(__sgi) && (IRIX >= 60500)))
-# if defined(SOLARIS2) && (SOLARIS2 < 7)
-extern void fr_slowtimer __P((void));
-# else
-extern void fr_slowtimer __P((void *));
-# endif
-#else
-extern int fr_slowtimer __P((void));
-#endif
-
-#endif /* __IP_FRAG_H__ */
diff --git a/contrib/ipfilter/ip_ftp_pxy.c b/contrib/ipfilter/ip_ftp_pxy.c
deleted file mode 100644
index 5bdc18a7c1ed..000000000000
--- a/contrib/ipfilter/ip_ftp_pxy.c
+++ /dev/null
@@ -1,1454 +0,0 @@
-/* $NetBSD$ */
-
-/*
- * Copyright (C) 1997-2003 by Darren Reed
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- *
- * Simple FTP transparent proxy for in-kernel use. For use with the NAT
- * code.
- *
- * Id: ip_ftp_pxy.c,v 2.88.2.15 2005/03/19 19:38:10 darrenr Exp
- */
-
-#define IPF_FTP_PROXY
-
-#define IPF_MINPORTLEN 18
-#define IPF_MAXPORTLEN 30
-#define IPF_MIN227LEN 39
-#define IPF_MAX227LEN 51
-#define IPF_MIN229LEN 47
-#define IPF_MAX229LEN 51
-
-#define FTPXY_GO 0
-#define FTPXY_INIT 1
-#define FTPXY_USER_1 2
-#define FTPXY_USOK_1 3
-#define FTPXY_PASS_1 4
-#define FTPXY_PAOK_1 5
-#define FTPXY_AUTH_1 6
-#define FTPXY_AUOK_1 7
-#define FTPXY_ADAT_1 8
-#define FTPXY_ADOK_1 9
-#define FTPXY_ACCT_1 10
-#define FTPXY_ACOK_1 11
-#define FTPXY_USER_2 12
-#define FTPXY_USOK_2 13
-#define FTPXY_PASS_2 14
-#define FTPXY_PAOK_2 15
-
-/*
- * Values for FTP commands. Numerics cover 0-999
- */
-#define FTPXY_C_PASV 1000
-
-int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
-int ippr_ftp_complete __P((char *, size_t));
-int ippr_ftp_in __P((fr_info_t *, ap_session_t *, nat_t *));
-int ippr_ftp_init __P((void));
-void ippr_ftp_fini __P((void));
-int ippr_ftp_new __P((fr_info_t *, ap_session_t *, nat_t *));
-int ippr_ftp_out __P((fr_info_t *, ap_session_t *, nat_t *));
-int ippr_ftp_pasv __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
-int ippr_ftp_epsv __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
-int ippr_ftp_port __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
-int ippr_ftp_process __P((fr_info_t *, nat_t *, ftpinfo_t *, int));
-int ippr_ftp_server __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
-int ippr_ftp_valid __P((ftpinfo_t *, int, char *, size_t));
-int ippr_ftp_server_valid __P((ftpside_t *, char *, size_t));
-int ippr_ftp_client_valid __P((ftpside_t *, char *, size_t));
-u_short ippr_ftp_atoi __P((char **));
-int ippr_ftp_pasvreply __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *,
- u_int, char *, char *, u_int));
-
-
-int ftp_proxy_init = 0;
-int ippr_ftp_pasvonly = 0;
-int ippr_ftp_insecure = 0; /* Do not require logins before transfers */
-int ippr_ftp_pasvrdr = 0;
-int ippr_ftp_forcepasv = 0; /* PASV must be last command prior to 227 */
-#if defined(_KERNEL)
-int ippr_ftp_