Add ipfilter kld and wire it in.

3 files changed, 197 insertions, 2 deletions

diff --git a/sys/modules/Makefile b/sys/modules/Makefile
index e3f97ad..2f14760 100644
--- a/sys/modules/Makefile
+++ b/sys/modules/Makefile
@@ -3,8 +3,8 @@
 # XXX present but broken: atapi ip_mroute_mod joy pcic
 
 SUBDIR=	aha al ax ccd cd9660 coda dm fdesc fxp if_disc if_ppp if_sl if_tun \
-	ipfw kernfs md mfs mii msdos mx netgraph nfs ntfs nullfs pn portal \
-	procfs rl sf sis sk ste ti tl umapfs union vn vr wb xl
+	ipfilter ipfw kernfs md mfs mii msdos mx netgraph nfs ntfs nullfs \
+	pn portal procfs rl sf sis sk ste ti tl umapfs union vn vr wb xl
 
 SUBDIR+=usb ugen uhid ukbd ulpt ums umodem umass
 
diff --git a/sys/modules/ipfilter/Makefile b/sys/modules/ipfilter/Makefile
new file mode 100644
index 0000000..694b2cc
--- /dev/null
+++ b/sys/modules/ipfilter/Makefile
@@ -0,0 +1,13 @@
+# $FreeBSD$ 
+
+.PATH:	${.CURDIR}/../../netinet
+KMOD=	ipl
+SRCS=	mlfk_ipl.c ip_nat.c ip_frag.c ip_state.c ip_proxy.c ip_auth.c \
+	ip_log.c
+NOMAN=
+CFLAGS+= -DIPFILTER_LKM -DIPFILTER_LOG
+#
+# If you don't want long functionality remove -DIPFILTER_LOG
+#
+
+.include <bsd.kmod.mk>
diff --git a/sys/modules/ipfilter/mlfk_ipl.c b/sys/modules/ipfilter/mlfk_ipl.c
new file mode 100644
index 0000000..8ae811d
--- /dev/null
+++ b/sys/modules/ipfilter/mlfk_ipl.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright 1999 Guido van Rooij.  All rights reserved.
+ * 
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *  1. Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *  2. Redistributions in binary form must reproduce the above copyright notice,
+ *     this list of conditions and the following disclaimer in the documentation
+ *     and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER ``AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef KLD_MODULE
+#define KLD_MODULE
+#endif
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/module.h>
+#include <sys/conf.h>
+#include <sys/socket.h>
+#include <sys/sysctl.h>
+#include <net/if.h>
+#include <netinet/in_systm.h>
+#include <netinet/in.h>
+
+
+#include <netinet/ipl.h>
+#include <netinet/ip_compat.h>
+#include <netinet/ip_fil.h>
+#include <netinet/ip_state.h>
+#include <netinet/ip_nat.h>
+#include <netinet/ip_auth.h>
+#include <netinet/ip_frag.h>
+
+static dev_t ipf_devs[IPL_LOGMAX + 1];
+
+SYSCTL_DECL(_net_inet);
+SYSCTL_NODE(_net_inet, OID_AUTO, ipf, CTLFLAG_RW, 0, "IPF");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_flags, CTLFLAG_RW, &fr_flags, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_pass, CTLFLAG_RW, &fr_pass, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_active, CTLFLAG_RD, &fr_active, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_tcpidletimeout, CTLFLAG_RW,
+	   &fr_tcpidletimeout, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_tcpclosewait, CTLFLAG_RW,
+	   &fr_tcpclosewait, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_tcplastack, CTLFLAG_RW,
+	   &fr_tcplastack, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_tcptimeout, CTLFLAG_RW,
+	   &fr_tcptimeout, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_tcpclosed, CTLFLAG_RW,
+	   &fr_tcpclosed, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_udptimeout, CTLFLAG_RW,
+	   &fr_udptimeout, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_icmptimeout, CTLFLAG_RW,
+	   &fr_icmptimeout, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_defnatage, CTLFLAG_RW,
+	   &fr_defnatage, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_ipfrttl, CTLFLAG_RW,
+	   &fr_ipfrttl, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, ipl_unreach, CTLFLAG_RW,
+	   &ipl_unreach, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, ipl_inited, CTLFLAG_RD,
+	   &ipl_inited, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_authsize, CTLFLAG_RD,
+	   &fr_authsize, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_authused, CTLFLAG_RD,
+	   &fr_authused, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_defaultauthage, CTLFLAG_RW,
+	   &fr_defaultauthage, 0, "");
+
+#define CDEV_MAJOR 79
+static struct cdevsw ipl_cdevsw = {
+	/* open */	iplopen,
+	/* close */	iplclose,
+	/* read */	iplread,
+	/* write */	nowrite,
+	/* ioctl */	iplioctl,
+	/* poll */	nopoll,
+	/* mmap */	nommap,
+	/* strategy */	nostrategy,
+	/* name */	"ipl",
+	/* maj */	CDEV_MAJOR,
+	/* dump */	nodump,
+	/* psize */	nopsize,
+	/* flags */	0,
+	/* bmaj */	-1
+};
+
+static int
+ipfilter_modevent(module_t mod, int type, void *unused)
+{
+	char	*c;
+	int	i, error = 0;
+
+	switch (type) {
+	case MOD_LOAD :
+		error = iplattach();
+
+		c = NULL;
+		for(i=strlen(IPL_NAME); i>0; i--)
+			if (IPL_NAME[i] == '/') {
+				c = &IPL_NAME[i+1];
+				break;
+			}
+		if (!c)
+			c = IPL_NAME;
+		ipf_devs[IPL_LOGIPF] =
+		    make_dev(&ipl_cdevsw, IPL_LOGIPF, 0, 0, 0600, c);
+
+		c = NULL;
+		for(i=strlen(IPL_NAT); i>0; i--)
+			if (IPL_NAT[i] == '/') {
+				c = &IPL_NAT[i+1];
+				break;
+			}
+		if (!c)
+			c = IPL_NAT;
+		ipf_devs[IPL_LOGNAT] =
+		    make_dev(&ipl_cdevsw, IPL_LOGNAT, 0, 0, 0600, c);
+
+		c = NULL;
+		for(i=strlen(IPL_STATE); i>0; i--)
+			if (IPL_STATE[i] == '/') {
+				c = &IPL_STATE[i+1];
+				break;
+			}
+		if (!c)
+			c = IPL_STATE;
+		ipf_devs[IPL_LOGSTATE] =
+		    make_dev(&ipl_cdevsw, IPL_LOGSTATE, 0, 0, 0600, c);
+
+		c = NULL;
+		for(i=strlen(IPL_AUTH); i>0; i--)
+			if (IPL_AUTH[i] == '/') {
+				c = &IPL_AUTH[i+1];
+				break;
+			}
+		if (!c)
+			c = IPL_AUTH;
+		ipf_devs[IPL_LOGAUTH] =
+		    make_dev(&ipl_cdevsw, IPL_LOGAUTH, 0, 0, 0600, c);
+
+		break;
+	case MOD_UNLOAD :
+		destroy_dev(ipf_devs[IPL_LOGIPF]);
+		destroy_dev(ipf_devs[IPL_LOGNAT]);
+		destroy_dev(ipf_devs[IPL_LOGSTATE]);
+		destroy_dev(ipf_devs[IPL_LOGAUTH]);
+		cdevsw_remove(&ipl_cdevsw);
+		error = ipldetach();
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+	return error;
+}
+
+static moduledata_t ipfiltermod = {
+	IPL_VERSION,
+	ipfilter_modevent,
+        0
+};
+DECLARE_MODULE(ipfilter, ipfiltermod, SI_SUB_PSEUDO, SI_ORDER_ANY);