Import of ipfilter 3.3.3 in anticipation of its revival.

More to come in the next days.

12 files changed, 481 insertions, 0 deletions

diff --git a/contrib/ipfilter/FreeBSD/conf.c.diffs b/contrib/ipfilter/FreeBSD/conf.c.diffs
new file mode 100644
index 0000000..afd2880
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/conf.c.diffs
@@ -0,0 +1,46 @@
+*** conf.c.orig	Sun Jan 14 15:39:32 1996
+--- conf.c	Sun Jan 14 15:48:21 1996
+***************
+*** 1128,1133 ****
+--- 1128,1149 ----
+  #define	labpcioctl		nxioctl
+  #endif
+  
++ #ifdef	IPFILTER
++ d_open_t	iplopen;
++ d_close_t	iplclose;
++ d_ioctl_t	iplioctl;
++ # ifdef	IPFILTER_LOG
++ d_read_t	iplread;
++ # else
++ #define	iplread	nxread
++ # endif
++ #else
++ #define	iplopen	nxopen
++ #define	iplclose	nxclose
++ #define	iplioctl	nxioctl
++ #define	iplread		nxread
++ #endif
++ 
+  /* open, close, read, write, ioctl, stop, reset, ttys, select, mmap, strat */
+  struct cdevsw	cdevsw[] =
+  {
+***************
+*** 1199,1206 ****
+   * Otherwise, simply use the one reserved for local use.
+   */
+  	/* character device 20 is reserved for local use */
+! 	{ nxopen,	nxclose,	nxread,		nxwrite,	/*20*/
+! 	  nxioctl,	nxstop,		nxreset,	nxdevtotty,/* reserved */
+  	  nxselect,	nxmmap,		NULL },
+  	{ psmopen,	psmclose,	psmread,	nowrite,	/*21*/
+  	  psmioctl,	nostop,		nullreset,	nodevtotty,/* psm mice */
+--- 1215,1222 ----
+   * Otherwise, simply use the one reserved for local use.
+   */
+  	/* character device 20 is reserved for local use */
+! 	{ iplopen,	iplclose,	iplread,	nxwrite,	/*20*/
+! 	  iplioctl,	nxstop,		nxreset,	nxdevtotty,/* reserved */
+  	  nxselect,	nxmmap,		NULL },
+  	{ psmopen,	psmclose,	psmread,	nowrite,	/*21*/
+  	  psmioctl,	nostop,		nullreset,	nodevtotty,/* psm mice */
diff --git a/contrib/ipfilter/FreeBSD/files.diffs b/contrib/ipfilter/FreeBSD/files.diffs
new file mode 100644
index 0000000..84893d4
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/files.diffs
@@ -0,0 +1,19 @@
+*** files.orig	Sat Sep 30 18:01:55 1995
+--- files	Sun Jan 14 14:32:25 1996
+***************
+*** 208,213 ****
+--- 208,221 ----
+  netinet/tcp_timer.c	optional inet
+  netinet/tcp_usrreq.c	optional inet
+  netinet/udp_usrreq.c	optional inet
++ netinet/ip_fil.c	optional ipfilter inet
++ netinet/fil.c		optional ipfilter inet
++ netinet/ip_nat.c	optional ipfilter inet
++ netinet/ip_frag.c	optional ipfilter inet
++ netinet/ip_state.c	optional ipfilter inet
++ netinet/ip_auth.c	optional ipfilter inet
++ netinet/ip_proxy.c	optional ipfilter inet
++ netinet/ip_log.c	optional ipfilter inet
+  netiso/clnp_debug.c	optional iso
+  netiso/clnp_er.c	optional iso
+  netiso/clnp_frag.c	optional iso
diff --git a/contrib/ipfilter/FreeBSD/files.newconf.diffs b/contrib/ipfilter/FreeBSD/files.newconf.diffs
new file mode 100644
index 0000000..cc7cf41
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/files.newconf.diffs
@@ -0,0 +1,19 @@
+*** files.newconf.orig	Sun Jun 25 02:17:29 1995
+--- files.newconf	Sun Jun 25 02:19:10 1995
+***************
+*** 161,166 ****
+--- 161,174 ----
+  file	netinet/ip_input.c	inet
+  file	netinet/ip_mroute.c	inet
+  file	netinet/ip_output.c	inet
++ file	netinet/ip_fil.c	ipfilter
++ file	netinet/fil.c		ipfilter
++ file	netinet/ip_nat.c	ipfilter
++ file	netinet/ip_frag.c	ipfilter
++ file	netinet/ip_state.c	ipfilter
++ file	netinet/ip_proxy.c	ipfilter
++ file	netinet/ip_auth.c	ipfilter
++ file	netinet/ip_log.c	ipfilter
+  file	netinet/raw_ip.c	inet
+  file	netinet/tcp_debug.c	inet
+  file	netinet/tcp_input.c	inet
diff --git a/contrib/ipfilter/FreeBSD/files.oldconf.diffs b/contrib/ipfilter/FreeBSD/files.oldconf.diffs
new file mode 100644
index 0000000..55b526f
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/files.oldconf.diffs
@@ -0,0 +1,19 @@
+*** files.oldconf.orig	Sat Apr 29 19:59:31 1995
+--- files.oldconf	Sun Apr 23 17:54:18 1995
+***************
+*** 180,185 ****
+--- 180,193 ----
+  netinet/tcp_timer.c	optional inet
+  netinet/tcp_usrreq.c	optional inet
+  netinet/udp_usrreq.c	optional inet
++ netinet/ip_fil.c	optional ipfilter requires inet
++ netinet/fil.c		optional ipfilter requires inet
++ netinet/ip_nat.c	optional ipfilter requires inet
++ netinet/ip_frag.c	optional ipfilter requires inet
++ netinet/ip_state.c	optional ipfilter requires inet
++ netinet/ip_proxy.c	optional ipfilter requires inet
++ netinet/ip_auth.c	optional ipfilter requires inet
++ netinet/ip_log.c	optional ipfilter requires inet
+  netiso/clnp_debug.c	optional iso
+  netiso/clnp_er.c	optional iso
+  netiso/clnp_frag.c	optional iso
diff --git a/contrib/ipfilter/FreeBSD/filez.diffs b/contrib/ipfilter/FreeBSD/filez.diffs
new file mode 100644
index 0000000..52492e8
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/filez.diffs
@@ -0,0 +1,19 @@
+*** files.orig	Sat Apr 29 20:00:02 1995
+--- files	Sun Apr 23 17:53:58 1995
+***************
+*** 222,227 ****
+--- 222,235 ----
+  file netinet/tcp_timer.c	inet
+  file netinet/tcp_usrreq.c	inet
+  file netinet/udp_usrreq.c	inet
++ file netinet/ip_fil.c		ipfilter
++ file netinet/fil.c		ipfilter
++ file netinet/ip_nat.c		ipfilter
++ file netinet/ip_frag.c		ipfilter
++ file netinet/ip_state.c		ipfilter
++ file netinet/ip_proxy.c		ipfilter
++ file netinet/ip_auth.c		ipfilter
++ file netinet/ip_log.c		ipfilter
+  file netiso/clnp_debug.c	iso
+  file netiso/clnp_er.c	 	iso
+  file netiso/clnp_frag.c	 	iso
diff --git a/contrib/ipfilter/FreeBSD/in_proto.c.diffs b/contrib/ipfilter/FreeBSD/in_proto.c.diffs
new file mode 100644
index 0000000..052dd51
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/in_proto.c.diffs
@@ -0,0 +1,16 @@
+*** in_proto.c.orig	Wed Sep  6 20:31:34 1995
+--- in_proto.c	Mon Mar 11 22:40:03 1996
+***************
+*** 81,86 ****
+--- 81,91 ----
+  void	eoninput(), eonctlinput(), eonprotoinit();
+  #endif /* EON */
+  
++ #ifdef	IPFILTER
++ void	iplinit();
++ #define	ip_init	iplinit
++ #endif
++ 
+  void rsvp_input(struct mbuf *, int);
+  void ipip_input(struct mbuf *, int);
+  
diff --git a/contrib/ipfilter/FreeBSD/ip_input.c.diffs b/contrib/ipfilter/FreeBSD/ip_input.c.diffs
new file mode 100644
index 0000000..a70be89
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/ip_input.c.diffs
@@ -0,0 +1,88 @@
+*** /sys/netinet/ip_input.c.orig	Thu Oct 24 22:27:27 1996
+--- /sys/netinet/ip_input.c	Tue Feb 18 21:18:19 1997
+***************
+*** 93,98 ****
+--- 93,102 ----
+  int	ipqmaxlen = IFQ_MAXLEN;
+  struct	in_ifaddr *in_ifaddr;			/* first inet address */
+  struct	ifqueue ipintrq;
++ #if defined(IPFILTER_LKM) || defined(IPFILTER)
++ int	fr_check __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
++ int	(*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
++ #endif
+  
+  struct ipstat ipstat;
+  struct ipq ipq;
+***************
+*** 219,226 ****
+  		}
+  		ip = mtod(m, struct ip *);
+  	}
+! 	ip->ip_sum = in_cksum(m, hlen);
+! 	if (ip->ip_sum) {
+  		ipstat.ips_badsum++;
+  		goto bad;
+  	}
+--- 223,229 ----
+  		}
+  		ip = mtod(m, struct ip *);
+  	}
+! 	if (in_cksum(m, hlen)) {
+  		ipstat.ips_badsum++;
+  		goto bad;
+  	}
+***************
+*** 267,272 ****
+--- 270,288 ----
+  	       goto next;
+  	}
+  
++ #if defined(IPFILTER) || defined(IPFILTER_LKM)
++ 	/*
++ 	 * Check if we want to allow this packet to be processed.
++ 	 * Consider it to be bad if not.
++ 	 */
++ 	if (fr_checkp) {
++ 		struct	mbuf	*m1 = m;
++ 
++ 		if ((*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0, &m1) || !m1)
++ 			goto next;
++ 		ip = mtod(m = m1, struct ip *);
++ 	}
++ #endif
+  	/*
+  	 * Process options and, if not destined for us,
+  	 * ship it on.  ip_dooptions returns 1 when an
+***************
+*** 527,532 ****
+--- 533,540 ----
+       * if they are completely covered, dequeue them.
+       */
+      while (q != (struct ipasfrag *)fp && ip->ip_off + ip->ip_len > q->ip_off) {
++             struct mbuf *m0;
++ 
+              i = (ip->ip_off + ip->ip_len) - q->ip_off;
+              if (i < q->ip_len) {
+                      q->ip_len -= i;
+***************
+*** 526,534 ****
+  			m_adj(dtom(q), i);
+  			break;
+  		}
+  		q = q->ipf_next;
+- 		m_freem(dtom(q->ipf_prev));
+  		ip_deq(q->ipf_prev);
+  	}
+  
+  insert:
+--- 542,551 ----
+  			m_adj(dtom(q), i);
+  			break;
+  		}
++ 		m0 = dtom(q);
+  		q = q->ipf_next;
+  		ip_deq(q->ipf_prev);
++ 		m_freem(m0);
+  	}
+  
+  insert:
diff --git a/contrib/ipfilter/FreeBSD/ip_output.c.diffs b/contrib/ipfilter/FreeBSD/ip_output.c.diffs
new file mode 100644
index 0000000..f1fe9ac
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/ip_output.c.diffs
@@ -0,0 +1,36 @@
+*** /sys/netinet/ip_output.c.orig	Thu Oct 24 22:27:28 1996
+--- /sys/netinet/ip_output.c	Tue Feb 18 21:38:23 1997
+***************
+*** 65,70 ****
+--- 65,74 ----
+  static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));
+  static void ip_mloopback
+  	__P((struct ifnet *, struct mbuf *, struct sockaddr_in *));
++ #if defined(IPFILTER_LKM) || defined(IPFILTER)
++ extern int fr_check __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
++ extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
++ #endif
+  
+  /*
+   * IP output.  The packet in mbuf chain m contains a skeletal IP
+***************
+*** 330,335 ****
+--- 334,351 ----
+  		m->m_flags &= ~M_BCAST;
+  
+  sendit:
++ #if defined(IPFILTER) || defined(IPFILTER_LKM)
++ 	/*
++ 	 * looks like most checking has been done now...do a filter check
++ 	 */
++ 	if (fr_checkp) {
++ 		struct	mbuf	*m1 = m;
++ 
++ 		if ((error = (*fr_checkp)(ip, hlen, ifp, 1, &m1)) || !m1)
++ 			goto done;
++ 		ip = mtod(m = m1, struct ip *);
++ 	    }
++ #endif
+  	/*
+  	 * Check with the firewall...
+  	 */
diff --git a/contrib/ipfilter/FreeBSD/kinstall b/contrib/ipfilter/FreeBSD/kinstall
new file mode 100755
index 0000000..42c2f09
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/kinstall
@@ -0,0 +1,61 @@
+#!/bin/csh -f
+#
+set dir=`pwd`
+set karch=`uname -m`
+if ( -d /sys/arch/$karch ) set archdir="/sys/arch/$karch"
+if ( -d /sys/$karch ) set archdir="/sys/$karch"
+set confdir="$archdir/conf"
+
+if ( $dir =~ */FreeBSD ) cd ..
+echo -n "Installing "
+foreach i (ip_fil.[ch] ip_nat.[ch] ip_frag.[ch] ip_state.[ch] fil.c \
+	   ip_proxy.[ch] ip_auth.[ch] ip_{ftp,rcmd}_pxy.c ip_compat.h ip_log.c)
+	echo -n "$i ";
+	cp $i /sys/netinet
+	chmod 644 /sys/netinet/$i
+end
+echo ""
+echo "Patching $archdir/$karch/conf.c"
+cat FreeBSD/conf.c.diffs | (cd $archdir/$karch; patch)
+echo "Patching ip_input.c, ip_output.c and in_proto.c"
+cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs | \
+(cd /sys/netinet; patch)
+
+if ( -f /sys/conf/files.newconf ) then
+	echo "Patching /sys/conf/files.newconf"
+	cat FreeBSD/files.newconf.diffs | (cd /sys/conf; patch)
+	echo "Patching /sys/conf/files"
+	cat FreeBSD/files.diffs | (cd /sys/conf; patch)
+endif
+if ( -f /sys/conf/files.oldconf ) then
+	echo "Patching /sys/conf/files.oldconf"
+	cat FreeBSD/files.oldconf.diffs | (cd /sys/conf; patch)
+	echo "Patching /sys/conf/files"
+	cat FreeBSD/filez.diffs | (cd /sys/conf; patch)
+endif
+
+set config=`(cd $confdir; /bin/ls -1t [0-9A-Z_]*) | head -1`
+echo -n "Kernel configuration to update [$config] "
+set newconfig=$<
+if ( "$newconfig" != "" ) then
+	set config="$confdir/$newconfig"
+else
+	set newconfig=$config
+endif
+echo "Re-config'ing $newconfig..."
+if ( -f $confdir/$newconfig ) then
+	mv $confdir/$newconfig $confdir/$newconfig.bak
+endif
+if ( -d $archdir/../compile/$newconfig ) then
+	set bak=".bak"
+	set dot=0
+	while ( -d $archdir/../compile/${newconfig}.${bak} )
+		set bak=".bak.$dot"
+		set dot=`expr 1 + $dot`
+	end
+	mv $archdir/../compile/$newconfig $archdir/../compile/${newconfig}.${bak}
+endif
+awk '{print $0;if($2=="INET"){print"options IPFILTER"}}' \
+	$confdir/$newconfig.bak > $confdir/$newconfig
+echo 'You will now need to run "config" and build a new kernel.'
+exit 0
diff --git a/contrib/ipfilter/FreeBSD/minstall b/contrib/ipfilter/FreeBSD/minstall
new file mode 100755
index 0000000..0cfe7c3
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/minstall
@@ -0,0 +1,51 @@
+#!/bin/csh -f
+#
+set dir=`pwd`
+set karch=`uname -m`
+if ( -d /sys/arch/$karch ) set archdir="/sys/arch/$karch"
+if ( -d /sys/$karch ) set archdir="/sys/$karch"
+set confdir="$archdir/conf"
+
+if ( $dir =~ */FreeBSD ) cd ..
+echo "Patching ip_input.c, ip_output.c and in_proto.c"
+cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs |  \
+(cd /sys/netinet; patch)
+
+if ( -f /sys/conf/files.newconf ) then
+	echo "Patching /sys/conf/files.newconf"
+	cat FreeBSD/files.newconf.diffs | (cd /sys/conf; patch)
+	echo "Patching /sys/conf/files"
+	cat FreeBSD/files.diffs | (cd /sys/conf; patch)
+endif
+if ( -f /sys/conf/files.oldconf ) then
+	echo "Patching /sys/conf/files.oldconf"
+	cat FreeBSD/files.oldconf.diffs | (cd /sys/conf; patch)
+	echo "Patching /sys/conf/files"
+	cat FreeBSD/filez.diffs | (cd /sys/conf; patch)
+endif
+
+set config=`(cd $confdir; /bin/ls -1t [0-9A-Z_]*) | head -1`
+echo -n "Kernel configuration to update [$config] "
+set newconfig=$<
+if ( "$newconfig" != "" ) then
+	set config="$confdir/$newconfig"
+else
+	set newconfig=$config
+endif
+echo "Re-config'ing $newconfig..."
+if ( -f $confdir/$newconfig ) then
+	mv $confdir/$newconfig $confdir/$newconfig.bak
+endif
+if ( -d $archdir/../compile/$newconfig ) then
+	set bak=".bak"
+	set dot=0
+	while ( -d $archdir/../compile/${newconfig}.${bak} )
+		set bak=".bak.$dot"
+		set dot=`expr 1 + $dot`
+	end
+	mv $archdir/../compile/$newconfig $archdir/../compile/${newconfig}.$bak
+endif
+awk '{print $0;if($2=="INET"){print"options IPFILTER_LKM"}}' \
+	$confdir/$newconfig.bak > $confdir/$newconfig
+echo 'You will now need to run "config" and build a new kernel.'
+exit 0
diff --git a/contrib/ipfilter/FreeBSD/unkinstall b/contrib/ipfilter/FreeBSD/unkinstall
new file mode 100755
index 0000000..8547fcd
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/unkinstall
@@ -0,0 +1,58 @@
+#!/bin/csh -f
+#
+set dir=`pwd`
+set karch=`uname -m`
+if ( -d /sys/arch/$karch ) set archdir="/sys/arch/$karch"
+if ( -d /sys/$karch ) set archdir="/sys/$karch"
+set confdir="$archdir/conf"
+
+if ( $dir =~ */FreeBSD ) cd ..
+echo -n "Uninstalling "
+foreach i (ip_fil.[ch] ip_nat.[ch] ip_frag.[ch] ip_state.[ch] fil.c \
+	   ip_compat.h ip_auth.[ch] ip_proxy.[ch] ip_ftp_pxy.c ip_log.c)
+	echo -n "$i ";
+	/bin/rm -f /sys/netinet/$i
+end
+echo ""
+echo "Unpatching $archdir/$karch/conf.c"
+cat FreeBSD/conf.c.diffs | (cd $archdir/$karch; patch -R)
+echo "Unpatching ip_input.c, ip_output.c and in_proto.c"
+cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs | \
+(cd /sys/netinet; patch -R)
+
+if ( -f /sys/conf/files.newconf ) then
+	echo "Unpatching /sys/conf/files.newconf"
+	cat FreeBSD/files.newconf.diffs | (cd /sys/conf; patch -R)
+	echo "Unpatching /sys/conf/files"
+	cat FreeBSD/files.diffs | (cd /sys/conf; patch -R)
+endif
+if ( -f /sys/conf/files.oldconf ) then
+	echo "Unpatching /sys/conf/files.oldconf"
+	cat FreeBSD/files.oldconf.diffs | (cd /sys/conf; patch -R)
+	echo "Unpatching /sys/conf/files"
+	cat FreeBSD/filez.diffs | (cd /sys/conf; patch -R)
+endif
+
+set config=`(cd $confdir; /bin/ls -1t [0-9A-Z_]*) | head -1`
+echo -n "Kernel configuration to update [$config] "
+set newconfig=$<
+if ( "$newconfig" != "" ) then
+	set config="$confdir/$newconfig"
+else
+	set newconfig=$config
+endif
+if ( -f $confdir/$newconfig ) then
+	mv $confdir/$newconfig $confdir/$newconfig.bak
+endif
+if ( -d $archdir/../compile/$newconfig ) then
+	set bak=".bak"
+	set dot=0
+	while ( -d $archdir/../compile/${newconfig}.${bak} )
+		set bak=".bak.$dot"
+		set dot=`expr 1 + $dot`
+	end
+	mv $archdir/../compile/$newconfig $archdir/../compile/${newconfig}.${bak}
+endif
+egrep -v IPFILTER $confdir/$newconfig.bak > $confdir/$newconfig
+echo 'You will now need to run "config" and build a new kernel.'
+exit 0
diff --git a/contrib/ipfilter/FreeBSD/unminstall b/contrib/ipfilter/FreeBSD/unminstall
new file mode 100755
index 0000000..a25746c
--- /dev/null
+++ b/contrib/ipfilter/FreeBSD/unminstall
@@ -0,0 +1,49 @@
+#!/bin/csh -f
+#
+set dir=`pwd`
+set karch=`uname -m`
+if ( -d /sys/arch/$karch ) set archdir="/sys/arch/$karch"
+if ( -d /sys/$karch ) set archdir="/sys/$karch"
+set confdir="$archdir/conf"
+
+if ( $dir =~ */FreeBSD ) cd ..
+echo "Unpatching ip_input.c, ip_output.c and in_proto.c"
+cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs |  \
+(cd /sys/netinet; patch -R)
+
+if ( -f /sys/conf/files.newconf ) then
+	echo "Unpatching /sys/conf/files.newconf"
+	cat FreeBSD/files.newconf.diffs | (cd /sys/conf; patch -R)
+	echo "Unpatching /sys/conf/files"
+	cat FreeBSD/files.diffs | (cd /sys/conf; patch -R)
+endif
+if ( -f /sys/conf/files.oldconf ) then
+	echo "Unpatching /sys/conf/files.oldconf"
+	cat FreeBSD/files.oldconf.diffs | (cd /sys/conf; patch -R)
+	echo "Unpatching /sys/conf/files"
+	cat FreeBSD/filez.diffs | (cd /sys/conf; patch -R)
+endif
+
+set config=`(cd $confdir; /bin/ls -1t [0-9A-Z_]*) | head -1`
+echo -n "Kernel configuration to update [$config] "
+set newconfig=$<
+if ( "$newconfig" != "" ) then
+	set config="$confdir/$newconfig"
+else
+	set newconfig=$config
+endif
+if ( -f $confdir/$newconfig ) then
+	mv $confdir/$newconfig $confdir/$newconfig.bak
+endif
+if ( -d $archdir/../compile/$newconfig ) then
+	set bak=".bak"
+	set dot=0
+	while ( -d $archdir/../compile/${newconfig}.${bak} )
+		set bak=".bak.$dot"
+		set dot=`expr 1 + $dot`
+	end
+	mv $archdir/../compile/$newconfig $archdir/../compile/${newconfig}.$bak
+endif
+grep -v IPFILTER $confdir/$newconfig.bak > $confdir/$newconfig
+echo 'You will now need to run "config" and build a new kernel.'
+exit 0