diff options
author | darrenr <darrenr@FreeBSD.org> | 1997-04-03 10:39:35 +0000 |
---|---|---|
committer | darrenr <darrenr@FreeBSD.org> | 1997-04-03 10:39:35 +0000 |
commit | 021f0bfee77ac6748b1987a770ae05b6c9ecae46 (patch) | |
tree | b63cd59d2ca166e7ead4b4e100442731b6a5855e /sys/contrib | |
parent | 4c6cc159636ece3e0117ca32504b86bb22092b96 (diff) | |
download | FreeBSD-src-021f0bfee77ac6748b1987a770ae05b6c9ecae46.zip FreeBSD-src-021f0bfee77ac6748b1987a770ae05b6c9ecae46.tar.gz |
Really import sys/netinet changes for IP Filter 3.2alpha4 this time.
Diffstat (limited to 'sys/contrib')
-rw-r--r-- | sys/contrib/ipfilter/netinet/fil.c | 137 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_compat.h | 93 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_fil.c | 444 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_fil.h | 135 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_frag.c | 29 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_frag.h | 16 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_nat.c | 171 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_nat.h | 43 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_state.c | 108 | ||||
-rw-r--r-- | sys/contrib/ipfilter/netinet/ip_state.h | 48 |
10 files changed, 905 insertions, 319 deletions
diff --git a/sys/contrib/ipfilter/netinet/fil.c b/sys/contrib/ipfilter/netinet/fil.c index 9f95361..118edf2 100644 --- a/sys/contrib/ipfilter/netinet/fil.c +++ b/sys/contrib/ipfilter/netinet/fil.c @@ -7,12 +7,13 @@ */ #if !defined(lint) && defined(LIBC_SCCS) static char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed"; -static char rcsid[] = "$Id: fil.c,v 2.0.1.7 1997/02/18 10:53:47 darrenr Exp $"; +static char rcsid[] = "$Id: fil.c,v 1.1.1.3 1997/04/03 10:10:10 darrenr Exp $"; #endif #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> +#include <sys/time.h> #include <sys/file.h> #include <sys/ioctl.h> #if defined(_KERNEL) || defined(KERNEL) @@ -44,8 +45,8 @@ static char rcsid[] = "$Id: fil.c,v 2.0.1.7 1997/02/18 10:53:47 darrenr Exp $"; #include <netinet/udp.h> #include <netinet/tcpip.h> #include <netinet/ip_icmp.h> -#include "ip_fil.h" #include "ip_compat.h" +#include "ip_fil.h" #include "ip_nat.h" #include "ip_frag.h" #include "ip_state.h" @@ -54,46 +55,48 @@ static char rcsid[] = "$Id: fil.c,v 2.0.1.7 1997/02/18 10:53:47 darrenr Exp $"; #endif #ifndef _KERNEL -#include "ipf.h" +# include "ipf.h" +# include "ipt.h" extern int opts; -extern void debug(), verbose(); -#define FR_IFVERBOSE(ex,second,verb_pr) if (ex) { verbose verb_pr; second; } -#define FR_IFDEBUG(ex,second,verb_pr) if (ex) { debug verb_pr; second; } -#define FR_VERBOSE(verb_pr) verbose verb_pr -#define FR_DEBUG(verb_pr) debug verb_pr -#define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi) +# define FR_IFVERBOSE(ex,second,verb_pr) if (ex) { verbose verb_pr; \ + second; } +# define FR_IFDEBUG(ex,second,verb_pr) if (ex) { debug verb_pr; \ + second; } +# define FR_VERBOSE(verb_pr) verbose verb_pr +# define FR_DEBUG(verb_pr) debug verb_pr +# define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m) +# define SEND_RESET(ip, qif, q, if) send_reset(ip, if) +# define IPLLOG(a, c, d, e) ipllog() # if SOLARIS +# define ICMP_ERROR(b, ip, t, c, if, src) icmp_error(ip) # define bcmp memcmp -# endif -#else -#define FR_IFVERBOSE(ex,second,verb_pr) ; -#define FR_IFDEBUG(ex,second,verb_pr) ; -#define FR_VERBOSE(verb_pr) -#define FR_DEBUG(verb_pr) -#define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m) -extern int send_reset(); -# if SOLARIS -extern int icmp_error(), ipfr_fastroute(); -extern kmutex_t ipf_mutex, ipl_mutex; # else -extern void ipfr_fastroute(); +# define ICMP_ERROR(b, ip, t, c, if, src) icmp_error(b, ip, if) # endif -extern int ipl_unreach, ipllog(); -#endif -#if SOLARIS -# define SEND_RESET(ip, if, q) send_reset(ip, qif, q) -# define ICMP_ERROR(b, ip, t, c, if, src) \ - icmp_error(b, ip, t, c, if, src) -#else -# define SEND_RESET(ip, if, q) send_reset(ip) -# if BSD < 199103 +#else /* #ifndef _KERNEL */ +# define FR_IFVERBOSE(ex,second,verb_pr) ; +# define FR_IFDEBUG(ex,second,verb_pr) ; +# define FR_VERBOSE(verb_pr) +# define FR_DEBUG(verb_pr) +# define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m) +# define IPLLOG(a, c, d, e) ipllog(a, IPL_LOGIPF, c, d, e) +# if SOLARIS +extern kmutex_t ipf_mutex; +# define SEND_RESET(ip, qif, q, if) send_reset(ip, qif, q) # define ICMP_ERROR(b, ip, t, c, if, src) \ - icmp_error(mtod(b, ip_t *), t, c, if, src) + icmp_error(b, ip, t, c, if, src) # else -# define ICMP_ERROR(b, ip, t, c, if, src) \ +# define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m) +# define SEND_RESET(ip, qif, q, if) send_reset((struct tcpiphdr *)ip) +# if BSD < 199103 +# define ICMP_ERROR(b, ip, t, c, if, src) \ + icmp_error(mtod(b, ip_t *), t, c, if, src) +# else +# define ICMP_ERROR(b, ip, t, c, if, src) \ icmp_error(b, t, c, (src).s_addr, if) +# endif # endif #endif @@ -103,7 +106,7 @@ extern int ipl_unreach, ipllog(); #ifdef IPF_DEFAULT_PASS #define IPF_NOMATCH (IPF_DEFAULT_PASS|FR_NOMATCH) #else -#define IPF_NOMATCH (FR_NOMATCH) +#define IPF_NOMATCH (FR_PASS|FR_NOMATCH) #endif struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}}; @@ -113,6 +116,10 @@ int fr_flags = IPF_LOGGING, fr_active = 0; fr_info_t frcache[2]; +static void fr_makefrip __P((int, ip_t *, fr_info_t *)); +static int fr_tcpudpchk __P((frentry_t *, fr_info_t *)); +static int fr_scanlist __P((int, ip_t *, fr_info_t *, void *)); + /* * bit values for identifying presence of individual IP options @@ -159,7 +166,7 @@ struct optlist secopt[8] = { * compact the IP header into a structure which contains just the info. * which is useful for comparing IP headers with. */ -void fr_makefrip(hlen, ip, fin) +static void fr_makefrip(hlen, ip, fin) int hlen; ip_t *ip; fr_info_t *fin; @@ -278,7 +285,7 @@ getports: /* * check an IP packet for TCP/UDP characteristics such as ports and flags. */ -int fr_tcpudpchk(fr, fin) +static int fr_tcpudpchk(fr, fin) frentry_t *fr; fr_info_t *fin; { @@ -371,7 +378,7 @@ fr_info_t *fin; * Could be per interface, but this gets real nasty when you don't have * kernel sauce. */ -int fr_scanlist(pass, ip, fin, m) +static int fr_scanlist(pass, ip, fin, m) int pass; ip_t *ip; register fr_info_t *fin; @@ -404,8 +411,7 @@ void *m; if (opts & (OPT_VERBOSE|OPT_DEBUG)) printf("\n"); FR_VERBOSE(("%c", (pass & FR_PASS) ? 'p' : 'b')); - if (fin->fin_ifp && *fr->fr_ifname && - strcasecmp((char *)fin->fin_ifp, fr->fr_ifname)) + if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) continue; FR_VERBOSE((":i")); #endif @@ -467,7 +473,7 @@ void *m; pass = (*fr->fr_func)(pass, ip, fin); #ifdef IPFILTER_LOG if ((pass & FR_LOGMASK) == FR_LOG) { - if (!ipllog(fr->fr_flags, ip, fin, m)) + if (!IPLLOG(fr->fr_flags, ip, fin, m)) frstats[fin->fin_out].fr_skip++; frstats[fin->fin_out].fr_pkl++; } @@ -475,7 +481,7 @@ void *m; FR_DEBUG(("pass %#x\n", pass)); fr->fr_hits++; if (pass & FR_ACCOUNT) - fr->fr_bytes += ip->ip_len; + fr->fr_bytes += (U_QUAD_T)ip->ip_len; else fin->fin_icode = fr->fr_icode; fin->fin_rule = rulen; @@ -504,7 +510,8 @@ mblk_t **mp; struct mbuf **mp; # endif #else -) +, mp) +char *mp; #endif ip_t *ip; int hlen; @@ -518,8 +525,12 @@ int out; register fr_info_t *fin = &frinfo; frentry_t *fr = NULL; int pass, changed; +#ifndef _KERNEL + char *mc = mp, *m = mp; +#endif -#if !defined(__SVR4) && !defined(__svr4__) && defined(_KERNEL) +#ifdef _KERNEL +# if !defined(__SVR4) && !defined(__svr4__) register struct mbuf *m = *mp; struct mbuf *mc = NULL; @@ -538,9 +549,10 @@ int out; } } } -#endif -#if SOLARIS && defined(_KERNEL) +# endif +# if SOLARIS mblk_t *mc = NULL, *m = qif->qf_m; +# endif #endif fr_makefrip(hlen, ip, fin); fin->fin_ifp = ifp; @@ -608,7 +620,7 @@ int out; } } - if (fr && fr->fr_func) + if (fr && fr->fr_func && !(pass & FR_CALLNOW)) pass = (*fr->fr_func)(pass, ip, fin); if (out) { @@ -639,7 +651,7 @@ int out; pass |= FF_LOGBLOCK; frstats[out].fr_bpkl++; logit: - if (!ipllog(pass, ip, fin, m)) { + if (!IPLLOG(pass, ip, fin, m)) { frstats[out].fr_skip++; if ((pass & (FR_PASS|FR_LOGORBLOCK)) == (FR_PASS|FR_LOGORBLOCK)) @@ -676,7 +688,7 @@ logit: frstats[0].fr_ret++; } else if ((pass & FR_RETRST) && !(fin->fin_fi.fi_fl & FI_SHORT)) { - if (SEND_RESET(ip, qif, q) == 0) + if (SEND_RESET(ip, qif, q, ifp) == 0) frstats[1].fr_ret++; } #else @@ -736,37 +748,32 @@ logit: #ifdef IPFILTER_LOG -# if !(defined(_KERNEL)) -static void ipllog() -{ - verbose("l"); -} -# endif - - -int fr_copytolog(buf, len) +int fr_copytolog(dev, buf, len) +int dev; char *buf; int len; { - int clen, tail; + register char *bufp = iplbuf[dev], *tp = iplt[dev], *hp = iplh[dev]; + register int clen, tail; - tail = (iplh >= iplt) ? (iplbuf + IPLLOGSIZE - iplh) : (iplt - iplh); + tail = (hp >= tp) ? (bufp + IPLLOGSIZE - hp) : (tp - hp); clen = MIN(tail, len); - bcopy(buf, iplh, clen); + bcopy(buf, hp, clen); len -= clen; tail -= clen; - iplh += clen; + hp += clen; buf += clen; - if (iplh == iplbuf + IPLLOGSIZE) { - iplh = iplbuf; - tail = iplt - iplh; + if (hp == bufp + IPLLOGSIZE) { + hp = bufp; + tail = tp - hp; } if (len && tail) { clen = MIN(tail, len); - bcopy(buf, iplh, clen); + bcopy(buf, hp, clen); len -= clen; - iplh += clen; + hp += clen; } + iplh[dev] = hp; return len; } #endif diff --git a/sys/contrib/ipfilter/netinet/ip_compat.h b/sys/contrib/ipfilter/netinet/ip_compat.h index 5a36cc3..615e4d0 100644 --- a/sys/contrib/ipfilter/netinet/ip_compat.h +++ b/sys/contrib/ipfilter/netinet/ip_compat.h @@ -6,17 +6,48 @@ * to the original author and the contributors. * * @(#)ip_compat.h 1.8 1/14/96 - * $Id: ip_compat.h,v 2.0.1.4 1997/02/04 14:24:25 darrenr Exp $ + * $Id: ip_compat.h,v 1.1.1.2 1997/04/03 10:10:48 darrenr Exp $ */ #ifndef __IP_COMPAT_H_ #define __IP_COMPAT_H__ +#ifndef __P +# ifdef __STDC__ +# define __P(x) x +# else +# define __P(x) () +# endif +#endif + #ifndef SOLARIS #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) #endif + #if SOLARIS -#define MTYPE(m) ((m)->b_datap->db_type) +# define MTYPE(m) ((m)->b_datap->db_type) +# include <sys/ioccom.h> +# include <sys/sysmacros.h> +/* + * because Solaris 2 defines these in two places :-/ + */ +# undef IPOPT_EOL +# undef IPOPT_NOP +# undef IPOPT_LSRR +# undef IPOPT_RR +# undef IPOPT_SSRR +# ifndef _KERNEL +# define _KERNEL +# undef RES_INIT +# include <inet/common.h> +# include <inet/ip.h> +# include <inet/ip_ire.h> +# undef _KERNEL +# else +# include <inet/common.h> +# include <inet/ip.h> +# include <inet/ip_ire.h> +# endif #endif #define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h))) @@ -24,6 +55,13 @@ #define IP_OFFMASK 0x1fff #endif +#if BSD > 199306 +# define USE_QUAD_T +# define U_QUAD_T u_quad_t +#else +# define U_QUAD_T u_long +#endif + #ifndef MAX #define MAX(a,b) (((a) > (b)) ? (a) : (b)) #endif @@ -85,11 +123,18 @@ #define IPOPT_FINN 205 /* FINN */ +#ifdef __FreeBSD__ +# include <machine/spl.h> +# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL) +# define ACTUALLY_LKM_NOT_KERNEL +# endif +#endif + /* * Build some macros and #defines to enable the same code to compile anywhere * Well, that's the idea, anyway :-) */ -#ifdef _KERNEL +#if defined(_KERNEL) || defined(KERNEL) # if SOLARIS # define MUTEX_ENTER(x) mutex_enter(x) # define MUTEX_EXIT(x) mutex_exit(x) @@ -108,6 +153,7 @@ # ifdef sun # if defined(__svr4__) || defined(__SVR4) +extern ill_t *get_unit __P((char *)); # define GETUNIT(n) get_unit((n)) # else # include <sys/kmem_alloc.h> @@ -132,8 +178,8 @@ typedef struct qif { queue_t *qf_out; void *qf_wqinfo; void *qf_rqinfo; - int (*qf_inp)(); - int (*qf_outp)(); + int (*qf_inp) __P((queue_t *, mblk_t *)); + int (*qf_outp) __P((queue_t *, mblk_t *)); mblk_t *qf_m; int qf_len; char qf_name[8]; @@ -151,10 +197,10 @@ typedef struct qif { # define htons(x) (x) # define htonl(x) (x) # endif -# define KMALLOC(x) kmem_alloc((x), KM_NOSLEEP) +# define KMALLOC(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP) # define GET_MINOR(x) getminor(x) # else -# define KMALLOC(x) new_kmem_alloc((x), KMEM_NOSLEEP) +# define KMALLOC(a,b,c) (a) = (b)new_kmem_alloc((c), KMEM_NOSLEEP) # endif /* __svr4__ */ # endif /* sun && !linux */ # ifndef GET_MINOR @@ -162,7 +208,7 @@ typedef struct qif { # endif # if BSD >= 199306 || defined(__FreeBSD__) # include <vm/vm.h> -# if !defined(__FreeBSD__) +# if !defined(__FreeBSD__) || (defined (__FreeBSD__) && __FreeBSD__>=3) # include <vm/vm_extern.h> # include <sys/proc.h> extern vm_map_t kmem_map; @@ -170,15 +216,15 @@ extern vm_map_t kmem_map; # include <vm/vm_kern.h> # endif /* __FreeBSD__ */ /* -** # define KMALLOC(x) kmem_alloc(kmem_map, (x)) -** # define KFREE(x) kmem_free(kmem_map, (vm_offset_t)(x), \ +# define KMALLOC(a,b,c) (a) = (b)kmem_alloc(kmem_map, (c)) +# define KFREE(x) kmem_free(kmem_map, (vm_offset_t)(x), \ sizeof(*(x))) */ # ifdef M_PFIL -# define KMALLOC(x) malloc((x), M_PFIL, M_NOWAIT) +# define KMALLOC(a, b, c) MALLOC((a), b, (c), M_PFIL, M_NOWAIT) # define KFREE(x) FREE((x), M_PFIL) # else -# define KMALLOC(x) malloc((x), M_TEMP, M_NOWAIT) +# define KMALLOC(a, b, c) MALLOC((a), b, (c), M_TEMP, M_NOWAIT) # define KFREE(x) FREE((x), M_TEMP) # endif # define UIOMOVE(a,b,c,d) uiomove(a,b,d) @@ -193,17 +239,16 @@ extern vm_map_t kmem_map; # endif # endif #else -# ifndef linux -# define MUTEX_ENTER(x) ; -# define MUTEX_EXIT(x) ; -# define SPLNET(x) ; -# define SPLX(x) ; -# define KMALLOC(x) malloc(x) -# define KFREE(x) free(x) -# define GETUNIT(x) (x) -# define IRCOPY(a,b,c) bcopy((a), (b), (c)) -# define IWCOPY(a,b,c) bcopy((a), (b), (c)) -# endif +# define MUTEX_ENTER(x) ; +# define MUTEX_EXIT(x) ; +# define SPLNET(x) ; +# undef SPLX +# define SPLX(x) ; +# define KMALLOC(a,b,c) (a) = (b)malloc(c) +# define KFREE(x) free(x) +# define GETUNIT(x) get_unit(x) +# define IRCOPY(a,b,c) bcopy((a), (b), (c)) +# define IWCOPY(a,b,c) bcopy((a), (b), (c)) #endif /* KERNEL */ #ifdef linux @@ -318,7 +363,7 @@ struct ipovly { # define UNITNAME(n) dev_get((n)) # define ifnet device -# define KMALLOC(x) kmalloc((x), GFP_ATOMIC) +# define KMALLOC(a,b,c) (a) = (b)kmalloc((c), GFP_ATOMIC) # define KFREE(x) kfree_s((x), sizeof(*(x))) # define IRCOPY(a,b,c) { \ error = verify_area(VERIFY_READ, \ diff --git a/sys/contrib/ipfilter/netinet/ip_fil.c b/sys/contrib/ipfilter/netinet/ip_fil.c index fec4846..a9c298a 100644 --- a/sys/contrib/ipfilter/netinet/ip_fil.c +++ b/sys/contrib/ipfilter/netinet/ip_fil.c @@ -7,17 +7,39 @@ */ #if !defined(lint) && defined(LIBC_SCCS) static char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed"; -static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.7 1997/02/19 12:45:02 darrenr Exp $"; +static char rcsid[] = "$Id: ip_fil.c,v 1.1.1.3 1997/04/03 10:10:52 darrenr Exp $"; #endif +#ifndef SOLARIS +#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) +#endif + +#ifdef __FreeBSD__ +#include <osreldate.h> +#endif +#ifndef _KERNEL +#include <stdio.h> +#include <string.h> +#endif #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> #include <sys/file.h> #include <sys/ioctl.h> +#include <sys/time.h> +#ifdef _KERNEL #include <sys/systm.h> +#endif #include <sys/uio.h> +#if !SOLARIS +#include <sys/dir.h> #include <sys/mbuf.h> +#else +#define bcmp memcmp +#define bzero(a,b) memset(a,0,b) +#define bcopy(a,b,c) memcpy(b,a,c) +#include <sys/filio.h> +#endif #include <sys/protosw.h> #include <sys/socket.h> @@ -36,8 +58,8 @@ static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.7 1997/02/19 12:45:02 darrenr Exp $ #include <netinet/tcpip.h> #include <netinet/ip_icmp.h> #include <syslog.h> -#include "ip_fil.h" #include "ip_compat.h" +#include "ip_fil.h" #include "ip_frag.h" #include "ip_nat.h" #include "ip_state.h" @@ -47,45 +69,49 @@ static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.7 1997/02/19 12:45:02 darrenr Exp $ extern fr_flags, fr_active; extern struct protosw inetsw[]; -extern int (*fr_checkp)(); #if BSD < 199306 -extern int ipfr_slowtimer(); -static int (*fr_saveslowtimo)(); +static int (*fr_saveslowtimo) __P((void)); extern int tcp_ttl; #else -extern void ipfr_slowtimer(); -static void (*fr_saveslowtimo)(); +static void (*fr_saveslowtimo) __P((void)); #endif int ipl_inited = 0; int ipl_unreach = ICMP_UNREACH_FILTER; -int send_reset(); + +#ifndef _KERNEL +#include "ipt.h" +static struct ifnet **ifneta = NULL; +static int nifs = 0; +struct ifnet *get_unit __P((char *)); +#endif #ifdef IPFILTER_LOG -# define LOGSIZE 8192 -int ipllog(); -char iplbuf[LOGSIZE]; -caddr_t iplh = iplbuf, iplt = iplbuf; -static int iplused = 0; +char iplbuf[3][IPLLOGSIZE]; +caddr_t iplh[3], iplt[3]; +int iplused[3] = {0,0,0}; #endif /* IPFILTER_LOG */ -static void frflush(); -static int frrequest(); -static int (*fr_savep)() = NULL; +static void frflush __P((caddr_t)); +static int frrequest __P((int, caddr_t, int)); +static void frzerostats __P((caddr_t)); +#ifdef _KERNEL +static int (*fr_savep) __P((struct ip *, int, struct ifnet *, + int, struct mbuf **)); +#else +void init_ifp __P((void)); +static int (*fr_savep) __P((struct ip *, int, struct ifnet *, + int, char *)); +static int no_output __P((struct ifnet *, struct mbuf *, + struct sockaddr *, struct rtentry *)); +static int write_output __P((struct ifnet *, struct mbuf *, + struct sockaddr *, struct rtentry *)); +#endif + -#if _BSDI_VERSION >= 199501 +#if (_BSDI_VERSION >= 199510) && defined(_KERNEL) # include <sys/device.h> # include <sys/conf.h> -int iplioctl __P((dev_t, int, caddr_t, int, struct proc *)); -int iplopen __P((dev_t, int, int, struct proc *)); -int iplclose __P((dev_t, int, int, struct proc *)); -# ifdef IPFILTER_LOG -int iplread __P((dev_t, struct uio *, int)); -# else -# define iplread noread -# endif -int iplioctl __P((dev_t, int, caddr_t, int, struct proc *)); - struct cfdriver iplcd = { NULL, "ipl", NULL, NULL, DV_DULL, 0 }; @@ -96,9 +122,11 @@ struct devsw iplsw = { nostrat, nodump, nopsize, 0, nostop }; -#endif /* _BSDI_VERSION >= 199501 */ +#endif /* _BSDI_VERSION >= 199510 && _KERNEL */ + -#ifdef IPFILTER_LKM +#ifdef _KERNEL +# ifdef IPFILTER_LKM int iplidentify(s) char *s; { @@ -106,12 +134,12 @@ char *s; return 1; return 0; } -#endif /* IPFILTER_LKM */ +# endif /* IPFILTER_LKM */ int iplattach() { - int s; + int s, i; SPLNET(s); if (ipl_inited || (fr_checkp == fr_check)) { @@ -125,6 +153,14 @@ int iplattach() fr_checkp = fr_check; fr_saveslowtimo = inetsw[0].pr_slowtimo; inetsw[0].pr_slowtimo = ipfr_slowtimer; + + /* + * Set log buffer pointers for each of the log buffers + */ + for (i = 0; i <= 2; i++) { + iplh[i] = iplbuf[i]; + iplt[i] = iplbuf[i]; + } SPLX(s); return 0; } @@ -142,7 +178,9 @@ int ipldetach() return EBUSY; } +#if defined(IPFILTER_LKM) || defined(IPFILTER) fr_checkp = fr_savep; +#endif inetsw[0].pr_slowtimo = fr_saveslowtimo; frflush((caddr_t)&i); ipl_inited = 0; @@ -154,6 +192,7 @@ int ipldetach() SPLX(s); return 0; } +#endif /* _KERNEL */ static void frzerostats(data) @@ -219,7 +258,7 @@ caddr_t data; * Filter ioctl interface. */ int iplioctl(dev, cmd, data, mode -#if _BSDI_VERSION >= 199501 +#if ((_BSDI_VERSION >= 199510) || (BSD >= 199506)) && defined(_KERNEL) , p) struct proc *p; #else @@ -232,18 +271,20 @@ int mode; { int error = 0, s, unit; +#ifdef _KERNEL unit = minor(dev); - if (unit != 0) + if ((2 < unit) || (unit < 0)) return ENXIO; +#endif SPLNET(s); switch (cmd) { case FIONREAD : #ifdef IPFILTER_LOG - *(int *)data = iplused; + *(int *)data = iplused[unit]; #endif break; -#ifndef IPFILTER_LKM +#if !defined(IPFILTER_LKM) && defined(_KERNEL) case SIOCFRENB : { u_int enable; @@ -330,9 +371,9 @@ int mode; if (!(mode & FWRITE)) error = EPERM; else { - *(int *)data = iplused; - iplh = iplt = iplbuf; - iplused = 0; + *(int *)data = iplused[unit]; + iplh[unit] = iplt[unit] = iplbuf[unit]; + iplused[unit] = 0; } break; #endif /* IPFILTER_LOG */ @@ -365,16 +406,13 @@ caddr_t data; { register frentry_t *fp, *f, **fprev; register frentry_t **ftail; - frentry_t fr; + frentry_t frd; frdest_t *fdp; - struct frentry frd; int error = 0, in; - fp = &fr; + fp = &frd; IRCOPY(data, (caddr_t)fp, sizeof(*fp)); - bzero((char *)frcache, sizeof(frcache[0]) * 2); - in = (fp->fr_flags & FR_INQUE) ? 0 : 1; if (fp->fr_flags & FR_ACCOUNT) { ftail = fprev = &ipacct[in][set]; @@ -383,8 +421,8 @@ caddr_t data; else return ESRCH; - IRCOPY((char *)fp, (char *)&frd, sizeof(frd)); - fp = &frd; + bzero((char *)frcache, sizeof(frcache[0]) * 2); + if (*fp->fr_ifname) { fp->fr_ifa = GETUNIT(fp->fr_ifname); if (!fp->fr_ifa) @@ -451,7 +489,8 @@ caddr_t data; if (f) error = EEXIST; else { - if ((f = (struct frentry *)KMALLOC(sizeof(*f)))) { + KMALLOC(f, frentry_t *, sizeof(*f)); + if (f != NULL) { bcopy((char *)fp, (char *)f, sizeof(*f)); f->fr_hits = 0; f->fr_next = *ftail; @@ -464,44 +503,48 @@ caddr_t data; } -#if !defined(linux) +#ifdef _KERNEL /* * routines below for saving IP headers to buffer */ int iplopen(dev, flags -#if _BSDI_VERSION >= 199501 +#if ((_BSDI_VERSION >= 199510) || (BSD >= 199506)) && defined(_KERNEL) , devtype, p) int devtype; struct proc *p; -#else +# else ) -#endif +# endif dev_t dev; int flags; { u_int min = minor(dev); - if (min) + if (2 < min) min = ENXIO; + else + min = 0; return min; } int iplclose(dev, flags -#if _BSDI_VERSION >= 199501 +#if ((_BSDI_VERSION >= 199510) || (BSD >= 199506)) && defined(_KERNEL) , devtype, p) int devtype; struct proc *p; -#else +# else ) -#endif +# endif dev_t dev; int flags; { u_int min = minor(dev); - if (min) + if (2 < min) min = ENXIO; + else + min = 0; return min; } @@ -521,52 +564,57 @@ int iplread(dev, uio) dev_t dev; register struct uio *uio; { - register int ret, s; + register int ret, s, unit; register size_t sz, sx; int error; + unit = minor(dev); + if ((2 < unit) || (unit < 0)) + return ENXIO; + if (!uio->uio_resid) return 0; - while (!iplused) { - error = SLEEP(iplbuf, "ipl sleep"); + + while (!iplused[unit]) { + error = SLEEP(iplbuf[unit], "ipl sleep"); if (error) return error; } SPLNET(s); - sx = sz = MIN(uio->uio_resid, iplused); - if (iplh < iplt) - sz = MIN(sz, LOGSIZE - (iplt - iplbuf)); + sx = sz = MIN(uio->uio_resid, iplused[unit]); + if (iplh[unit] < iplt[unit]) + sz = MIN(sz, IPLLOGSIZE - (iplt[unit] - iplbuf[unit])); sx -= sz; # if BSD >= 199306 || defined(__FreeBSD__) uio->uio_rw = UIO_READ; # endif - if (!(ret = UIOMOVE(iplt, sz, UIO_READ, uio))) { - iplt += sz; - iplused -= sz; - if ((iplh < iplt) && (iplt == iplbuf + LOGSIZE)) - iplt = iplbuf; - - if (sx && !(ret = UIOMOVE(iplt, sx, UIO_READ, uio))) { - iplt += sx; - iplused -= sx; - if ((iplh < iplt) && (iplt == iplbuf + LOGSIZE)) - iplt = iplbuf; + if (!(ret = UIOMOVE(iplt[unit], sz, UIO_READ, uio))) { + iplt[unit] += sz; + iplused[unit] -= sz; + if ((iplh[unit] < iplt[unit]) && (iplt[unit] == iplbuf[unit] + IPLLOGSIZE)) + iplt[unit] = iplbuf[unit]; + + if (sx && !(ret = UIOMOVE(iplt[unit], sx, UIO_READ, uio))) { + iplt[unit] += sx; + iplused[unit] -= sx; + if ((iplh[unit] < iplt[unit]) && (iplt[unit] == iplbuf[unit] + IPLLOGSIZE)) + iplt[unit] = iplbuf[unit]; } - if (!iplused) /* minimise wrapping around the end */ - iplh = iplt = iplbuf; + if (!iplused[unit]) /* minimise wrapping around the end */ + iplh[unit] = iplt[unit] = iplbuf[unit]; } SPLX(s); return ret; } # endif /* IPFILTER_LOG */ -#endif /* linux */ -#ifdef IPFILTER_LOG -int ipllog(flags, ip, fin, m) +# ifdef IPFILTER_LOG +int ipllog(flags, dev, ip, fin, m) u_int flags; +int dev; ip_t *ip; register fr_info_t *fin; struct mbuf *m; @@ -597,16 +645,16 @@ struct mbuf *m; mlen = (flags & FR_LOGBODY) ? MIN(ip->ip_len - hlen, 128) : 0; len = hlen + sizeof(iplci) + mlen; - if (iplused + len > LOGSIZE) + if (iplused[dev] + len > IPLLOGSIZE) return 0; - iplused += len; + iplused[dev] += len; -# ifdef sun +# ifdef sun uniqtime(&iplci); -# endif -# if BSD >= 199306 || defined(__FreeBSD__) +# endif +# if BSD >= 199306 || defined(__FreeBSD__) microtime((struct timeval *)&iplci); -# endif +# endif iplci.flags = flags; iplci.hlen = (u_char)hlen; iplci.plen = (u_char)mlen; @@ -619,22 +667,25 @@ struct mbuf *m; if ((iplci.ifname[1] = ifp->if_name[1])) if ((iplci.ifname[2] = ifp->if_name[2])) iplci.ifname[3] = ifp->if_name[3]; -# endif +# endif + if (iplh[dev] == iplbuf[dev] + IPLLOGSIZE) + iplh[dev] = iplbuf[dev]; + /* * Gauranteed to succeed from above */ - (void) fr_copytolog(&iplci, sizeof(iplci)); + (void) fr_copytolog(dev, (char *)&iplci, sizeof(iplci)); for (len -= sizeof(iplci); m && len > 0; m = m->m_next, len -= hlen) { hlen = MIN(len, m->m_len); - if (fr_copytolog(mtod(m, char *), hlen)) + if (fr_copytolog(dev, mtod(m, char *), hlen)) break; } - wakeup(iplbuf); + wakeup(iplbuf[dev]); return 1; } -#endif /* IPFILTER_LOG */ +# endif /* IPFILTER_LOG */ /* * send_reset - this could conceivably be a call to tcp_respond(), but that @@ -651,22 +702,22 @@ struct tcpiphdr *ti; if (ti->ti_flags & TH_RST) return -1; /* feedback loop */ -#if BSD < 199306 +# if BSD < 199306 m = m_get(M_DONTWAIT, MT_HEADER); -#else +# else m = m_gethdr(M_DONTWAIT, MT_HEADER); m->m_data += max_linkhdr; -#endif +# endif if (m == NULL) return -1; if (ti->ti_flags & TH_SYN) tlen = 1; m->m_len = sizeof (struct tcpiphdr); -#if BSD >= 199306 +# if BSD >= 199306 m->m_pkthdr.len = sizeof (struct tcpiphdr); m->m_pkthdr.rcvif = (struct ifnet *)0; -#endif +# endif bzero(mtod(m, char *), sizeof(struct tcpiphdr)); ip = mtod(m, struct ip *); tp = mtod(m, struct tcpiphdr *); @@ -686,11 +737,11 @@ struct tcpiphdr *ti; ip->ip_tos = ((struct ip *)ti)->ip_tos; ip->ip_p = ((struct ip *)ti)->ip_p; ip->ip_len = sizeof (struct tcpiphdr); -#if BSD < 199306 +# if BSD < 199306 ip->ip_ttl = tcp_ttl; -#else +# else ip->ip_ttl = ip_defttl; -#endif +# endif /* * extra 0 in case of multicast @@ -700,13 +751,18 @@ struct tcpiphdr *ti; } -#ifndef IPFILTER_LKM -void iplinit() +# ifndef IPFILTER_LKM +# if BSD < 199306 +int +# else +void +# endif +iplinit() { (void) iplattach(); ip_init(); } -#endif +# endif void ipfr_fastroute(m0, fin, fdp) @@ -738,12 +794,12 @@ frdest_t *fdp; #if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) # ifdef RTF_CLONING rtalloc_ign(ro, RTF_CLONING); -# else +# else rtalloc_ign(ro, RTF_PRCLONING); -# endif -#else +# endif +# else rtalloc(ro); -#endif +# endif if (!ifp) { if (!(fin->fin_fr->fr_flags & FR_FASTROUTE)) { error = -2; @@ -773,19 +829,19 @@ frdest_t *fdp; * If small enough for interface, can just send directly. */ if (ip->ip_len <= ifp->if_mtu) { -#ifndef sparc +# ifndef sparc ip->ip_id = htons(ip->ip_id); ip->ip_len = htons(ip->ip_len); ip->ip_off = htons(ip->ip_off); -#endif +# endif if (!ip->ip_sum) ip->ip_sum = in_cksum(m, hlen); -#if BSD >= 199306 +# if BSD >= 199306 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro->ro_rt); -#else +# else error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst); -#endif +# endif goto done; } /* @@ -818,11 +874,11 @@ frdest_t *fdp; error = ENOBUFS; goto bad; } -#if BSD >= 199306 +# if BSD >= 199306 m->m_data += max_linkhdr; -#else +# else m->m_off = MMAXOFF - hlen; -#endif +# endif mhip = mtod(m, struct ip *); bcopy((char *)ip, (char *)mhip, sizeof(*ip)); if (hlen > sizeof (struct ip)) { @@ -843,9 +899,9 @@ frdest_t *fdp; error = ENOBUFS; /* ??? */ goto sendorfree; } -#ifndef sparc +# ifndef sparc mhip->ip_off = htons((u_short)mhip->ip_off); -#endif +# endif mhip->ip_sum = 0; mhip->ip_sum = in_cksum(m, mhlen); *mnext = m; @@ -865,13 +921,13 @@ sendorfree: m0 = m->m_act; m->m_act = 0; if (error == 0) -#if BSD >= 199306 +# if BSD >= 199306 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro->ro_rt); -#else +# else error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst); -#endif +# endif else m_freem(m); } @@ -885,3 +941,159 @@ bad: m_freem(m); goto done; } +#else /* #ifdef _KERNEL */ + + +static int no_output __P((struct ifnet *ifp, struct mbuf *m, + struct sockaddr *s, struct rtentry *rt)) +{ + return 0; +} + + +# ifdef __STDC__ +static int write_output __P((struct ifnet *ifp, struct mbuf *m, + struct sockaddr *s, struct rtentry *rt)) +{ + ip_t *ip = (ip_t *)m; +# else +static int write_output(ifp, ip) +struct ifnet *ifp; +ip_t *ip; +{ +# endif + FILE *fp; + char fname[32]; + +#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) + sprintf(fname, "/tmp/%s", ifp->if_xname); + if ((fp = fopen(fname, "a"))) { + fclose(fp); + } +#else + sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit); + if ((fp = fopen(fname, "a"))) { + fwrite((char *)ip, ntohs(ip->ip_len), 1, fp); + fclose(fp); + } +#endif +} + + +struct ifnet *get_unit(name) +char *name; +{ + struct ifnet *ifp, **ifa; +#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) + for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) { + if (!strcmp(name, ifp->if_xname)) + return ifp; + } +#else + char ifname[32], *s; + + for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) { + (void) sprintf(ifname, "%s%d", ifp->if_name, ifp->if_unit); + if (!strcmp(name, ifname)) + return ifp; + } +#endif + + if (!ifneta) { + ifneta = (struct ifnet **)malloc(sizeof(ifp) * 2); + ifneta[1] = NULL; + ifneta[0] = (struct ifnet *)calloc(1, sizeof(*ifp)); + nifs = 1; + } else { + nifs++; + ifneta = (struct ifnet **)realloc(ifneta, + (nifs + 1) * sizeof(*ifa)); + ifneta[nifs] = NULL; + ifneta[nifs - 1] = (struct ifnet *)malloc(sizeof(*ifp)); + } + ifp = ifneta[nifs - 1]; + +#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) + strncpy(ifp->if_xname, name, sizeof(ifp->if_xname)); +#else + for (s = name; *s && !isdigit(*s); s++) + ; + if (*s && isdigit(*s)) { + ifp->if_unit = atoi(s); + ifp->if_name = (char *)malloc(s - name + 1); + strncpy(ifp->if_name, name, s - name); + ifp->if_name[s - name] = '\0'; + } else { + ifp->if_name = strdup(name); + ifp->if_unit = -1; + } +#endif + ifp->if_output = no_output; + return ifp; +} + + +void init_ifp() +{ + FILE *fp; + struct ifnet *ifp, **ifa; + char fname[32]; +#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) + for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) { + ifp->if_output = write_output; + sprintf(fname, "/tmp/%s", ifp->if_xname); + if ((fp = fopen(fname, "w"))) + fclose(fp); + } +#else + + for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) { + ifp->if_output = write_output; + sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit); + if ((fp = fopen(fname, "w"))) + fclose(fp); + } +#endif +} + + +void ipfr_fastroute(ip, fin, fdp) +ip_t *ip; +fr_info_t *fin; +frdest_t *fdp; +{ + struct ifnet *ifp = fdp->fd_ifp; + + if (!ifp) + return; /* no routing table out here */ + + ip->ip_len = htons((u_short)ip->ip_len); + ip->ip_off = htons((u_short)(ip->ip_off | IP_MF)); + ip->ip_sum = 0; + (*ifp->if_output)(ifp, (void *)ip, NULL, 0); +} + + +void ipllog() +{ + verbose("l"); +} + + +int send_reset(ip, ifp) +ip_t *ip; +struct ifnet *ifp; +{ + verbose("- TCP RST sent\n"); + return 0; +} + + +int icmp_error(ip, ifp) +ip_t *ip; +struct ifnet *ifp; +{ + verbose("- TCP RST sent\n"); + return 0; +} +#endif /* _KERNEL */ diff --git a/sys/contrib/ipfilter/netinet/ip_fil.h b/sys/contrib/ipfilter/netinet/ip_fil.h index 389a161..4f0bfa9 100644 --- a/sys/contrib/ipfilter/netinet/ip_fil.h +++ b/sys/contrib/ipfilter/netinet/ip_fil.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_fil.h 1.35 6/5/96 - * $Id: ip_fil.h,v 2.0.1.2 1997/01/10 00:28:15 darrenr Exp $ + * $Id: ip_fil.h,v 1.1.1.2 1997/04/03 10:10:58 darrenr Exp $ */ #ifndef __IP_FIL_H__ @@ -19,20 +19,12 @@ #if defined(KERNEL) && !defined(_KERNEL) #define _KERNEL #endif -#if SOLARIS -# include <sys/ioccom.h> -# include <sys/sysmacros.h> -# ifdef _KERNEL -# include <inet/common.h> -/* - * because Solaris 2 defines these in two places :-/ - */ -#undef IPOPT_EOL -#undef IPOPT_NOP -#undef IPOPT_LSRR -#undef IPOPT_RR -#undef IPOPT_SSRR -# include <inet/ip.h> + +#ifndef __P +# ifdef __STDC__ +# define __P(x) x +# else +# define __P(x) () # endif #endif @@ -118,9 +110,12 @@ typedef struct frdest { typedef struct frentry { struct frentry *fr_next; struct ifnet *fr_ifa; - u_long fr_hits; - u_long fr_bytes; /* this is only incremented when a packet */ - /* matches this rule and it is the last match*/ + /* + * There are only incremented when a packet matches this rule and + * it is the last match + */ + U_QUAD_T fr_hits; + U_QUAD_T fr_bytes; /* * Fields after this may not change whilst in the kernel. */ @@ -140,7 +135,7 @@ typedef struct frentry { u_short fr_stop; /* top port for <> and >< */ u_short fr_dtop; /* top port for <> and >< */ u_long fr_flags; /* per-rule flags && options (see below) */ - int (*fr_func)(); /* call this function */ + int (*fr_func) __P((int, struct ip *, fr_info_t *)); /* call this function */ char fr_icode; /* return ICMP code */ char fr_ifname[IFNAMSIZ]; struct frdest fr_tif; /* "to" interface */ @@ -162,7 +157,7 @@ typedef struct frentry { /* * fr_flags -*/ + */ #define FR_BLOCK 0x00001 #define FR_PASS 0x00002 #define FR_OUTQUE 0x00004 @@ -276,18 +271,100 @@ typedef struct ipl_ci { #define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h))) #define IPLLOGSIZE 8192 -extern int fr_check(); -extern int fr_copytolog(); -extern fr_info_t frcache[]; -extern char *iplh, *iplt; -extern char iplbuf[IPLLOGSIZE]; +/* + * Device filenames. Use ipf on Solaris2 because ipl is already a name used + * by something else. + */ +#ifndef IPL_NAME +# if SOLARIS +# define IPL_NAME "/dev/ipf" +# else +# define IPL_NAME "/dev/ipl" +# endif +#endif +#define IPL_NAT "/dev/ipnat" +#define IPL_STATE "/dev/ipstate" +#define IPL_LOGIPF 0 /* Minor device #'s for accessing logs */ +#define IPL_LOGNAT 1 +#define IPL_LOGSTATE 2 -#ifdef _KERNEL +#if !defined(CDEV_MAJOR) && defined (__FreeBSD_version) && \ + (__FreeBSD_version >= 220000) +# define CDEV_MAJOR 79 +#endif -extern struct frentry *ipfilter[2][2], *ipacct[2][2]; -extern struct filterstats frstats[]; +#ifndef _KERNEL +extern int fr_check __P((struct ip *, int, struct ifnet *, int, char *)); +extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, + int, char *)); +extern int send_reset __P((struct ip *, struct ifnet *)); +extern int icmp_error __P((struct ip *, struct ifnet *)); +extern void ipllog __P((void)); +extern void ipfr_fastroute __P((struct ip *, fr_info_t *, frdest_t *)); +#else # if SOLARIS -extern int ipfsync(); +extern int fr_check __P((struct ip *, int, struct ifnet *, int, qif_t *, + queue_t *, mblk_t **)); +extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, + int, qif_t *, queue_t *, mblk_t *)); +extern int icmp_error __P((queue_t *, ip_t *, int, int, qif_t *, + struct in_addr)); +# else +extern int fr_check __P((struct ip *, int, struct ifnet *, int, + struct mbuf **)); +extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, + struct mbuf **)); +extern int send_reset __P((struct tcpiphdr *)); +extern int ipllog __P((u_int, int, struct ip *, fr_info_t *, struct mbuf *)); +extern void ipfr_fastroute __P((struct mbuf *, fr_info_t *, frdest_t *)); # endif +#endif +extern int fr_copytolog __P((int, char *, int)); +extern int ipl_unreach; +extern fr_info_t frcache[]; +extern char *iplh[3], *iplt[3]; +extern char iplbuf[3][IPLLOGSIZE]; +extern int iplused[3]; +extern struct frentry *ipfilter[2][2], *ipacct[2][2]; +extern struct filterstats frstats[]; + +#ifndef _KERNEL +extern int iplioctl __P((dev_t, int, caddr_t, int)); +extern int iplopen __P((dev_t, int)); +extern int iplclose __P((dev_t, int)); +#else +extern int iplattach __P((void)); +extern int ipldetach __P((void)); +# if SOLARIS +extern int iplioctl __P((dev_t, int, int, int, cred_t *, int *)); +extern int iplopen __P((dev_t *, int, int, cred_t *)); +extern int iplclose __P((dev_t, int, int, cred_t *)); +extern int ipfsync __P((void)); +# ifdef IPFILTER_LOG +extern int iplread __P((dev_t, struct uio *, cred_t *)); +# endif +# else +# ifdef IPFILTER_LKM +extern int iplidentify __P((char *)); +# endif +# if (_BSDI_VERSION >= 199510) || (__FreeBSD_version >= 199612) +extern int iplioctl __P((dev_t, int, caddr_t, int, struct proc *)); +extern int iplopen __P((dev_t, int, int, struct proc *)); +extern int iplclose __P((dev_t, int, int, struct proc *)); +# else +extern int iplioctl __P((dev_t, int, caddr_t, int)); +extern int iplopen __P((dev_t, int)); +extern int iplclose __P((dev_t, int)); +# endif /* (_BSDI_VERSION >= 199510) */ +# ifdef IPFILTER_LOG +# if BSD >= 199306 +extern int iplread __P((dev_t, struct uio *, int)); +# else +extern int iplread __P((dev_t, struct uio *)); +# endif /* BSD >= 199306 */ +# else +# define iplread noread +# endif /* IPFILTER_LOG */ +# endif /* SOLARIS */ #endif /* _KERNEL */ #endif /* __IP_FIL_H__ */ diff --git a/sys/contrib/ipfilter/netinet/ip_frag.c b/sys/contrib/ipfilter/netinet/ip_frag.c index 7ed97ce..dbe852e 100644 --- a/sys/contrib/ipfilter/netinet/ip_frag.c +++ b/sys/contrib/ipfilter/netinet/ip_frag.c @@ -7,7 +7,7 @@ */ #if !defined(lint) && defined(LIBC_SCCS) static char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-1995 Darren Reed"; -static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.2 1997/02/16 06:17:35 darrenr Exp $"; +static char rcsid[] = "$Id: ip_frag.c,v 1.1.1.3 1997/04/03 10:11:03 darrenr Exp $"; #endif #if !defined(_KERNEL) && !defined(KERNEL) @@ -17,12 +17,19 @@ static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.2 1997/02/16 06:17:35 darrenr Exp #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> +#include <sys/time.h> #include <sys/file.h> +#if defined(__FreeBSD__) && (__FreeBSD__ >= 3) +#include <sys/ioccom.h> +#include <sys/filio.h> +#include <sys/fcntl.h> +#else #include <sys/ioctl.h> +#endif #include <sys/uio.h> #include <sys/protosw.h> #include <sys/socket.h> -#ifdef _KERNEL +#ifdef _KERNEL # include <sys/systm.h> #endif #if !defined(__SVR4) && !defined(__svr4__) @@ -47,8 +54,8 @@ static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.2 1997/02/16 06:17:35 darrenr Exp #include <netinet/udp.h> #include <netinet/tcpip.h> #include <netinet/ip_icmp.h> -#include "ip_fil.h" #include "ip_compat.h" +#include "ip_fil.h" #include "ip_frag.h" #include "ip_nat.h" #include "ip_state.h" @@ -69,6 +76,13 @@ extern kmutex_t ipf_frag; # endif #endif +#ifdef __FreeBSD__ +# if BSD < 199306 +int ipfr_slowtimer __P((void)); +# else +void ipfr_slowtimer __P((void)); +# endif +#endif /* __FreeBSD__ */ ipfrstat_t *ipfr_fragstats() { @@ -114,7 +128,8 @@ int pass; return -1; } - if (!(fr = (ipfr_t *)KMALLOC(sizeof(*fr)))) { + KMALLOC(fr, ipfr_t *, sizeof(*fr)); + if (fr == NULL) { ipfr_stats.ifs_nomem++; MUTEX_EXIT(&ipf_frag); return -1; @@ -230,10 +245,10 @@ void ipfr_unload() * Slowly expire held state for fragments. Timeouts are set * in expectation * of this being called twice per second. */ -# if BSD < 199306 -int ipfr_slowtimer() -# else +# if (BSD >= 199306) || SOLARIS void ipfr_slowtimer() +# else +int ipfr_slowtimer() # endif { ipfr_t **fp, *fr; diff --git a/sys/contrib/ipfilter/netinet/ip_frag.h b/sys/contrib/ipfilter/netinet/ip_frag.h index a356785..0e8fe90 100644 --- a/sys/contrib/ipfilter/netinet/ip_frag.h +++ b/sys/contrib/ipfilter/netinet/ip_frag.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_frag.h 1.5 3/24/96 - * $Id: ip_frag.h,v 2.0.1.1 1997/01/09 15:14:43 darrenr Exp $ + * $Id: ip_frag.h,v 1.1.1.2 1997/04/03 10:11:06 darrenr Exp $ */ #ifndef __IP_FRAG_H_ @@ -39,9 +39,13 @@ typedef struct ipfrstat { #define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1) -extern ipfrstat_t *ipfr_fragstats(); -extern int ipfr_newfrag(), ipfr_knownfrag(); -# ifdef _KERNEL -extern void ipfr_unload(); -# endif +extern ipfrstat_t *ipfr_fragstats __P((void)); +extern int ipfr_newfrag __P((ip_t *, fr_info_t *, int)); +extern int ipfr_knownfrag __P((ip_t *, fr_info_t *)); +extern void ipfr_unload __P((void)); +#if (BSD >= 199306) || SOLARIS +extern void ipfr_slowtimer __P((void)); +#else +extern int ipfr_slowtimer __P((void)); +#endif #endif /* __IP_FIL_H__ */ diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c index ee59a6c..146b490 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.c +++ b/sys/contrib/ipfilter/netinet/ip_nat.c @@ -9,7 +9,11 @@ */ #if !defined(lint) && defined(LIBC_SCCS) static char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; -static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.11 1997/02/16 06:26:47 darrenr Exp $"; +static char rcsid[] = "$Id: ip_nat.c,v 1.1.1.3 1997/04/03 10:11:11 darrenr Exp $"; +#endif + +#if defined(__FreeBSD__) && defined(KERNEL) +#define _KERNEL #endif #if !defined(_KERNEL) && !defined(KERNEL) @@ -20,12 +24,13 @@ static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.11 1997/02/16 06:26:47 darrenr Exp #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> +#include <sys/time.h> #include <sys/file.h> #include <sys/ioctl.h> #include <sys/uio.h> #include <sys/protosw.h> #include <sys/socket.h> -#ifdef _KERNEL +#ifdef _KERNEL # include <sys/systm.h> #endif #if !defined(__SVR4) && !defined(__svr4__) @@ -57,8 +62,8 @@ extern struct ifnet vpnif; #include <netinet/udp.h> #include <netinet/tcpip.h> #include <netinet/ip_icmp.h> -#include "ip_fil.h" #include "ip_compat.h" +#include "ip_fil.h" #include "ip_nat.h" #include "ip_state.h" #ifndef MIN @@ -80,10 +85,13 @@ extern kmutex_t ipf_nat; # endif #endif -static int flush_nattable(), clear_natlist(); -static void nattable_sync(); +static int flush_nattable __P((void)), clear_natlist __P((void)); +static void nattable_sync __P((void)), nat_delete __P((struct nat *)); +static nat_t *nat_new __P((ipnat_t *, ip_t *, fr_info_t *, u_short, int)); +static void fix_outcksum __P((u_short *, u_long)); +static void fix_incksum __P((u_short *, u_long)); -void fix_outcksum(sp, n) +static void fix_outcksum(sp, n) u_short *sp; u_long n; { @@ -104,7 +112,7 @@ u_long n; } -void fix_incksum(sp, n) +static void fix_incksum(sp, n) u_short *sp; u_long n; { @@ -182,7 +190,8 @@ int cmd, mode; error = EEXIST; break; } - if (!(n = (ipnat_t *)KMALLOC(sizeof(*n)))) { + KMALLOC(n, ipnat_t *, sizeof(*n)); + if (n == NULL) { error = ENOMEM; break; } @@ -365,7 +374,7 @@ static int clear_natlist() /* * Create a new NAT table entry. */ -nat_t *nat_new(np, ip, fin, flags, direction) +static nat_t *nat_new(np, ip, fin, flags, direction) ipnat_t *np; ip_t *ip; fr_info_t *fin; @@ -387,15 +396,22 @@ int direction; } /* Give me a new nat */ - if (!(nat = (nat_t *)KMALLOC(sizeof(*nat)))) + KMALLOC(nat, nat_t *, sizeof(*nat)); + if (nat == NULL) return NULL; bzero((char *)nat, sizeof(*nat)); + nat->nat_flags = flags; /* * Search the current table for a match. */ if (direction == NAT_OUTBOUND) { +#if SOLARIS + ill_t *ill = fin->fin_ifp; +#else + struct ifnet *ifp = fin->fin_ifp; +#endif /* * If it's an outbound packet which doesn't match any existing * record, then create a new port @@ -403,6 +419,34 @@ int direction; do { port = 0; in.s_addr = np->in_nip; + if (!in.s_addr && (np->in_outmsk == 0xffffffff)) { +#if SOLARIS + in.s_addr = ill->ill_ipif->ipif_local_addr; +#else + struct ifaddr *ifa; + struct sockaddr_in *sin; + + ifa = ifp->if_addrlist; +# if BSD < 199306 + sin = (struct sockaddr_in *)&ifa->ifa_addr; +# else + sin = (struct sockaddr_in *)ifa->ifa_addr; + while (sin && ifa && + sin->sin_family != AF_INET) { + ifa = ifa->ifa_next; + sin = (struct sockaddr_in *)ifa->ifa_addr; + } + if (!ifa) + sin = NULL; + if (!sin) { + KFREE(nat); + return NULL; + } +# endif + in = sin->sin_addr; + in.s_addr = ntohl(in.s_addr); +#endif + } if (nflags & IPN_TCPUDP) { port = htons(np->in_pnext++); if (np->in_pnext >= ntohs(np->in_pmax)) { @@ -555,8 +599,9 @@ u_short sport, mapdport; for (; nat; nat = nat->nat_hnext[1]) if (nat->nat_oip.s_addr == src.s_addr && nat->nat_outip.s_addr == mapdst.s_addr && - (!flags || (nat->nat_oport == sport && - nat->nat_outport == mapdport))) + flags == nat->nat_flags && (!flags || + (nat->nat_oport == sport && + nat->nat_outport == mapdport))) return nat; return NULL; } @@ -581,8 +626,8 @@ u_short sport, dport; for (; nat; nat = nat->nat_hnext[0]) if (nat->nat_inip.s_addr == src.s_addr && nat->nat_oip.s_addr == dst.s_addr && - (!flags || (nat->nat_inport == sport && - nat->nat_oport == dport))) + flags == nat->nat_flags && (!flags || + (nat->nat_inport == sport && nat->nat_oport == dport))) return nat; return NULL; } @@ -606,8 +651,9 @@ u_short mapsport, dport; for (; nat; nat = nat->nat_hnext[0]) if (nat->nat_outip.s_addr == mapsrc.s_addr && nat->nat_oip.s_addr == dst.s_addr && - (!flags || (nat->nat_outport == mapsport && - nat->nat_oport == dport))) + flags == nat->nat_flags && (!flags || + (nat->nat_outport == mapsport && + nat->nat_oport == dport))) return nat; return NULL; } @@ -684,17 +730,20 @@ fr_info_t *fin; */ if (!(nat = nat_outlookup(nflags, ip->ip_src, sport, ip->ip_dst, dport))) { - if (np->in_redir == NAT_REDIRECT) - continue; /* - * if it's a redirection, then we don't want + * If it's a redirection, then we don't want * to create new outgoing port stuff. * Redirections are only for incoming * connections. */ + if (np->in_redir == NAT_REDIRECT) + continue; if (!(nat = nat_new(np, ip, fin, nflags, NAT_OUTBOUND))) break; +#ifdef IPFILTER_LOG + nat_log(nat, (u_short)np->in_redir); +#endif } ip->ip_src = nat->nat_outip; @@ -719,8 +768,8 @@ fr_info_t *fin; if (ip->ip_p == IPPROTO_TCP) { csump = &tcp->th_sum; - set_tcp_age(&nat->nat_age, - nat->nat_state, ip, fin,1); + fr_tcp_age(&nat->nat_age, + nat->nat_state, ip, fin,1); } else if (ip->ip_p == IPPROTO_UDP) { udphdr_t *udp = (udphdr_t *)tcp; @@ -787,20 +836,20 @@ fr_info_t *fin; (np->in_redir == NAT_MAP || np->in_pmin == dport)) { if (!(nat = nat_inlookup(nflags, ip->ip_src, sport, ip->ip_dst, dport))) { + /* + * If this rule (np) is a redirection, rather + * than a mapping, then do a nat_new. + * Otherwise, if it's just a mapping, do a + * continue; + */ if (np->in_redir == NAT_MAP) continue; - else { - /* - * If this rule (np) is a redirection, - * rather than a mapping, then do a - * nat_new. Otherwise, if it's just a - * mapping, do a continue; - */ - if (!(nat = nat_new(np, ip, fin, - nflags, - NAT_INBOUND))) - break; - } + if (!(nat = nat_new(np, ip, fin, nflags, + NAT_INBOUND))) + break; +#ifdef IPFILTER_LOG + nat_log(nat, (u_short)np->in_redir); +#endif } ip->ip_dst = nat->nat_inip; @@ -824,8 +873,8 @@ fr_info_t *fin; if (ip->ip_p == IPPROTO_TCP) { csump = &tcp->th_sum; - set_tcp_age(&nat->nat_age, - nat->nat_state, ip, fin,0); + fr_tcp_age(&nat->nat_age, + nat->nat_state, ip, fin,0); } else if (ip->ip_p == IPPROTO_UDP) { udphdr_t *udp = (udphdr_t *)tcp; @@ -887,9 +936,61 @@ void ip_natexpire() continue; } *natp = nat->nat_next; +#ifdef IPFILTER_LOG + nat_log(nat, NL_EXPIRE); +#endif nat_delete(nat); nat_stats.ns_expire++; } SPLX(s); MUTEX_EXIT(&ipf_nat); } + + +#ifdef IPFILTER_LOG +void nat_log(nat, type) +struct nat *nat; +u_short type; +{ + struct ipnat *np; + struct natlog natl; + int rulen; + + if (iplused[IPL_LOGNAT] + sizeof(natl) > IPLLOGSIZE) { + nat_stats.ns_logfail++; + return; + } + + if (iplh[IPL_LOGNAT] == iplbuf[IPL_LOGNAT] + IPLLOGSIZE) + iplh[IPL_LOGNAT] = iplbuf[IPL_LOGNAT]; + +# ifdef sun + uniqtime(&natl); +# endif +# if BSD >= 199306 || defined(__FreeBSD__) + microtime((struct timeval *)&natl); +# endif + natl.nl_origport = nat->nat_oport; + natl.nl_outport = nat->nat_outport; + natl.nl_inport = nat->nat_inport; + natl.nl_origip = nat->nat_oip; + natl.nl_outip = nat->nat_outip; + natl.nl_inip = nat->nat_inip; + natl.nl_type = type; + natl.nl_rule = -1; + if (nat->nat_ptr) { + for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++) + if (np == nat->nat_ptr) { + natl.nl_rule = rulen; + break; + } + } + + if (!fr_copytolog(IPL_LOGNAT, (char *)&natl, sizeof(natl))) { + iplused[IPL_LOGNAT] += sizeof(natl); + nat_stats.ns_logged++; + } else + nat_stats.ns_logfail++; + wakeup(iplbuf[IPL_LOGNAT]); +} +#endif diff --git a/sys/contrib/ipfilter/netinet/ip_nat.h b/sys/contrib/ipfilter/netinet/ip_nat.h index d64183a..6dcd28b 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.h +++ b/sys/contrib/ipfilter/netinet/ip_nat.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_nat.h 1.5 2/4/96 - * $Id: ip_nat.h,v 2.0.1.7 1997/01/30 12:39:41 darrenr Exp $ + * $Id: ip_nat.h,v 1.1.1.2 1997/04/03 10:11:19 darrenr Exp $ */ #ifndef __IP_NAT_H_ @@ -40,7 +40,8 @@ #define NAT_SIZE 367 typedef struct nat { - int nat_age; + u_long nat_age; + int nat_flags; u_long nat_sumd; u_long nat_ipsumd; struct in_addr nat_inip; @@ -101,6 +102,8 @@ typedef struct natstat { u_long ns_added; u_long ns_expire; u_long ns_inuse; + u_long ns_logged; + u_long ns_logfail; nat_t **ns_table[2]; ipnat_t *ns_list; } natstat_t; @@ -110,9 +113,37 @@ typedef struct natstat { #define IPN_UDP 2 #define IPN_TCPUDP 3 + +typedef struct natlog { + struct timeval nl_tv; + struct in_addr nl_origip; + struct in_addr nl_outip; + struct in_addr nl_inip; + u_short nl_origport; + u_short nl_outport; + u_short nl_inport; + u_short nl_type; + int nl_rule; +} natlog_t; + + +#define NL_NEWMAP NAT_MAP +#define NL_NEWRDR NAT_REDIRECT +#define NL_EXPIRE 0xffff + + extern nat_t *nat_table[2][NAT_SIZE]; -extern int nat_ioctl(); -extern nat_t *nat_outlookup(), *nat_inlookup(), *nat_lookupredir(); -extern int ip_natout(), ip_natin(); -extern void ip_natunload(), ip_natexpire(); +extern int nat_ioctl __P((caddr_t, int, int)); +extern nat_t *nat_outlookup __P((int, struct in_addr, u_short, + struct in_addr, u_short)); +extern nat_t *nat_inlookup __P((int, struct in_addr, u_short, + struct in_addr, u_short)); +extern nat_t *nat_lookupredir __P((natlookup_t *)); +extern nat_t *nat_lookupmapip __P((int, struct in_addr, u_short, + struct in_addr, u_short)); + +extern int ip_natout __P((ip_t *, int, fr_info_t *)); +extern int ip_natin __P((ip_t *, int, fr_info_t *)); +extern void ip_natunload __P((void)), ip_natexpire __P((void)); +extern void nat_log __P((struct nat *, u_short)); #endif /* __IP_NAT_H__ */ diff --git a/sys/contrib/ipfilter/netinet/ip_state.c b/sys/contrib/ipfilter/netinet/ip_state.c index 2643ce9..e26b4f3 100644 --- a/sys/contrib/ipfilter/netinet/ip_state.c +++ b/sys/contrib/ipfilter/netinet/ip_state.c @@ -7,7 +7,7 @@ */ #if !defined(lint) && defined(LIBC_SCCS) static char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed"; -static char rcsid[] = "$Id: ip_state.c,v 2.0.1.3 1997/02/16 06:18:36 darrenr Exp $"; +static char rcsid[] = "$Id: ip_state.c,v 1.1.1.3 1997/04/03 10:11:29 darrenr Exp $"; #endif #if !defined(_KERNEL) && !defined(KERNEL) @@ -17,12 +17,19 @@ static char rcsid[] = "$Id: ip_state.c,v 2.0.1.3 1997/02/16 06:18:36 darrenr Exp #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> +#include <sys/time.h> #include <sys/file.h> +#if defined(__FreeBSD__) && (__FreeBSD__ >= 3) +#include <sys/ioccom.h> +#include <sys/filio.h> +#include <sys/fcntl.h> +#else #include <sys/ioctl.h> +#endif #include <sys/uio.h> #include <sys/protosw.h> #include <sys/socket.h> -#ifdef _KERNEL +#ifdef _KERNEL # include <sys/systm.h> #endif #if !defined(__SVR4) && !defined(__svr4__) @@ -48,15 +55,13 @@ static char rcsid[] = "$Id: ip_state.c,v 2.0.1.3 1997/02/16 06:18:36 darrenr Exp #include <netinet/udp.h> #include <netinet/tcpip.h> #include <netinet/ip_icmp.h> -#include "ip_fil.h" #include "ip_compat.h" +#include "ip_fil.h" #include "ip_state.h" #ifndef MIN #define MIN(a,b) (((a)<(b))?(a):(b)) #endif -void set_tcp_age(); - #define TCP_CLOSE (TH_FIN|TH_RST) ipstate_t *ips_table[IPSTATE_SIZE]; @@ -169,8 +174,8 @@ u_int pass; */ if ((tcp->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) is->is_ack = 0; /* Trumpet WinSock 'ism */ - set_tcp_age(&is->is_age, is->is_state, ip, fin, - tcp->th_sport == is->is_sport); + fr_tcp_age(&is->is_age, is->is_state, ip, fin, + tcp->th_sport == is->is_sport); break; } case IPPROTO_UDP : @@ -187,7 +192,8 @@ u_int pass; return -1; } - if (!(is = (ipstate_t *)KMALLOC(sizeof(*is)))) { + KMALLOC(is, ipstate_t *, sizeof(*is)); + if (is == NULL) { ips_stats.iss_nomem++; return -1; } @@ -197,9 +203,14 @@ u_int pass; is->is_next = ips_table[hv]; ips_table[hv] = is; is->is_pass = pass; + is->is_pkts = 1; + is->is_bytes = ip->ip_len; if (pass & FR_LOGFIRST) is->is_pass &= ~(FR_LOGFIRST|FR_LOG); ips_num++; +#ifdef IPFILTER_LOG + ipstate_log(is, ISL_NEW); +#endif MUTEX_EXIT(&ipf_state); return 0; } @@ -210,13 +221,7 @@ u_int pass; * change timeout depending on whether new packet is a SYN-ACK returning for a * SYN or a RST or FIN which indicate time to close up shop. */ -int fr_tcpstate(is, fin, ip, tcp, sport -#ifndef _KERNEL -,isp) -ipstate_t **isp; -#else -) -#endif +int fr_tcpstate(is, fin, ip, tcp, sport) register ipstate_t *is; fr_info_t *fin; ip_t *ip; @@ -278,11 +283,13 @@ u_short sport; is->is_dwin = ntohs(tcp->th_win); } ips_stats.iss_hits++; + is->is_pkts++; + is->is_bytes += ip->ip_len; /* * Nearing end of connection, start timeout. */ - set_tcp_age(&is->is_age, is->is_state, ip, fin, - tcp->th_sport == is->is_sport); + fr_tcp_age(&is->is_age, is->is_state, ip, fin, + tcp->th_sport == is->is_sport); return 1; } return 0; @@ -301,7 +308,7 @@ fr_info_t *fin; register u_char pr; struct icmp *ic; tcphdr_t *tcp; - u_int hv, hlen; + u_int hv, hlen, pass; if ((ip->ip_off & 0x1fff) || (fin->fin_fi.fi_fl & FI_SHORT)) return 0; @@ -336,6 +343,8 @@ fr_info_t *fin; is->is_icmp.ics_type != ic->icmp_type) continue; is->is_age = fr_icmptimeout; + is->is_pkts++; + is->is_bytes += ip->ip_len; ips_stats.iss_hits++; MUTEX_EXIT(&ipf_state); return is->is_pass; @@ -357,7 +366,6 @@ fr_info_t *fin; if (fr_tcpstate(is, fin, ip, tcp, sport)) { #ifdef _KERNEL MUTEX_EXIT(&ipf_state); - return is->is_pass; #else int pass = is->is_pass; @@ -366,8 +374,8 @@ fr_info_t *fin; isp = &ips_table[hv]; KFREE(is); } - return pass; #endif + return pass; } } MUTEX_EXIT(&ipf_state); @@ -389,9 +397,12 @@ fr_info_t *fin; PAIRS(sport, dport, is->is_sport, is->is_dport) && IPPAIR(src, dst, is->is_src, is->is_dst)) { ips_stats.iss_hits++; + is->is_pkts++; + is->is_bytes += ip->ip_len; is->is_age = fr_udptimeout; + pass = is->is_pass; MUTEX_EXIT(&ipf_state); - return is->is_pass; + return pass; } MUTEX_EXIT(&ipf_state); break; @@ -445,6 +456,9 @@ void fr_timeoutstate() ips_stats.iss_fin++; else ips_stats.iss_expire++; +#ifdef IPFILTER_LOG + ipstate_log(is, ISL_EXPIRE); +#endif KFREE(is); ips_num--; } else @@ -458,8 +472,8 @@ void fr_timeoutstate() * Original idea freom Pradeep Krishnan for use primarily with NAT code. * (pkrishna@netcom.com) */ -void set_tcp_age(age, state, ip, fin, dir) -int *age; +void fr_tcp_age(age, state, ip, fin, dir) +u_long *age; u_char *state; ip_t *ip; fr_info_t *fin; @@ -540,3 +554,51 @@ int dir; break; } } + + +#ifdef IPFILTER_LOG +void ipstate_log(is, type) +struct ipstate *is; +u_short type; +{ + struct ipslog ipsl; + + if (iplused[IPL_LOGSTATE] + sizeof(ipsl) > IPLLOGSIZE) { + ips_stats.iss_logfail++; + return; + } + + if (iplh[IPL_LOGSTATE] == iplbuf[IPL_LOGSTATE] + IPLLOGSIZE) + iplh[IPL_LOGSTATE] = iplbuf[IPL_LOGSTATE]; + +# ifdef sun + uniqtime(&ipsl); +# endif +# if BSD >= 199306 || defined(__FreeBSD__) + microtime((struct timeval *)&ipsl); +# endif + ipsl.isl_pkts = is->is_pkts; + ipsl.isl_bytes = is->is_bytes; + ipsl.isl_src = is->is_src; + ipsl.isl_dst = is->is_dst; + ipsl.isl_p = is->is_p; + ipsl.isl_flags = is->is_flags; + ipsl.isl_type = type; + if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { + ipsl.isl_sport = is->is_sport; + ipsl.isl_dport = is->is_dport; + } else if (ipsl.isl_p == IPPROTO_ICMP) + ipsl.isl_itype = is->is_icmp.ics_type; + else { + ipsl.isl_ps.isl_filler[0] = 0; + ipsl.isl_ps.isl_filler[1] = 0; + } + + if (!fr_copytolog(IPL_LOGSTATE, (char *)&ipsl, sizeof(ipsl))) { + iplused[IPL_LOGSTATE] += sizeof(ipsl); + ips_stats.iss_logged++; + } else + ips_stats.iss_logfail++; + wakeup(iplbuf[IPL_LOGSTATE]); +} +#endif diff --git a/sys/contrib/ipfilter/netinet/ip_state.h b/sys/contrib/ipfilter/netinet/ip_state.h index ee30b98..b92f8c2 100644 --- a/sys/contrib/ipfilter/netinet/ip_state.h +++ b/sys/contrib/ipfilter/netinet/ip_state.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed - * $Id: ip_state.h,v 2.0.1.1 1997/01/09 15:14:43 darrenr Exp $ + * $Id: ip_state.h,v 1.1.1.2 1997/04/03 10:11:33 darrenr Exp $ */ #ifndef __IP_STATE_H__ #define __IP_STATE_H__ @@ -37,8 +37,10 @@ typedef struct tcpstate { typedef struct ipstate { struct ipstate *is_next; - int is_age; + u_long is_age; u_int is_pass; + U_QUAD_T is_pkts; + U_QUAD_T is_bytes; struct in_addr is_src; struct in_addr is_dst; u_char is_p; @@ -63,6 +65,31 @@ typedef struct ipstate { #define TH_OPENING (TH_SYN|TH_ACK) + +typedef struct ipslog { + struct timeval isl_tv; + U_QUAD_T isl_pkts; + U_QUAD_T isl_bytes; + struct in_addr isl_src; + struct in_addr isl_dst; + u_char isl_p; + u_char isl_flags; + u_short isl_type; + union { + u_short isl_filler[2]; + u_short isl_ports[2]; + u_short isl_icmp; + } isl_ps; +} ipslog_t; + +#define isl_sport isl_ps.isl_ports[0] +#define isl_dport isl_ps.isl_ports[1] +#define isl_itype isl_ps.isl_icmp + +#define ISL_NEW 0 +#define ISL_EXPIRE 0xffff + + typedef struct ips_stat { u_long iss_hits; u_long iss_miss; @@ -74,13 +101,18 @@ typedef struct ips_stat { u_long iss_expire; u_long iss_fin; u_long iss_active; + u_long iss_logged; + u_long iss_logfail; ipstate_t **iss_table; } ips_stat_t; -extern ips_stat_t *fr_statetstats(); -extern int fr_addstate(), fr_checkstate(); -extern void fr_timeoutstate(), set_tcp_age(); -# ifdef _KERNEL -extern void fr_stateunload(); -# endif +extern int fr_tcpstate __P((ipstate_t *, fr_info_t *, ip_t *, + tcphdr_t *, u_short)); +extern ips_stat_t *fr_statetstats __P((void)); +extern int fr_addstate __P((ip_t *, fr_info_t *, u_int)); +extern int fr_checkstate __P((ip_t *, fr_info_t *)); +extern void fr_timeoutstate __P((void)); +extern void fr_tcp_age __P((u_long *, u_char *, ip_t *, fr_info_t *, int)); +extern void fr_stateunload __P((void)); +extern void ipstate_log __P((struct ipstate *, u_short)); #endif /* __IP_STATE_H__ */ |