diff options
33 files changed, 959 insertions, 188 deletions
diff --git a/contrib/ipfilter/FreeBSD/kinstall b/contrib/ipfilter/FreeBSD/kinstall index 42c2f09..bb5aef5 100755 --- a/contrib/ipfilter/FreeBSD/kinstall +++ b/contrib/ipfilter/FreeBSD/kinstall @@ -15,12 +15,17 @@ foreach i (ip_fil.[ch] ip_nat.[ch] ip_frag.[ch] ip_state.[ch] fil.c \ chmod 644 /sys/netinet/$i end echo "" -echo "Patching $archdir/$karch/conf.c" -cat FreeBSD/conf.c.diffs | (cd $archdir/$karch; patch) -echo "Patching ip_input.c, ip_output.c and in_proto.c" -cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs | \ -(cd /sys/netinet; patch) - +grep iplopen $archdir/$karch/conf.c >& /dev/null +if ( $status != 0 ) then + echo "Patching $archdir/$karch/conf.c" + cat FreeBSD/conf.c.diffs | (cd $archdir/$karch; patch) +endif +grep fr_checkp /sys/netinet/ip_input.c >& /dev/null +if ( $status != 0 ) then + echo "Patching ip_input.c, ip_output.c and in_proto.c" + cat FreeBSD/ip_{in,out}put.c.diffs FreeBSD/in_proto.c.diffs | \ + (cd /sys/netinet; patch) +endif if ( -f /sys/conf/files.newconf ) then echo "Patching /sys/conf/files.newconf" cat FreeBSD/files.newconf.diffs | (cd /sys/conf; patch) diff --git a/contrib/ipfilter/HISTORY b/contrib/ipfilter/HISTORY index ea2f478..b794c9a 100644 --- a/contrib/ipfilter/HISTORY +++ b/contrib/ipfilter/HISTORY @@ -20,6 +20,55 @@ # and especially those who have found the time to port IP Filter to new # platforms. # +3.4.8 19/07/2000 - Released + +create fake opt_inet6.h for FreeBSD-4 compile as LKM + +add #ifdef's for KLD_MODULE sanity + +NAT fastroute'd packets which come out of return-* + +fix upper/lower case crap in ftp proxy and get seq# checking fixed up. + +3.4.7 08/07/2000 - Released + +make "ipf -y" lookup NAT if's which are unknown + +prepend line numbers to ioctl error messages in ipf/ipnat + +don't apply patches to FreeBSD twice + +allow for ip_len to be on an unaligned boundary early on in fr_precheck + +fix printing of icmp code when it is 0 + +correct printing of port numbers in map rules with from/to + +don't allow fr_func to be called at securelevel > 0 or rules to be added +if securelevel > 0 if they have a non-zero fr_func. + +3.4.6 11/06/2000 - Released + +add extra regression tests for new nat functionality + +place restrictions on using '!' in map/rdr rules + +fix up solaris compile problems + +3.4.5 10/06/2000 - Released + +mention -sl in ipfstat.8 + +fix/support '!' in from/to rules (rdr) for NAT + +add from/to support to rdr NAT rules + +don't send ICMP errors in response to ICMP errors + +fix sunos5 compilation for "ipfstat-top" and cleanup ipfboot + +input accounting list used for both outbound and inbound packets + 3.4.4 23/05/2000 - Released don't add TCP state if it is an RST packet and (attempt) to send out diff --git a/contrib/ipfilter/Makefile b/contrib/ipfilter/Makefile index 050aac6..cb4199e 100644 --- a/contrib/ipfilter/Makefile +++ b/contrib/ipfilter/Makefile @@ -5,7 +5,7 @@ # provided that this notice is preserved and due credit is given # to the original author and the contributors. # -# $Id: Makefile,v 2.11.2.1 2000/04/26 12:14:58 darrenr Exp $ +# $Id: Makefile,v 2.11.2.2 2000/07/18 13:58:10 darrenr Exp $ # BINDEST=/usr/local/bin SBINDEST=/sbin @@ -126,6 +126,11 @@ freebsd22: include make freebsd freebsd4: include + if [ x$INET6 = x ] ; then \ + echo "#undef INET6" > opt_inet6.h; \ + else \ + echo "#define INET6" > opt_inet6.h; \ + fi make setup "TARGOS=BSD" "CPUDIR=$(CPUDIR)" (cd BSD/$(CPUDIR); make build TOP=../.. $(MFLAGS) "ML=mlfk_ipl.c" "MLD=mlfk_ipl.c" "LKM=ipf.ko" "DLKM=-DKLD_MODULE"; cd ..) (cd BSD/$(CPUDIR); make -f Makefile.ipsend TOP=../.. $(MFLAGS1); cd ..) @@ -181,7 +186,7 @@ setup: clean: clean-include ${RM} -f core *.o ipt fils ipf ipfstat ipftest ipmon if_ipl \ - vnode_if.h $(LKM) *~ + vnode_if.h $(LKM) *~ opt_inet6.h (cd SunOS4; make clean) (cd SunOS5; make clean) (cd BSD; make clean) diff --git a/contrib/ipfilter/fil.c b/contrib/ipfilter/fil.c index 258f76e..623e84e 100644 --- a/contrib/ipfilter/fil.c +++ b/contrib/ipfilter/fil.c @@ -7,13 +7,9 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.8 2000/05/22 10:26:09 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.18 2000/07/19 13:13:40 darrenr Exp $"; #endif -#if defined(_KERNEL) && defined(__FreeBSD_version) && \ - (__FreeBSD_version >= 400000) && !defined(KLD_MODULE) -#include "opt_inet6.h" -#endif #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> @@ -25,6 +21,14 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.8 2000/05/22 10:26:09 darre #endif #if (defined(KERNEL) || defined(_KERNEL)) && defined(__FreeBSD_version) && \ (__FreeBSD_version >= 220000) +# if (__FreeBSD_version >= 400000) +# ifndef KLD_MODULE +# include "opt_inet6.h" +# endif +# if (__FreeBSD_version == 400019) +# define CSUM_DELAY_DATA +# endif +# endif # include <sys/filio.h> # include <sys/fcntl.h> #else @@ -115,10 +119,8 @@ extern kmutex_t ipf_rw; # if SOLARIS # define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \ ip, qif) -# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip, qif) # else /* SOLARIS */ # define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip) -# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip) # endif /* SOLARIS || __sgi */ #endif /* _KERNEL */ @@ -659,8 +661,11 @@ void *m; * Just log this packet... */ passt = fr->fr_flags; - if ((passt & FR_CALLNOW) && fr->fr_func) - passt = (*fr->fr_func)(passt, ip, fin); +#if (BSD >= 199306) && (defined(_KERNEL) || defined(KERNEL)) + if (securelevel <= 0) +#endif + if ((passt & FR_CALLNOW) && fr->fr_func) + passt = (*fr->fr_func)(passt, ip, fin); fin->fin_fr = fr; #ifdef IPFILTER_LOG if ((passt & FR_LOGMASK) == FR_LOG) { @@ -965,8 +970,11 @@ int out; pass &= ~(FR_LOGFIRST|FR_LOG); } - if (fr && fr->fr_func && !(pass & FR_CALLNOW)) - pass = (*fr->fr_func)(pass, ip, fin); +#if (BSD >= 199306) && (defined(_KERNEL) || defined(KERNEL)) + if (securelevel <= 0) +#endif + if (fr && fr->fr_func && !(pass & FR_CALLNOW)) + pass = (*fr->fr_func)(pass, ip, fin); /* * Only count/translate packets which will be passed on, out the @@ -975,10 +983,10 @@ int out; if (out && (pass & FR_PASS)) { #ifdef USE_INET6 if (v == 6) - list = ipacct6[0][fr_active]; + list = ipacct6[1][fr_active]; else #endif - list = ipacct[0][fr_active]; + list = ipacct[1][fr_active]; if ((fin->fin_fr = list) && (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) { ATOMIC_INCL(frstats[1].fr_acct); @@ -1123,11 +1131,11 @@ logit: if (((pass & FR_FASTROUTE) && !out) || (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) { - if (ipfr_fastroute(qif, ip, m, mp, fin, fdp) == 0) + if (ipfr_fastroute(ip, m, mp, fin, fdp) == 0) m = *mp = NULL; } if (mc) - ipfr_fastroute(qif, ip, mc, mp, fin, &fr->fr_dif); + ipfr_fastroute(ip, mc, mp, fin, &fr->fr_dif); } # endif /* !SOLARIS */ return (pass & FR_PASS) ? 0 : error; @@ -1359,7 +1367,7 @@ nodata: * SUCH DAMAGE. * * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94 - * $Id: fil.c,v 2.35.2.8 2000/05/22 10:26:09 darrenr Exp $ + * $Id: fil.c,v 2.35.2.18 2000/07/19 13:13:40 darrenr Exp $ */ /* * Copy data from an mbuf chain starting "off" bytes from the beginning, @@ -1807,6 +1815,7 @@ void frsync() ip_natsync(ifp); ip_statesync(ifp); } + ip_natsync((struct ifnet *)-1); # endif WRITE_ENTER(&ipf_mutex); diff --git a/contrib/ipfilter/ip_auth.c b/contrib/ipfilter/ip_auth.c index 78aff43..9fa24d6 100644 --- a/contrib/ipfilter/ip_auth.c +++ b/contrib/ipfilter/ip_auth.c @@ -6,7 +6,7 @@ * to the original author and the contributors. */ #if !defined(lint) -static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.2 2000/05/22 10:26:11 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.3 2000/06/17 06:24:31 darrenr Exp $"; #endif #include <sys/errno.h> @@ -46,7 +46,7 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.2 2000/05/22 10:26:11 d # include <sys/stream.h> # include <sys/kmem.h> #endif -#if _BSDI_VERSION >= 199802 +#if (_BSDI_VERSION >= 199802) || (__FreeBSD_Version >= 400000) # include <sys/queue.h> #endif #if defined(__NetBSD__) || defined(__OpenBSD__) || defined(bsdi) diff --git a/contrib/ipfilter/ip_fil.c b/contrib/ipfilter/ip_fil.c index 9216b3c..fe6af66 100644 --- a/contrib/ipfilter/ip_fil.c +++ b/contrib/ipfilter/ip_fil.c @@ -7,7 +7,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.9 2000/05/22 12:48:28 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.14 2000/07/18 13:57:55 darrenr Exp $"; #endif #ifndef SOLARIS @@ -692,6 +692,10 @@ caddr_t data; if (error) return EFAULT; fp->fr_ref = 0; +#if (BSD >= 199306) && defined(_KERNEL) + if ((securelevel > 0) && (fp->fr_func != NULL)) + return EPERM; +#endif /* * Check that the group number does exist and that if a head group @@ -764,7 +768,7 @@ caddr_t data; * interface pointer in the comparison (fr_next, fr_ifa). */ for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_ip, pp = &fp->fr_cksum; - p != pp; p++) + p < pp; p++) fp->fr_cksum += *p; for (; (f = *ftail); ftail = &f->fr_next) @@ -1088,6 +1092,19 @@ int dst; m = NULL; ifp = fin->fin_ifp; if (fin->fin_v == 4) { + if ((oip->ip_p == IPPROTO_ICMP) && + !(fin->fin_fi.fi_fl & FI_SHORT)) + switch (ntohs(fin->fin_data[0]) >> 8) + { + case ICMP_ECHO : + case ICMP_TSTAMP : + case ICMP_IREQ : + case ICMP_MASKREQ : + break; + default : + return 0; + } + # if (BSD < 199306) || defined(__sgi) avail = MLEN; m = m_get(M_DONTWAIT, MT_HEADER); @@ -1325,10 +1342,9 @@ frdest_t *fdp; ATOMIC_INCL(frstats[1].fr_acct); } fin->fin_fr = NULL; - if (!fr || !(fr->fr_flags & FR_RETMASK)) { + if (!fr || !(fr->fr_flags & FR_RETMASK)) (void) fr_checkstate(ip, fin); - (void) ip_natout(ip, fin); - } + (void) ip_natout(ip, fin); } else ip->ip_sum = 0; /* @@ -1585,15 +1601,29 @@ int v; if (!ifneta) { ifneta = (struct ifnet **)malloc(sizeof(ifp) * 2); + if (!ifneta) + return NULL; ifneta[1] = NULL; ifneta[0] = (struct ifnet *)calloc(1, sizeof(*ifp)); + if (!ifneta[0]) { + free(ifneta); + return NULL; + } nifs = 1; } else { nifs++; ifneta = (struct ifnet **)realloc(ifneta, (nifs + 1) * sizeof(*ifa)); + if (!ifneta) { + nifs = 0; + return NULL; + } ifneta[nifs] = NULL; ifneta[nifs - 1] = (struct ifnet *)malloc(sizeof(*ifp)); + if (!ifneta[nifs - 1]) { + nifs--; + return NULL; + } } ifp = ifneta[nifs - 1]; diff --git a/contrib/ipfilter/ip_fil.h b/contrib/ipfilter/ip_fil.h index 14f4861..da109b7 100644 --- a/contrib/ipfilter/ip_fil.h +++ b/contrib/ipfilter/ip_fil.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_fil.h 1.35 6/5/96 - * $Id: ip_fil.h,v 2.29.2.2 2000/05/22 10:26:13 darrenr Exp $ + * $Id: ip_fil.h,v 2.29.2.3 2000/06/05 13:12:42 darrenr Exp $ */ #ifndef __IP_FIL_H__ @@ -519,8 +519,8 @@ extern int iplioctl __P((dev_t, int, int *, int, cred_t *, int *)); extern int iplopen __P((dev_t *, int, int, cred_t *)); extern int iplclose __P((dev_t, int, int, cred_t *)); extern int ipfsync __P((void)); -extern int ipfr_fastroute __P((qif_t *, ip_t *, mblk_t *, mblk_t **, - fr_info_t *, frdest_t *)); +extern int ipfr_fastroute __P((ip_t *, mblk_t *, mblk_t **, + fr_info_t *, frdest_t *)); extern void copyin_mblk __P((mblk_t *, size_t, size_t, char *)); extern void copyout_mblk __P((mblk_t *, size_t, size_t, char *)); extern int fr_qin __P((queue_t *, mblk_t *)); @@ -529,8 +529,6 @@ extern int iplread __P((dev_t, struct uio *, cred_t *)); # else /* SOLARIS */ extern int fr_check __P((ip_t *, int, void *, int, mb_t **)); extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **)); -extern int send_reset __P((struct ip *, fr_info_t *)); -extern int send_icmp_err __P((ip_t *, int, fr_info_t *, int)); extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *)); extern size_t mbufchainlen __P((mb_t *)); # ifdef __sgi diff --git a/contrib/ipfilter/ip_frag.c b/contrib/ipfilter/ip_frag.c index 3e0a7f3..5019c60 100644 --- a/contrib/ipfilter/ip_frag.c +++ b/contrib/ipfilter/ip_frag.c @@ -7,7 +7,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.3 2000/05/05 15:10:23 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.4 2000/06/06 15:49:15 darrenr Exp $"; #endif #if defined(KERNEL) && !defined(_KERNEL) @@ -144,6 +144,9 @@ ipfr_t *table[]; ipfr_t **fp, *fra, frag; u_int idx; + if (ipfr_inuse >= IPFT_SIZE) + return NULL; + frag.ipfr_p = ip->ip_p; idx = ip->ip_p; frag.ipfr_id = ip->ip_id; diff --git a/contrib/ipfilter/ip_ftp_pxy.c b/contrib/ipfilter/ip_ftp_pxy.c index 691e0ad..5ea94a1 100644 --- a/contrib/ipfilter/ip_ftp_pxy.c +++ b/contrib/ipfilter/ip_ftp_pxy.c @@ -2,14 +2,17 @@ * Simple FTP transparent proxy for in-kernel use. For use with the NAT * code. * - * $Id: ip_ftp_pxy.c,v 2.7.2.7 2000/05/13 14:28:14 darrenr Exp $ + * $Id: ip_ftp_pxy.c,v 2.7.2.12 2000/07/19 13:06:13 darrenr Exp $ */ #if SOLARIS && defined(_KERNEL) extern kmutex_t ipf_rw; #endif #define isdigit(x) ((x) >= '0' && (x) <= '9') -#define isupper(x) ((unsigned)((x) - 'A') <= 'Z' - 'A') +#define isupper(x) (((unsigned)(x) >= 'A') && ((unsigned)(x) <= 'Z')) +#define islower(x) (((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z')) +#define isalpha(x) (isupper(x) || islower(x)) +#define toupper(x) (isupper(x) ? (x) : (x) - 'a' + 'A') #define IPF_FTP_PROXY @@ -35,6 +38,7 @@ u_short ippr_ftp_atoi __P((char **)); static frentry_t natfr; int ippr_ftp_pasvonly = 0; +int ippr_ftp_insecure = 0; /* @@ -97,21 +101,12 @@ int dlen; #endif tcp = (tcphdr_t *)fin->fin_dp; - off = f->ftps_seq - ntohl(tcp->th_seq); - if (off < 0) - return 0; /* * Check for client sending out PORT message. */ if (dlen < IPF_MINPORTLEN) return 0; - /* - * Count the number of bytes in the PORT message is. - */ - if (off < 0) - return 0; - - off += fin->fin_hlen + (tcp->th_off << 2); + off = fin->fin_hlen + (tcp->th_off << 2); /* * Skip the PORT command + space */ @@ -201,6 +196,10 @@ int dlen; m_adj(m, inc); /* the mbuf chain will be extended if necessary by m_copyback() */ m_copyback(m, off, nlen, newbuf); +# ifdef M_PKTHDR + if (!(m->m_flags & M_PKTHDR)) + m->m_pkthdr.len += inc; +# endif #endif if (inc != 0) { #if SOLARIS || defined(__sgi) @@ -275,27 +274,39 @@ ftpinfo_t *ftp; ip_t *ip; int dlen; { - char *rptr, *wptr; + char *rptr, *wptr, cmd[6], c; ftpside_t *f; - int inc; + int inc, i; inc = 0; f = &ftp->ftp_side[0]; rptr = f->ftps_rptr; wptr = f->ftps_wptr; - if ((ftp->ftp_passok == 0) && !strncmp(rptr, "USER ", 5)) + for (i = 0; (i < 5) && (i < dlen); i++) { + c = rptr[i]; + if (isalpha(c)) { + cmd[i] = toupper(c); + } else { + cmd[i] = c; + } + } + cmd[i] = '\0'; + + if ((ftp->ftp_passok == 0) && !strncmp(cmd, "USER ", 5)) ftp->ftp_passok = 1; - else if ((ftp->ftp_passok == 2) && !strncmp(rptr, "PASS ", 5)) + else if ((ftp->ftp_passok == 2) && !strncmp(cmd, "PASS ", 5)) ftp->ftp_passok = 3; else if ((ftp->ftp_passok == 4) && !ippr_ftp_pasvonly && - !strncmp(rptr, "PORT ", 5)) { + !strncmp(cmd, "PORT ", 5)) { + inc = ippr_ftp_port(fin, ip, nat, f, dlen); + } else if (ippr_ftp_insecure && !ippr_ftp_pasvonly && + !strncmp(cmd, "PORT ", 5)) { inc = ippr_ftp_port(fin, ip, nat, f, dlen); } while ((*rptr++ != '\n') && (rptr < wptr)) ; - f->ftps_seq += rptr - f->ftps_rptr; f->ftps_rptr = rptr; return inc; } @@ -313,8 +324,8 @@ int dlen; u_short a5, a6, sp, dp; u_int a1, a2, a3, a4; fr_info_t fi; - int inc, off; nat_t *ipn; + int inc; char *s; /* @@ -325,15 +336,8 @@ int dlen; else if (strncmp(f->ftps_rptr, "227 Entering Passive Mode", 25)) return 0; - /* - * Count the number of bytes in the 227 reply is. - */ tcp = (tcphdr_t *)fin->fin_dp; - off = f->ftps_seq - ntohl(tcp->th_seq); - if (off < 0) - return 0; - off += fin->fin_hlen + (tcp->th_off << 2); /* * Skip the PORT command + space */ @@ -417,13 +421,13 @@ int dlen; m1->b_wptr += inc; } /*copyin_mblk(m, off, nlen, newbuf);*/ -#else +#else /* SOLARIS */ m = *((mb_t **)fin->fin_mp); if (inc < 0) m_adj(m, inc); /* the mbuf chain will be extended if necessary by m_copyback() */ /*m_copyback(m, off, nlen, newbuf);*/ -#endif +#endif /* SOLARIS */ if (inc != 0) { #if SOLARIS || defined(__sgi) register u_32_t sum1, sum2; @@ -438,10 +442,10 @@ int dlen; sum2 = (sum2 & 0xffff) + (sum2 >> 16); fix_outcksum(&ip->ip_sum, sum2, 0); -#endif +#endif /* SOLARIS || defined(__sgi) */ ip->ip_len += inc; } -#endif +#endif /* 0 */ /* * Add skeleton NAT entry for connection which will come back the @@ -507,10 +511,11 @@ int dlen; ftp->ftp_passok = 0; else if ((ftp->ftp_passok == 4) && !strncmp(rptr, "227 ", 4)) { inc = ippr_ftp_pasv(fin, ip, nat, f, dlen); + } else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) { + inc = ippr_ftp_pasv(fin, ip, nat, f, dlen); } while ((*rptr++ != '\n') && (rptr < wptr)) ; - f->ftps_seq += rptr - f->ftps_rptr; f->ftps_rptr = rptr; return inc; } @@ -548,16 +553,16 @@ size_t len; return 1; } else return 1; - } else if (isupper(c)) { + } else if (isalpha(c)) { c = *s++; i--; - if (isupper(c)) { + if (isalpha(c)) { c = *s++; i--; - if (isupper(c)) { + if (isalpha(c)) { c = *s++; i--; - if (isupper(c)) { + if (isalpha(c)) { c = *s++; i--; if ((c != ' ') && (c != '\r')) @@ -586,10 +591,10 @@ nat_t *nat; ftpinfo_t *ftp; int rv; { - int mlen, len, off, inc, i; + int mlen, len, off, inc, i, sel; char *rptr, *wptr; + ftpside_t *f, *t; tcphdr_t *tcp; - ftpside_t *f; mb_t *m; tcp = (tcphdr_t *)fin->fin_dp; @@ -606,23 +611,29 @@ int rv; #else mlen = mbufchainlen(m) - off; #endif - if (!mlen) + t = &ftp->ftp_side[1 - rv]; + if (!mlen) { + t->ftps_seq = ntohl(tcp->th_ack); return 0; + } inc = 0; f = &ftp->ftp_side[rv]; rptr = f->ftps_rptr; wptr = f->ftps_wptr; - if ((wptr == f->ftps_buf) && (f->ftps_seq <= ntohl(tcp->th_seq))) - f->ftps_seq = ntohl(tcp->th_seq); + sel = nat->nat_aps->aps_sel[1 - rv]; + if (rv) + i = nat->nat_aps->aps_ackoff[sel]; + else + i = nat->nat_aps->aps_seqoff[sel]; /* * XXX - Ideally, this packet should get dropped because we now know * that it is out of order (and there is no real danger in doing so * apart from causing packets to go through here ordered). */ - if (ntohl(tcp->th_seq) != f->ftps_seq + (wptr - rptr)) { - return APR_ERR(0); + if (ntohl(tcp->th_seq) + i != f->ftps_seq) { + return APR_ERR(-1); } while (mlen > 0) { @@ -666,7 +677,6 @@ int rv; } else rptr++; } - f->ftps_seq += rptr - f->ftps_rptr; f->ftps_rptr = rptr; } @@ -677,7 +687,6 @@ int rv; i = wptr - rptr; if ((rptr == f->ftps_buf) || (wptr - rptr > FTP_BUFSZ / 2)) { - f->ftps_seq += i; f->ftps_junk = 1; rptr = wptr = f->ftps_buf; } else { @@ -691,6 +700,7 @@ int rv; } } + t->ftps_seq = ntohl(tcp->th_ack); f->ftps_rptr = rptr; f->ftps_wptr = wptr; return inc; diff --git a/contrib/ipfilter/ip_log.c b/contrib/ipfilter/ip_log.c index ef1af7f..08073bb 100644 --- a/contrib/ipfilter/ip_log.c +++ b/contrib/ipfilter/ip_log.c @@ -5,7 +5,7 @@ * provided that this notice is preserved and due credit is given * to the original author and the contributors. * - * $Id: ip_log.c,v 2.5 2000/03/13 22:10:21 darrenr Exp $ + * $Id: ip_log.c,v 2.5.2.1 2000/07/19 13:11:47 darrenr Exp $ */ #include <sys/param.h> #if defined(KERNEL) && !defined(_KERNEL) @@ -20,7 +20,11 @@ # include "opt_ipfilter.h" # endif # else -# include <osreldate.h> +# ifdef KLD_MODULE +# include <sys/osreldate.h> +# else +# include <osreldate.h> +# endif # endif #endif #ifdef IPFILTER_LOG diff --git a/contrib/ipfilter/ip_nat.c b/contrib/ipfilter/ip_nat.c index 64f50b6..d25f3f7 100644 --- a/contrib/ipfilter/ip_nat.c +++ b/contrib/ipfilter/ip_nat.c @@ -9,7 +9,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.10 2000/05/19 15:54:44 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.16 2000/07/18 13:57:40 darrenr Exp $"; #endif #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) @@ -473,10 +473,14 @@ int mode; n->in_next = NULL; *np = n; - if (n->in_redir & NAT_REDIRECT) + if (n->in_redir & NAT_REDIRECT) { + n->in_flags &= ~IPN_NOTDST; nat_addrdr(n); - if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) + } + if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { + n->in_flags &= ~IPN_NOTSRC; nat_addnat(n); + } n->in_use = 0; if (n->in_redir & NAT_MAPBLK) @@ -1517,6 +1521,8 @@ int dir; ip_t *oip; int flags = 0; + if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) + return NULL; if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir))) return NULL; *nflags = IPN_ICMPERR; @@ -1559,14 +1565,14 @@ int dir; fix_outcksum(&icmp->icmp_cksum, sumd, 0); } else { fix_outcksum(&oip->ip_sum, sumd, 0); - +#if !SOLARIS && !defined(__sgi) sumd += (sumd & 0xffff); while (sumd > 0xffff) sumd = (sumd & 0xffff) + (sumd >> 16); -/* fix_incksum(&icmp->icmp_cksum, sumd, 0); */ + fix_incksum(&icmp->icmp_cksum, sumd, 0); +#endif } - if ((flags & IPN_TCPUDP) != 0) { tcphdr_t *tcp; @@ -1714,19 +1720,28 @@ ip_t *ip; if (np->in_p && ip->ip_p != np->in_p) return 0; if (fin->fin_out) { - if (!(np->in_redir && (NAT_MAP|NAT_MAPBLK))) + if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) return 0; - if ((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) + if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) + ^ ((np->in_flags & IPN_NOTSRC) != 0)) return 0; - if ((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) + if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) + ^ ((np->in_flags & IPN_NOTDST) != 0)) return 0; } else { - if (!(np->in_redir && NAT_REDIRECT)) + if (!(np->in_redir & NAT_REDIRECT)) + return 0; + if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) + ^ ((np->in_flags & IPN_NOTSRC) != 0)) + return 0; + if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) + ^ ((np->in_flags & IPN_NOTDST) != 0)) return 0; } ft = &np->in_tuc; - if (!(fin->fin_fi.fi_fl & FI_TCPUDP)) { + if (!(fin->fin_fi.fi_fl & FI_TCPUDP) || + (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) { if (ft->ftu_scmp || ft->ftu_dcmp) return 0; return 1; @@ -1863,7 +1878,6 @@ maskloop: np = nat->nat_ptr; if (natadd && fin->fin_fi.fi_fl & FI_FRAG) ipfr_nat_newfrag(ip, fin, 0, nat); - ip->ip_src = nat->nat_outip; MUTEX_ENTER(&nat->nat_lock); nat->nat_age = fr_defnatage; nat->nat_bytes += ip->ip_len; @@ -1874,12 +1888,27 @@ maskloop: * Fix up checksums, not by recalculating them, but * simply computing adjustments. */ + if (nflags == IPN_ICMPERR) { + u_32_t s1, s2, sumd; + + s1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); + s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); + CALC_SUMD(s1, s2, sumd); + + if (nat->nat_dir == NAT_OUTBOUND) + fix_incksum(&ip->ip_sum, sumd, 0); + else + fix_outcksum(&ip->ip_sum, sumd, 0); + } #if SOLARIS || defined(__sgi) - if (nat->nat_dir == NAT_OUTBOUND) - fix_outcksum(&ip->ip_sum, nat->nat_ipsumd, 0); - else - fix_incksum(&ip->ip_sum, nat->nat_ipsumd, 0); + else { + if (nat->nat_dir == NAT_OUTBOUND) + fix_outcksum(&ip->ip_sum, nat->nat_ipsumd, 0); + else + fix_incksum(&ip->ip_sum, nat->nat_ipsumd, 0); + } #endif + ip->ip_src = nat->nat_outip; if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { @@ -1917,6 +1946,7 @@ maskloop: } else if (ip->ip_p == IPPROTO_ICMP) { nat->nat_age = fr_defnaticmpage; } + if (csump) { if (nat->nat_dir == NAT_OUTBOUND) fix_outcksum(csump, nat->nat_sumd[1], @@ -1986,7 +2016,7 @@ fr_info_t *fin; if ((ip->ip_p == IPPROTO_ICMP) && (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND))) ; - else if ((ip->ip_off & IP_OFFMASK) && + else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && (nat = ipfr_nat_knownfrag(ip, fin))) natadd = 0; else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p, @@ -2024,7 +2054,7 @@ maskloop: } else if ((in.s_addr & np->in_outmsk) != np->in_outip) continue; if ((np->in_redir & NAT_REDIRECT) && - (!np->in_pmin || + (!np->in_pmin || (np->in_flags & IPN_FILTER) || ((ntohs(np->in_pmax) >= ntohs(dport)) && (ntohs(dport) >= ntohs(np->in_pmin))))) if ((nat = nat_new(np, ip, fin, nflags, diff --git a/contrib/ipfilter/ip_nat.h b/contrib/ipfilter/ip_nat.h index f1a339f..26fed25 100644 --- a/contrib/ipfilter/ip_nat.h +++ b/contrib/ipfilter/ip_nat.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_nat.h 1.5 2/4/96 - * $Id: ip_nat.h,v 2.17.2.1 2000/05/15 06:50:14 darrenr Exp $ + * $Id: ip_nat.h,v 2.17.2.6 2000/07/15 14:50:06 darrenr Exp $ */ #ifndef __IP_NAT_H__ @@ -103,9 +103,10 @@ typedef struct ipnat { u_int in_hits; struct in_addr in_nextip; u_short in_pnext; - u_short in_ppip; /* ports per IP */ u_short in_ippip; /* IP #'s per IP# */ - u_short in_flags; /* From here to in_dport must be reflected */ + u_32_t in_flags; /* From here to in_dport must be reflected */ + u_short in_spare; + u_short in_ppip; /* ports per IP */ u_short in_port[2]; /* correctly in IPN_CMPSIZ */ struct in_addr in_in[2]; struct in_addr in_out[2]; @@ -212,11 +213,13 @@ typedef struct natstat { #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR) #define IPN_AUTOPORTMAP 0x010 #define IPN_IPRANGE 0x020 -#define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|\ - IPN_SPLIT|IPN_ROUNDR|IPN_FILTER) +#define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\ + IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST) #define IPN_FILTER 0x040 #define IPN_SPLIT 0x080 #define IPN_ROUNDR 0x100 +#define IPN_NOTSRC 0x080000 +#define IPN_NOTDST 0x100000 typedef struct natlog { @@ -236,6 +239,8 @@ typedef struct natlog { #define NL_NEWMAP NAT_MAP #define NL_NEWRDR NAT_REDIRECT +#define NL_NEWBIMAP NAT_BIMAP +#define NL_NEWBLOCK NAT_MAPBLK #define NL_EXPIRE 0xffff #define NAT_HASH_FN(k,l,m) (((k) + ((k) >> 12) + l) % (m)) diff --git a/contrib/ipfilter/ip_rcmd_pxy.c b/contrib/ipfilter/ip_rcmd_pxy.c index daea94f..1d6264d 100644 --- a/contrib/ipfilter/ip_rcmd_pxy.c +++ b/contrib/ipfilter/ip_rcmd_pxy.c @@ -1,5 +1,5 @@ /* - * $Id: ip_rcmd_pxy.c,v 1.4.2.1 2000/05/06 11:19:34 darrenr Exp $ + * $Id: ip_rcmd_pxy.c,v 1.4.2.2 2000/07/15 12:38:30 darrenr Exp $ */ /* * Simple RCMD transparent proxy for in-kernel use. For use with the NAT @@ -93,8 +93,17 @@ nat_t *nat; #endif tcp = (tcphdr_t *)fin->fin_dp; + + if (tcp->th_flags & TH_SYN) { + *(u_32_t *)aps->aps_data = htonl(ntohl(tcp->th_seq) + 1); + return 0; + } + + if ((*(u_32_t *)aps->aps_data != 0) && + (tcp->th_seq != *(u_32_t *)aps->aps_data)) + return 0; + off = (ip->ip_hl << 2) + (tcp->th_off << 2); - m = *(mb_t **)fin->fin_mp; #if SOLARIS m = fin->fin_qfm; @@ -103,13 +112,11 @@ nat_t *nat; bzero(portbuf, sizeof(portbuf)); copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf); #else + m = *(mb_t **)fin->fin_mp; dlen = mbufchainlen(m) - off; bzero(portbuf, sizeof(portbuf)); m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf); #endif - if ((*(u_32_t *)aps->aps_data != 0) && - (tcp->th_seq != *(u_32_t *)aps->aps_data)) - return 0; portbuf[sizeof(portbuf) - 1] = '\0'; s = portbuf; diff --git a/contrib/ipfilter/ip_sfil.c b/contrib/ipfilter/ip_sfil.c index 40766e0..615e57f 100644 --- a/contrib/ipfilter/ip_sfil.c +++ b/contrib/ipfilter/ip_sfil.c @@ -9,7 +9,7 @@ */ #if !defined(lint) static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.2 2000/05/22 10:26:14 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.3 2000/07/08 02:20:14 darrenr Exp $"; #endif #include <sys/types.h> @@ -515,7 +515,7 @@ caddr_t data; * interface pointer in the comparison (fr_next, fr_ifa). */ for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_ip, pp = &fp->fr_cksum; - p != pp; p++) + p < pp; p++) fp->fr_cksum += *p; for (; (f = *ftail); ftail = &f->fr_next) diff --git a/contrib/ipfilter/ip_state.c b/contrib/ipfilter/ip_state.c index c9a28af..fa8e050 100644 --- a/contrib/ipfilter/ip_state.c +++ b/contrib/ipfilter/ip_state.c @@ -7,7 +7,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.9 2000/05/22 10:26:15 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.12 2000/06/19 02:38:37 darrenr Exp $"; #endif #include <sys/errno.h> @@ -381,8 +381,8 @@ caddr_t data; { register ipstate_t *is, *isn; ipstate_save_t ips, *ipsp; + int error, out; frentry_t *fr; - int error; error = IRCOPY(data, (caddr_t)&ipsp, sizeof(ipsp)); if (error) @@ -405,8 +405,26 @@ caddr_t data; return ENOMEM; } bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); + out = fr->fr_flags & FR_OUTQUE ? 1 : 0; isn->is_rule = fr; ips.ips_is.is_rule = fr; + if (*fr->fr_ifname) { + fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_v); + if (fr->fr_ifa == NULL) + fr->fr_ifa = (void *)-1; +#ifdef _KERNEL + else { + strncpy(isn->is_ifname[out], + IFNAME(fr->fr_ifa), IFNAMSIZ); + isn->is_ifp[out] = fr->fr_ifa; + } +#endif + } else + fr->fr_ifa = NULL; + /* + * send a copy back to userland of what we ended up + * to allow for verification. + */ error = IWCOPY((caddr_t)&ips, ipsp, sizeof(ips)); if (error) { KFREE(isn); @@ -1582,8 +1600,8 @@ fr_info_t *fin; (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || (is->is_type - 1 == oic->icmp6_type )) { ips_stats.iss_hits++; - is->is_pkts++; - is->is_bytes += fin->fin_plen; + is->is_pkts++; + is->is_bytes += fin->fin_plen; return is->is_rule; } } diff --git a/contrib/ipfilter/ip_state.h b/contrib/ipfilter/ip_state.h index 01c26a0..a5643af 100644 --- a/contrib/ipfilter/ip_state.h +++ b/contrib/ipfilter/ip_state.h @@ -6,7 +6,7 @@ * to the original author and the contributors. * * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed - * $Id: ip_state.h,v 2.13 2000/03/13 22:10:23 darrenr Exp $ + * $Id: ip_state.h,v 2.13.2.1 2000/07/08 02:15:35 darrenr Exp $ */ #ifndef __IP_STATE_H__ #define __IP_STATE_H__ @@ -17,8 +17,8 @@ # define SIOCDELST _IOW(r, 61, struct ipstate *) #endif -#define IPSTATE_SIZE 257 -#define IPSTATE_MAX 2048 /* Maximum number of states held */ +#define IPSTATE_SIZE 5737 +#define IPSTATE_MAX 4013 /* Maximum number of states held */ #define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\ (((s1) == (d2)) && ((d1) == (s2)))) diff --git a/contrib/ipfilter/ipf.c b/contrib/ipfilter/ipf.c index ac975e5..a1a0bfc 100644 --- a/contrib/ipfilter/ipf.c +++ b/contrib/ipfilter/ipf.c @@ -43,7 +43,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10 2000/03/13 22:10:23 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.1 2000/07/08 02:19:46 darrenr Exp $"; #endif #if SOLARIS @@ -295,9 +295,10 @@ char *name, *file; if ((opts & OPT_ZERORULEST) && !(opts & OPT_DONOTHING)) { - if (ioctl(fd, add, &fr) == -1) + if (ioctl(fd, add, &fr) == -1) { + fprintf(stderr, "%d:", linenum); perror("ioctl(SIOCZRLST)"); - else { + } else { #ifdef USE_QUAD_T printf("hits %qd bytes %qd ", (long long)fr->fr_hits, @@ -310,11 +311,15 @@ char *name, *file; } } else if ((opts & OPT_REMOVE) && !(opts & OPT_DONOTHING)) { - if (ioctl(fd, del, &fr) == -1) + if (ioctl(fd, del, &fr) == -1) { + fprintf(stderr, "%d:", linenum); perror("ioctl(delete rule)"); + } } else if (!(opts & OPT_DONOTHING)) { - if (ioctl(fd, add, &fr) == -1) + if (ioctl(fd, add, &fr) == -1) { + fprintf(stderr, "%d:", linenum); perror("ioctl(add/insert rule)"); + } } } } @@ -339,7 +344,7 @@ FILE *file; int s, len; do { - for (p = str, s = size;; p += len, s -= len) { + for (p = str, s = size;; p += (len - 1), s -= (len - 1)) { /* * if an error occured, EOF was encounterd, or there * was no room to put NUL, return NULL. @@ -347,12 +352,21 @@ FILE *file; if (fgets(p, s, file) == NULL) return (NULL); len = strlen(p); + if (p[len - 1] != '\n') { + p[len] = '\0'; + break; + } p[len - 1] = '\0'; - if (p[len - 1] != '\\') + if (len < 2 || p[len - 2] != '\\') break; - size -= len; + else + /* + * Convert '\\' to a space so words don't + * run together + */ + p[len - 2] = ' '; } - } while (*str == '\0' || *str == '\n'); + } while (*str == '\0'); return (str); } diff --git a/contrib/ipfilter/ipl.h b/contrib/ipfilter/ipl.h index 12d866c..bb2523d 100644 --- a/contrib/ipfilter/ipl.h +++ b/contrib/ipfilter/ipl.h @@ -6,12 +6,12 @@ * to the original author and the contributors. * * @(#)ipl.h 1.21 6/5/96 - * $Id: ipl.h,v 2.15.2.5 2000/05/22 10:26:16 darrenr Exp $ + * $Id: ipl.h,v 2.15.2.9 2000/07/19 13:40:04 darrenr Exp $ */ #ifndef __IPL_H__ #define __IPL_H__ -#define IPL_VERSION "IP Filter: v3.4.4" +#define IPL_VERSION "IP Filter: v3.4.8" #endif diff --git a/contrib/ipfilter/ipmon.c b/contrib/ipfilter/ipmon.c index 593c665..858c40c 100644 --- a/contrib/ipfilter/ipmon.c +++ b/contrib/ipfilter/ipmon.c @@ -7,7 +7,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.2 2000/07/15 14:50:06 darrenr Exp $"; #endif #ifndef SOLARIS @@ -209,11 +209,11 @@ static void init_tabs() if (s->s_proto == NULL) continue; else if (!strcmp(s->s_proto, "tcp")) { - port = s->s_port; + port = ntohs(s->s_port); name = s->s_name; tab = tcp_ports; } else if (!strcmp(s->s_proto, "udp")) { - port = s->s_port; + port = ntohs(s->s_port); name = s->s_name; tab = udp_ports; } else @@ -401,6 +401,10 @@ int blen; strcpy(t, "NAT:RDR "); else if (nl->nl_type == NL_EXPIRE) strcpy(t, "NAT:EXPIRE "); + else if (nl->nl_type == NL_NEWBIMAP) + strcpy(t, "NAT:BIMAP "); + else if (nl->nl_type == NL_NEWBLOCK) + strcpy(t, "NAT:MAPBLOCK "); else sprintf(t, "Type: %d ", nl->nl_type); t += strlen(t); diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8 index d1f2c3c..11149afdf 100644 --- a/contrib/ipfilter/man/ipfstat.8 +++ b/contrib/ipfilter/man/ipfstat.8 @@ -99,8 +99,10 @@ protocol number. If this option is not specified, state entries for any protocol are specified. .TP .B \-s -Show packet/flow state information (statistics) and held state information (in -the kernel) if any is present. +Show packet/flow state information (statistics only). +.TP +.B \-sl +Show held state information (in the kernel) if any is present (no statistics). .TP .BR \-S \0<addrport> This option is only valid in combination with \fB\-t\fP. Limit the state top diff --git a/contrib/ipfilter/natparse.c b/contrib/ipfilter/natparse.c index 1069dbd..9655615 100644 --- a/contrib/ipfilter/natparse.c +++ b/contrib/ipfilter/natparse.c @@ -54,7 +54,7 @@ extern char *sys_errlist[]; #if !defined(lint) static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed"; -static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.1 2000/04/28 18:08:00 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.6 2000/07/08 02:14:40 darrenr Exp $"; #endif @@ -103,25 +103,35 @@ void *ptr; printf(" %s ", np->in_ifname); if (np->in_flags & IPN_FILTER) { + if (np->in_flags & IPN_NOTSRC) + printf("! "); printf("from "); - if (np->in_redir == NAT_REDIRECT) + if (np->in_redir == NAT_REDIRECT) { printhostmask(4, (u_32_t *)&np->in_srcip, (u_32_t *)&np->in_srcmsk); - else + if (np->in_scmp) + printportcmp(np->in_p, &np->in_tuc.ftu_src); + } else { printhostmask(4, (u_32_t *)&np->in_inip, (u_32_t *)&np->in_inmsk); - if (np->in_scmp) - printportcmp(np->in_p, &np->in_tuc.ftu_src); + if (np->in_dcmp) + printportcmp(np->in_p, &np->in_tuc.ftu_dst); + } + if (np->in_flags & IPN_NOTDST) + printf(" !"); printf(" to "); - if (np->in_redir == NAT_REDIRECT) - printhostmask(4, (u_32_t *)&np->in_inip, - (u_32_t *)&np->in_inmsk); - else + if (np->in_redir == NAT_REDIRECT) { + printhostmask(4, (u_32_t *)&np->in_outip, + (u_32_t *)&np->in_outmsk); + if (np->in_dcmp) + printportcmp(np->in_p, &np->in_tuc.ftu_dst); + } else { printhostmask(4, (u_32_t *)&np->in_srcip, (u_32_t *)&np->in_srcmsk); - if (np->in_dcmp) - printportcmp(np->in_p, &np->in_tuc.ftu_dst); + if (np->in_scmp) + printportcmp(np->in_p, &np->in_tuc.ftu_src); + } } if (np->in_redir == NAT_REDIRECT) { @@ -132,12 +142,12 @@ void *ptr; printf("/%d ", bits); else printf("/%s ", inet_ntoa(np->in_out[1])); + if (np->in_pmin) + printf("port %d", ntohs(np->in_pmin)); + if (np->in_pmax != np->in_pmin) + printf("- %d", ntohs(np->in_pmax)); } - if (np->in_pmin) - printf("port %d ", ntohs(np->in_pmin)); - if (np->in_pmax != np->in_pmin) - printf("- %d ", ntohs(np->in_pmax)); - printf("-> %s", inet_ntoa(np->in_in[0])); + printf(" -> %s", inet_ntoa(np->in_in[0])); if (np->in_flags & IPN_SPLIT) printf(",%s", inet_ntoa(np->in_in[1])); if (np->in_pnext) @@ -312,7 +322,27 @@ int linenum; ipn.in_ifname[sizeof(ipn.in_ifname) - 1] = '\0'; cpp++; - if (!strcasecmp(*cpp, "from")) { + if (!strcasecmp(*cpp, "from") || (**cpp == '!')) { + if (!strcmp(*cpp, "!")) { + cpp++; + if (strcasecmp(*cpp, "from")) { + fprintf(stderr, "Missing from after !\n"); + return NULL; + } + ipn.in_flags |= IPN_NOTSRC; + } else if (**cpp == '!') { + if (strcasecmp(*cpp + 1, "from")) { + fprintf(stderr, "Missing from after !\n"); + return NULL; + } + ipn.in_flags |= IPN_NOTSRC; + } + if ((ipn.in_flags & IPN_NOTSRC) && + (ipn.in_redir & (NAT_MAP|NAT_MAPBLK))) { + fprintf(stderr, "Cannot use '! from' with map\n"); + return NULL; + } + ipn.in_flags |= IPN_FILTER; cpp++; if (ipn.in_redir == NAT_REDIRECT) { @@ -325,34 +355,48 @@ int linenum; } else { if (hostmask(&cpp, (u_32_t *)&ipn.in_inip, (u_32_t *)&ipn.in_inmsk, - &ipn.in_dport, &ipn.in_dcmp, - &ipn.in_dtop, linenum)) { + &ipn.in_sport, &ipn.in_scmp, + &ipn.in_stop, linenum)) { return NULL; } } + if (!strcmp(*cpp, "!")) { + cpp++; + ipn.in_flags |= IPN_NOTDST; + } else if (**cpp == '!') { + (*cpp)++; + ipn.in_flags |= IPN_NOTDST; + } + if (strcasecmp(*cpp, "to")) { fprintf(stderr, "%d: unexpected keyword (%s) - to\n", linenum, *cpp); return NULL; } + if ((ipn.in_flags & IPN_NOTDST) && + (ipn.in_redir & (NAT_REDIRECT))) { + fprintf(stderr, "Cannot use '! to' with rdr\n"); + return NULL; + } if (!*++cpp) { fprintf(stderr, "%d: missing host after to\n", linenum); return NULL; } if (ipn.in_redir == NAT_REDIRECT) { - if (hostmask(&cpp, (u_32_t *)&ipn.in_inip, - (u_32_t *)&ipn.in_inmsk, + if (hostmask(&cpp, (u_32_t *)&ipn.in_outip, + (u_32_t *)&ipn.in_outmsk, &ipn.in_dport, &ipn.in_dcmp, &ipn.in_dtop, linenum)) { return NULL; } + ipn.in_pmin = htons(ipn.in_dport); } else { if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip, (u_32_t *)&ipn.in_srcmsk, - &ipn.in_sport, &ipn.in_scmp, - &ipn.in_stop, linenum)) { + &ipn.in_dport, &ipn.in_dcmp, + &ipn.in_dtop, linenum)) { return NULL; } } @@ -673,8 +717,11 @@ int linenum; return NULL; } cpp++; - if (!*cpp) + if (!*cpp) { + fprintf(stderr, "%d: missing expression following portmap\n", + linenum); return NULL; + } if (!strcasecmp(*cpp, "tcp")) ipn.in_flags |= IPN_TCP; @@ -741,7 +788,7 @@ int opts; fp = stdin; while (fgets(line, sizeof(line) - 1, fp)) { - linenum++; + linenum++; line[sizeof(line) - 1] = '\0'; if ((s = strchr(line, '\n'))) *s = '\0'; @@ -755,10 +802,15 @@ int opts; printnat(np, opts, NULL); if (!(opts & OPT_NODO)) { if (!(opts & OPT_REMOVE)) { - if (ioctl(fd, SIOCADNAT, &np) == -1) + if (ioctl(fd, SIOCADNAT, &np) == -1) { + fprintf(stderr, "%d:", + linenum); perror("ioctl(SIOCADNAT)"); - } else if (ioctl(fd, SIOCRMNAT, &np) == -1) + } + } else if (ioctl(fd, SIOCRMNAT, &np) == -1) { + fprintf(stderr, "%d:", linenum); perror("ioctl(SIOCRMNAT)"); + } } } } diff --git a/contrib/ipfilter/parse.c b/contrib/ipfilter/parse.c index 0f05c15..ab1e08c 100644 --- a/contrib/ipfilter/parse.c +++ b/contrib/ipfilter/parse.c @@ -939,14 +939,20 @@ int linenum; linenum, **cp); return -1; } - fp->fr_icmp |= (u_short)i; - fp->fr_icmpm = (u_short)0xffff; - (*cp)++; - return 0; + } else { + i = icmpcode(**cp); + if (i == -1) { + fprintf(stderr, + "%d: Invalid icmp code (%s) specified\n", + linenum, **cp); + return -1; + } } - fprintf(stderr, "%d: Invalid icmp code (%s) specified\n", - linenum, **cp); - return -1; + i &= 0xff; + fp->fr_icmp |= (u_short)i; + fp->fr_icmpm = (u_short)0xffff; + (*cp)++; + return 0; } @@ -966,9 +972,8 @@ char *str; char *s; int i, len; - if (!(s = strrchr(str, ')'))) - return -1; - *s = '\0'; + if ((s = strrchr(str, ')'))) + *s = '\0'; if (isdigit(*str)) { if (!ratoi(str, &i, 0, 255)) return -1; @@ -1153,7 +1158,7 @@ struct frentry *fp; printf(" icmp-type %s", icmptypes[type]); else printf(" icmp-type %d", type); - if (code) + if (ntohs(fp->fr_icmpm) & 0xff) printf(" code %d", code); } if (fp->fr_proto == IPPROTO_TCP && (fp->fr_tcpf || fp->fr_tcpfm)) { diff --git a/contrib/ipfilter/solaris.c b/contrib/ipfilter/solaris.c index 5187bca..ce25337 100644 --- a/contrib/ipfilter/solaris.c +++ b/contrib/ipfilter/solaris.c @@ -6,7 +6,7 @@ * to the original author and the contributors. */ /* #pragma ident "@(#)solaris.c 1.12 6/5/96 (C) 1995 Darren Reed"*/ -#pragma ident "@(#)$Id: solaris.c,v 2.15.2.3 2000/05/22 10:26:17 darrenr Exp $" +#pragma ident "@(#)$Id: solaris.c,v 2.15.2.6 2000/07/18 13:56:33 darrenr Exp $" #include <sys/systm.h> #include <sys/types.h> @@ -625,15 +625,28 @@ tryagain: sap = qif->qf_ill->ill_sap; if (sap == 0x800) { + u_short tlen; + hlen = sizeof(*ip); - plen = ntohs(ip->ip_len); + + /* XXX - might not be aligned (from ppp?) */ + ((char *)&tlen)[0] = ((char *)&ip->ip_len)[0]; + ((char *)&tlen)[1] = ((char *)&ip->ip_len)[1]; + + plen = ntohs(tlen); + sap = 0; } #if SOLARIS2 >= 8 else if (sap == IP6_DL_SAP) { + u_short tlen; + hlen = sizeof(ip6_t); ip6 = (ip6_t *)ip; - plen = ntohs(ip6->ip6_plen); + /* XXX - might not be aligned (from ppp?) */ + ((char *)&tlen)[0] = ((char *)&ip->ip_len)[0]; + ((char *)&tlen)[1] = ((char *)&ip->ip_len)[1]; + plen = ntohs(tlen); sap = IP6_DL_SAP; } #endif @@ -670,7 +683,7 @@ fixalign: s = m->b_rptr; } *mp = m2; - MTYPE(m2) = M_DATA; + MTYPE(m2) = MTYPE(mt); freemsg(mt); mt = m2; @@ -678,7 +691,6 @@ fixalign: synced = 1; off = 0; goto tryagain; - } if (((sap == 0) && (ip->ip_v != IP_VERSION)) @@ -1590,8 +1602,7 @@ ire_t *ire; #endif -int ipfr_fastroute(qf, ip, mb, mpp, fin, fdp) -qif_t *qf; +int ipfr_fastroute(ip, mb, mpp, fin, fdp) ip_t *ip; mblk_t *mb, **mpp; fr_info_t *fin; @@ -1608,13 +1619,15 @@ frdest_t *fdp; frentry_t *fr; frdest_t fd; ill_t *ifp; - qif_t *qif; u_char *s; + qif_t *qf; int p; #ifndef sparc u_short __iplen, __ipoff; #endif + qf = fin->fin_qif; + /* * If this is a duplicate mblk then we want ip to point at that * data, not the original, if and only if it is already pointing at @@ -1718,10 +1731,9 @@ frdest_t *fdp; ATOMIC_INCL(frstats[1].fr_acct); } fin->fin_fr = NULL; - if (!fr || !(fr->fr_flags & FR_RETMASK)) { + if (!fr || !(fr->fr_flags & FR_RETMASK)) (void) fr_checkstate(ip, fin); - (void) ip_natout(ip, fin); - } + (void) ip_natout(ip, fin); } #ifndef sparc if (fin->fin_v == 4) { diff --git a/contrib/ipfilter/test/Makefile b/contrib/ipfilter/test/Makefile index a6d73ef..0726cdd 100644 --- a/contrib/ipfilter/test/Makefile +++ b/contrib/ipfilter/test/Makefile @@ -20,7 +20,7 @@ ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 # Rule parsing tests ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 -ntests: n1 n2 n3 n4 +ntests: n1 n2 n3 n4 n5 n6 n7 0: @(cd ..; make ipftest; ) @@ -34,10 +34,10 @@ f12: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11: @/bin/sh ./itest $@ -n1 n2 n3 n4: +n1 n2 n3 n4 n5 n6 n7: @/bin/sh ./nattest $@ clean: /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 results/* /bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 - /bin/rm -f n1 n2 n3 n4 + /bin/rm -f n1 n2 n3 n4 n5 n6 n7 diff --git a/contrib/ipfilter/test/expected/n5 b/contrib/ipfilter/test/expected/n5 new file mode 100644 index 0000000..75f174b --- /dev/null +++ b/contrib/ipfilter/test/expected/n5 @@ -0,0 +1,330 @@ +ip 20(20) 255 10.1.1.0 > 10.1.1.2 +ip 20(20) 255 10.2.2.2 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.3.4.5 +ip 20(20) 255 10.1.1.2 > 10.3.4.5 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,1025 +ip 48(20) 1 10.2.2.2 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.1.1.1 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.1.1.2 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.1.1.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.1.1.3 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.1.1.3 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.2.2.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.2.2.2,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.0 > 10.1.1.2 +ip 20(20) 0 10.2.2.2 > 10.1.2.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 28(20) 17 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.3,2000 > 10.1.2.1,80 +ip 40(20) 6 10.1.1.3,2001 > 10.1.3.1,80 +ip 40(20) 6 10.1.1.3,2002 > 10.1.4.1,80 +ip 40(20) 6 10.1.1.3,2003 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.2.2.2,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.2.2.2,1025 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- +ip 20(20) 255 10.3.4.5 > 10.1.1.2 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.3.4.5 > 10.1.1.1 +ip 40(20) 6 10.3.4.5,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,1026 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.2.2.2 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.0 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 48(20) 1 10.1.1.1 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.2.2.2 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.1.1.2 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.1.1.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.1.1.3 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.1.1.3 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.3.4.5 > 10.1.1.2 +ip 20(20) 0 10.3.4.5 > 10.1.2.1 +ip 40(20) 6 10.3.4.5,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,1026 > 10.1.1.1,1025 +ip 28(20) 17 10.3.4.5,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,2000 > 10.1.2.1,80 +ip 40(20) 6 10.3.4.5,2001 > 10.1.3.1,80 +ip 40(20) 6 10.3.4.5,2002 > 10.1.4.1,80 +ip 40(20) 6 10.3.4.5,2003 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- +ip 20(20) 255 10.1.1.0 > 10.1.1.2 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.2.2.2 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.3.4.5 +ip 20(20) 255 10.1.1.2 > 10.3.4.5 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,1025 +ip 48(20) 1 10.3.4.1 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.2.2.2 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.3.4.1 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.3.4.1 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.3.4.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.3.4.2 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.0 > 10.1.1.2 +ip 20(20) 0 10.1.1.1 > 10.1.2.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 28(20) 17 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.3,2000 > 10.1.2.1,80 +ip 40(20) 6 10.1.1.3,2001 > 10.1.3.1,80 +ip 40(20) 6 10.1.1.3,2002 > 10.1.4.1,80 +ip 40(20) 6 10.1.1.3,2003 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.3.4.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.3.4.1,1025 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 28(20) 17 10.3.4.1,1025 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- +ip 20(20) 255 10.1.1.0 > 10.1.1.2 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.2.2.2 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.3.4.5 +ip 20(20) 255 10.1.1.2 > 10.3.4.5 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,1025 +ip 48(20) 1 10.1.1.1 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.2.2.2 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.1.1.2 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.1.1.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.1.1.3 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.1.1.3 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.0 > 10.1.1.2 +ip 20(20) 0 10.1.1.1 > 10.1.2.1 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.2,1026 > 10.1.1.1,1025 +ip 28(20) 17 10.3.4.5,10000 > 10.1.1.1,1025 +ip 40(20) 6 10.1.1.3,2000 > 10.1.2.1,80 +ip 40(20) 6 10.1.1.3,2001 > 10.1.3.1,80 +ip 40(20) 6 10.1.1.3,2002 > 10.1.4.1,80 +ip 40(20) 6 10.1.1.3,2003 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 28(20) 17 10.3.4.5,10001 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- +ip 20(20) 255 10.1.1.0 > 10.1.1.2 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.3.4.1,10000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.1,10001 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.2.2.2 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.3.4.5 +ip 20(20) 255 10.1.1.2 > 10.3.4.5 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,1025 +ip 48(20) 1 10.1.1.1 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.2.2.2 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.1.1.2 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.1.1.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.1.1.3 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.1.1.3 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.3.4.1,10002 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.1,10003 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.0 > 10.1.1.2 +ip 20(20) 0 10.1.1.1 > 10.1.2.1 +ip 40(20) 6 10.3.4.1,10000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.1,10000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.1,10001 > 10.1.1.1,1025 +ip 28(20) 17 10.3.4.1,10004 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.1,10005 > 10.1.2.1,80 +ip 40(20) 6 10.3.4.1,10006 > 10.1.3.1,80 +ip 40(20) 6 10.3.4.1,10007 > 10.1.4.1,80 +ip 40(20) 6 10.3.4.1,10008 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.3.4.1,10009 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.3.4.1,10010 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,40000 +ip 28(20) 17 10.3.4.1,10011 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.3.4.1,10012 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- +ip 20(20) 255 10.1.1.0 > 10.1.1.2 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.3.4.5,40000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,40001 > 10.1.1.1,1025 +ip 20(20) 255 10.2.2.1 > 10.1.2.1 +ip 20(20) 255 10.2.2.2 > 10.1.2.1 +ip 20(20) 255 10.1.1.1 > 10.1.1.2 +ip 20(20) 255 10.1.1.2 > 10.1.1.1 +ip 20(20) 255 10.2.2.1 > 10.2.1.1 +ip 20(20) 255 10.2.2.2 > 10.2.1.1 +ip 20(20) 255 10.2.2.3 > 10.1.1.1 +ip 20(20) 255 10.2.3.4 > 10.2.2.2 +ip 20(20) 255 10.1.1.1 > 10.2.2.2 +ip 20(20) 255 10.1.1.2 > 10.2.2.2 +ip 20(20) 255 10.1.1.0 > 10.3.4.5 +ip 20(20) 255 10.1.1.1 > 10.3.4.5 +ip 20(20) 255 10.1.1.2 > 10.3.4.5 +ip 40(20) 6 10.1.1.1,1025 > 10.3.4.5,1025 +ip 48(20) 1 10.1.1.1 > 10.4.3.2 +ip 48(20) 1 10.4.3.2 > 10.2.2.2 +ip 48(20) 1 10.4.3.2 > 10.3.4.3 +ip 48(20) 1 10.4.3.2 > 10.3.4.5 +ip 20(20) 34 10.1.1.2 > 10.4.3.2 +ip 20(20) 34 10.4.3.2 > 10.3.4.4 +ip 20(20) 34 10.1.1.2 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.5 +ip 20(20) 34 10.1.1.3 > 10.4.3.4 +ip 20(20) 34 10.4.3.4 > 10.3.4.6 +ip 20(20) 35 10.1.1.3 > 10.4.3.4 +ip 20(20) 35 10.4.3.4 > 10.3.4.7 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,40000 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.0 > 10.1.1.2 +ip 20(20) 0 10.1.1.1 > 10.1.2.1 +ip 40(20) 6 10.3.4.5,40000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,40000 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,40001 > 10.1.1.1,1025 +ip 28(20) 17 10.3.4.5,40001 > 10.1.1.1,1025 +ip 40(20) 6 10.3.4.5,40000 > 10.1.2.1,80 +ip 40(20) 6 10.3.4.5,40001 > 10.1.3.1,80 +ip 40(20) 6 10.3.4.5,40000 > 10.1.4.1,80 +ip 40(20) 6 10.3.4.5,40001 > 10.1.4.1,80 +ip 20(20) 0 10.1.1.1 > 10.1.1.2 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 20(20) 0 10.1.1.2 > 10.1.1.1 +ip 40(20) 6 10.3.4.5,40000 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1026 > 10.3.4.5,40000 +ip 40(20) 6 10.3.4.5,40001 > 10.3.4.5,40000 +ip 40(20) 6 10.1.1.1,1025 > 10.1.1.2,1025 +ip 28(20) 17 10.3.4.5,40000 > 10.3.4.5,40001 +ip 28(20) 17 10.1.1.2,1025 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +ip 40(20) 6 10.1.2.1,80 > 10.3.4.5,40001 +------------------------------- diff --git a/contrib/ipfilter/test/expected/n6 b/contrib/ipfilter/test/expected/n6 new file mode 100644 index 0000000..d28d4f1 --- /dev/null +++ b/contrib/ipfilter/test/expected/n6 @@ -0,0 +1,70 @@ +ip 40(20) 6 10.2.2.2,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.1.2.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.2,23 +ip 40(20) 6 10.3.3.3,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.0.0,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.0.0,23 +ip 28(20) 17 10.2.2.2,12345 > 10.1.1.0,53 +ip 28(20) 17 10.3.3.3,12345 > 10.1.1.0,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.0,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.0,53 +------------------------------- +ip 40(20) 6 10.2.2.2,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.3.0.1,12345 > 10.1.2.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.2,23 +ip 40(20) 6 10.3.3.3,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.0.0,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.0.0,23 +ip 28(20) 17 10.2.2.2,12345 > 10.1.1.0,53 +ip 28(20) 17 10.3.3.3,12345 > 10.1.1.0,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.0,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.0,53 +------------------------------- +ip 40(20) 6 10.2.2.2,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.3.0.1,12345 > 10.1.2.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.2,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,23 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.0.0,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.0.0,23 +ip 28(20) 17 10.2.2.2,12345 > 10.1.1.0,53 +ip 28(20) 17 10.3.3.3,12345 > 10.1.1.0,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.0,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.0,53 +------------------------------- +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,23 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.2,23 +ip 40(20) 6 10.3.3.3,12345 > 10.2.2.1,10023 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.0.0,23 +ip 40(20) 6 10.3.3.3,12345 > 10.2.2.1,10023 +ip 28(20) 17 10.2.2.2,12345 > 10.1.1.0,53 +ip 28(20) 17 10.3.3.3,12345 > 10.1.1.0,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.0,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.0,53 +------------------------------- +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,23 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.1.2.2,23 +ip 40(20) 6 10.3.0.1,12345 > 10.2.2.2,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,23 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.1,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.1,53 +ip 40(20) 6 10.2.2.2,12345 > 10.1.0.0,23 +ip 40(20) 6 10.3.3.3,12345 > 10.1.0.0,23 +ip 28(20) 17 10.2.2.2,12345 > 10.1.1.0,53 +ip 28(20) 17 10.3.3.3,12345 > 10.2.2.1,10053 +ip 40(20) 6 10.2.2.2,12345 > 10.1.1.0,53 +ip 40(20) 6 10.3.3.3,12345 > 10.1.1.0,53 +------------------------------- diff --git a/contrib/ipfilter/test/expected/n7 b/contrib/ipfilter/test/expected/n7 new file mode 100644 index 0000000..51aa987 --- /dev/null +++ b/contrib/ipfilter/test/expected/n7 @@ -0,0 +1,20 @@ +ip 40(20) 6 10.2.3.1,1230 > 10.1.1.1,22 +ip 40(20) 6 10.2.3.1,1231 > 10.2.2.1,10023 +ip 40(20) 6 10.2.3.1,1232 > 10.2.2.1,10050 +ip 40(20) 6 10.2.3.1,1233 > 10.2.2.1,10079 +ip 40(20) 6 10.2.3.1,1234 > 10.1.1.1,80 +ip 40(20) 6 10.2.3.1,1235 > 10.1.1.2,80 +ip 40(20) 6 10.2.3.1,1236 > 10.1.1.3,80 +ip 40(20) 6 10.2.3.1,1237 > 10.1.1.4,80 +ip 40(20) 6 10.2.3.1,1238 > 10.1.1.4,80 +------------------------------- +ip 40(20) 6 10.2.3.1,1230 > 10.1.1.1,22 +ip 40(20) 6 10.2.3.1,1231 > 10.1.1.1,23 +ip 40(20) 6 10.2.3.1,1232 > 10.1.1.1,50 +ip 40(20) 6 10.2.3.1,1233 > 10.1.1.1,79 +ip 40(20) 6 10.2.3.1,1234 > 10.2.2.1,3128 +ip 40(20) 6 10.2.3.1,1235 > 1.2.2.129,3128 +ip 40(20) 6 10.2.3.1,1236 > 10.2.2.1,3128 +ip 40(20) 6 10.2.3.1,1237 > 1.2.2.129,3128 +ip 40(20) 6 10.2.3.1,1238 > 10.2.2.1,3128 +------------------------------- diff --git a/contrib/ipfilter/test/input/n5 b/contrib/ipfilter/test/input/n5 new file mode 100644 index 0000000..579210b --- /dev/null +++ b/contrib/ipfilter/test/input/n5 @@ -0,0 +1,54 @@ +out on zx0 255 10.1.1.0 10.1.1.2 +out on zx0 255 10.1.1.1 10.1.1.2 +out on zx0 255 10.1.1.2 10.1.1.1 +out on zx0 tcp 10.1.1.2,1025 10.1.1.1,1025 +out on zx0 tcp 10.1.1.2,1026 10.1.1.1,1025 +out on zx0 255 10.2.2.1 10.1.2.1 +out on zx0 255 10.2.2.2 10.1.2.1 +in on zx0 255 10.1.1.1 10.1.1.2 +in on zx0 255 10.1.1.2 10.1.1.1 +in on zx0 255 10.2.2.1 10.2.1.1 +in on zx0 255 10.2.2.2 10.2.1.1 +in on zx0 255 10.2.2.3 10.1.1.1 +in on zx0 255 10.2.3.4 10.2.2.2 +in on zx0 255 10.1.1.1 10.2.2.2 +in on zx0 255 10.1.1.2 10.2.2.2 +in on zx0 255 10.1.1.0 10.3.4.5 +in on zx0 255 10.1.1.1 10.3.4.5 +in on zx0 255 10.1.1.2 10.3.4.5 +in on zx0 tcp 10.1.1.1,1025 10.3.4.5,1025 +out on zx0 icmp 10.1.1.1 10.4.3.2 +in on zx0 icmp 10.4.3.2 10.2.2.2 +in on zx0 icmp 10.4.3.2 10.3.4.3 +in on zx0 icmp 10.4.3.2 10.3.4.5 +out on zx0 34 10.1.1.2 10.4.3.2 +in on zx0 34 10.4.3.2 10.3.4.4 +out on zx0 34 10.1.1.2 10.4.3.4 +in on zx0 34 10.4.3.4 10.3.4.5 +out on zx0 34 10.1.1.3 10.4.3.4 +in on zx0 34 10.4.3.4 10.3.4.6 +out on zx0 35 10.1.1.3 10.4.3.4 +in on zx0 35 10.4.3.4 10.3.4.7 +out on zx0 tcp 10.1.1.1,1025 10.1.1.1,1025 +out on zx0 tcp 10.1.1.1,1025 10.1.1.2,1025 +out on zx0 10.1.1.0 10.1.1.2 +out on zx0 10.1.1.1 10.1.2.1 +out on zx0 tcp 10.1.1.2,1025 10.1.1.1,1025 +out on zx0 tcp 10.1.1.2,1025 10.1.1.1,1025 +out on zx0 tcp 10.1.1.2,1026 10.1.1.1,1025 +out on zx0 udp 10.1.1.2,1025 10.1.1.1,1025 +out on zx0 tcp 10.1.1.3,2000 10.1.2.1,80 +out on zx0 tcp 10.1.1.3,2001 10.1.3.1,80 +out on zx0 tcp 10.1.1.3,2002 10.1.4.1,80 +out on zx0 tcp 10.1.1.3,2003 10.1.4.1,80 +in on zx0 10.1.1.1 10.1.1.2 +in on zx0 tcp 10.1.1.1,1025 10.1.1.2,1025 +in on zx0 10.1.1.2 10.1.1.1 +out on zx0 tcp 10.1.1.1,1026 10.3.4.5,40000 +in on zx0 tcp 10.1.1.1,1026 10.3.4.5,40000 +out on zx0 tcp 10.1.1.1,1025 10.3.4.5,40000 +in on zx0 tcp 10.1.1.1,1025 10.3.4.5,40000 +out on zx0 udp 10.1.1.2,1025 10.3.4.5,40001 +in on zx0 udp 10.1.1.2,1025 10.3.4.5,40001 +out on zx0 tcp 10.1.2.1,80 10.3.4.5,40001 +in on zx0 tcp 10.1.2.1,80 10.3.4.5,40001 diff --git a/contrib/ipfilter/test/input/n6 b/contrib/ipfilter/test/input/n6 new file mode 100644 index 0000000..8a0c924 --- /dev/null +++ b/contrib/ipfilter/test/input/n6 @@ -0,0 +1,13 @@ +in on zx0 tcp 10.2.2.2,12345 10.1.1.1,23 +in on zx0 tcp 10.2.2.2,12345 10.1.1.2,23 +in on zx0 tcp 10.3.0.1,12345 10.1.2.2,23 +in on zx0 tcp 10.3.0.1,12345 10.2.2.2,23 +in on zx0 tcp 10.3.3.3,12345 10.1.1.1,23 +in on zx0 tcp 10.2.2.2,12345 10.1.1.1,53 +in on zx0 tcp 10.3.3.3,12345 10.1.1.1,53 +in on zx0 tcp 10.2.2.2,12345 10.1.0.0,23 +in on zx0 tcp 10.3.3.3,12345 10.1.0.0,23 +in on zx0 udp 10.2.2.2,12345 10.1.1.0,53 +in on zx0 udp 10.3.3.3,12345 10.1.1.0,53 +in on zx0 tcp 10.2.2.2,12345 10.1.1.0,53 +in on zx0 tcp 10.3.3.3,12345 10.1.1.0,53 diff --git a/contrib/ipfilter/test/input/n7 b/contrib/ipfilter/test/input/n7 new file mode 100644 index 0000000..79af901 --- /dev/null +++ b/contrib/ipfilter/test/input/n7 @@ -0,0 +1,9 @@ +in on zx0 tcp 10.2.3.1,1230 10.1.1.1,22 +in on zx0 tcp 10.2.3.1,1231 10.1.1.1,23 +in on zx0 tcp 10.2.3.1,1232 10.1.1.1,50 +in on zx0 tcp 10.2.3.1,1233 10.1.1.1,79 +in on zx0 tcp 10.2.3.1,1234 10.1.1.1,80 +in on zx0 tcp 10.2.3.1,1235 10.1.1.2,80 +in on zx0 tcp 10.2.3.1,1236 10.1.1.3,80 +in on zx0 tcp 10.2.3.1,1237 10.1.1.4,80 +in on zx0 tcp 10.2.3.1,1238 10.1.1.4,80 diff --git a/contrib/ipfilter/test/regress/n5 b/contrib/ipfilter/test/regress/n5 new file mode 100644 index 0000000..e55cea0 --- /dev/null +++ b/contrib/ipfilter/test/regress/n5 @@ -0,0 +1,6 @@ +map zx0 10.1.1.1/32 -> 10.2.2.2/32 +map zx0 from 10.1.1.0/24 to 10.1.0.0/16 -> 10.3.4.5/32 +map zx0 from 10.1.1.0/24 ! to 10.1.0.0/16 -> 10.3.4.0/24 +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap udp 10000:20000 +map zx0 10.1.0.0/16 -> 10.3.4.0/24 portmap tcp/udp 10000:20000 +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap tcp/udp 40000:40001 diff --git a/contrib/ipfilter/test/regress/n6 b/contrib/ipfilter/test/regress/n6 new file mode 100644 index 0000000..79f11a4 --- /dev/null +++ b/contrib/ipfilter/test/regress/n6 @@ -0,0 +1,5 @@ +rdr zx0 10.1.1.1/32 port 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from any to 10.1.1.0/24 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from 10.2.0.0/16 to 10.1.1.0/24 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from 10.3.0.0/16 to 10.1.0.0/16 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 ! from 10.2.0.0/16 to 10.1.1.0/24 port = 53 -> 10.2.2.1 port 10053 udp diff --git a/contrib/ipfilter/test/regress/n7 b/contrib/ipfilter/test/regress/n7 new file mode 100644 index 0000000..4abde53 --- /dev/null +++ b/contrib/ipfilter/test/regress/n7 @@ -0,0 +1,2 @@ +rdr zx0 10.1.1.1/32 port 23-79 -> 10.2.2.1 port 10023 tcp +rdr zx0 10.1.1.0/24 port 80 -> 10.2.2.1,1.2.2.129 port 3128 tcp |
