diff options
93 files changed, 1972 insertions, 1091 deletions
diff --git a/contrib/ipfilter/BNF b/contrib/ipfilter/BNF index 556171d..ac2381b 100644 --- a/contrib/ipfilter/BNF +++ b/contrib/ipfilter/BNF @@ -17,7 +17,7 @@ log = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] . call = "call" [ "now" ] function-name . skip = "skip" decnumber . dup = "dup-to" interface-name[":"ipaddr] . -froute = "fastroute" | "to" interface-name . +froute = "fastroute" | "to" interface-name [ ":" ipaddr ] . protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber . srcdst = "all" | fromto . fromto = "from" object "to" object . diff --git a/contrib/ipfilter/HISTORY b/contrib/ipfilter/HISTORY index 0249367..584f4f2 100644 --- a/contrib/ipfilter/HISTORY +++ b/contrib/ipfilter/HISTORY @@ -22,6 +22,121 @@ # and especially those who have found the time to port IP Filter to new # platforms. # +3.4.20 24/07/2001 - Released + +adjust NAT hashing to give a better spread across the table + +show icmp code/type names in output, where known + +fix bug in altering cached interface names in state when resync'ing + +fix bug in real audio proxy that caused crashs + +fix compiling using sunos4 cc + +patch from casper to address weird exit problem for ipstat in top mode + +patch from Greg Woods to produce names for icmp types/unreach codes, +where they are known + +fix bug where ipfr_fastroute() would use a mblk and it would also get +freed later. + +don't match fragments which would cause 64k length to be exceeded + +ftp proxy fix for port numbers being setup for pasv ftp with state/nat + +change hashing for NAT to include both IP#'s and ports. + +Solaris fixes for IPv6 + +fix compiling iplang bits, under Solaris, for ipsend + +3.4.19 29/06/2001 - Released + +fix to support suspend/resume on solaris8 as well as ipv6 + +include group/group-head in match of filter rules + +fix endian problem reading snoop files + +make all licence comments point to the one place + +fix ftp proxy to only advance state if a reply is received in response to +a recognised command + +3.4.18 05/06/2001 - Released + +fix up parsing of "from ! host" where '!' is separate + +disable hardware checksums for NetBSD + +put ipftest temporary files in . rather than /tmp + +modify ftp proxy to be more intelligent about moving between states +and recognise new authentication commands + +allow state/nat table sizes to be externally influenced + +print out host mapping table for NAT with ipnat -l + +fix handling of hardware checksum'ing on Solaris + +fixup makefiles for Solaris + +update regression tests + +fix surrender of SPL's for failure cases + +include patches for OpenBSD's new timeout mechanism + +default ipl_unreach to ICMP_UNREACH_FILTER_PROHIB if defined, else make it +ICMP_UNREACH_FILTER + +fix up handling of packets matching auth rules and interaction with state + +add -q command line option to ipfstat on Solaris to list bound interfaces + +add command line option to ipfstat/ipnat to select different core image + +don't use ncurses on Solaris for STATETOP + +fix includes to get FreeBSD version + +do not byte swap ip_id + +fix handling success for packets matching the auth rule + +don't double-count short packets + +add ICMP router discovery message size recognition + +fix packet length calculation for IPv6 + +set CPUDIR when for install-sunos5 make target + +SUNWspro -xF causes Solaris 2.5.1 kernel to crash + +3.4.17 06/04/2001 - Released + +fix fragment#0 handling bug where they could get in via cache information +created by state table entries + +use ire_walk to look for ire cache entries with link layer headers cached + +deal with bad SPL assumptions for log reading on BSD + +fix ftp proxy to allow logins with passwords + +some auth rule patches, fixing byte endian problems and returning as an error + +support LOG_SECURITY, where available, in ipmon + +don't return an error for packets which match auth rules + +introduce fr_icmpacktimeout to timeout entries once an ICMP reply has +been seen separately to when created + 3.4.16 15/01/2001 - Released fix race condition in flushing of state entries that are timing out diff --git a/contrib/ipfilter/IMPORTANT b/contrib/ipfilter/IMPORTANT index de2cc85..0ef7a3d 100644 --- a/contrib/ipfilter/IMPORTANT +++ b/contrib/ipfilter/IMPORTANT @@ -3,41 +3,6 @@ **************************************** 1) -If you're using this software and have a rule which ends like this: - -flags S - -(for TCP), then to make it totally effective, you need to change it to appear -as follows: - -flags S/SA - -The problem is that the old code would compare all the TCP flags against the -rule (which just has "S") to see if that matched exactly. It is very possible -for this to not be the case and in these cases, the rule would fail to match -a 'valid' TCP SYN packet. - -Why does it need to be "S/SA" and not "S/S" ? - -"S/S" will match the SYN-ACK as well the SYN. - -By defalt, "flags S" will now be converted to "flags S/AUPRFS". - -If you have any queries regarding this, see the examples and ipf(4). -If you still have a query or suggestion, please email me. - - -2) - -If a filter rule used, in combination port comparisons and the flags -keywords, a "short" TCP packet, if not explicitly blocked high up in -the list of packets, would actually get matched even though it would -otherwise not have been (due to the ports not). This behaviour has -subsequently been fixed. - - -3) - If you have BOTH GNU make and the normal make shipped with your system, DO NOT use the GNU make to build this package. diff --git a/contrib/ipfilter/Makefile b/contrib/ipfilter/Makefile index 5770d40..09b5db6 100644 --- a/contrib/ipfilter/Makefile +++ b/contrib/ipfilter/Makefile @@ -1,11 +1,9 @@ # -# Copyright (C) 1993-2000 by Darren Reed. +# Copyright (C) 1993-2001 by Darren Reed. # -# Redistribution and use in source and binary forms are permitted -# provided that this notice is preserved and due credit is given -# to the original author and the contributors. +# See the IPFILTER.LICENCE file for details on licencing. # -# $Id: Makefile,v 2.11.2.6 2000/12/17 12:43:15 darrenr Exp $ +# $Id: Makefile,v 2.11.2.8 2001/06/26 10:43:10 darrenr Exp $ # BINDEST=/usr/local/bin SBINDEST=/sbin @@ -19,6 +17,7 @@ TOP=../.. CFLAGS=-I$$(TOP) CPU=`uname -m` CPUDIR=`uname -s|sed -e 's@/@@g'`-`uname -r`-`uname -m` +IPFILKERN=`/bin/ls -1tr /usr/src/sys/compile | grep -v .bak | tail -1` # # To enable this to work as a Loadable Kernel Module... # @@ -262,7 +261,7 @@ install-sunos4: solaris (cd SunOS4; $(MAKE) "CPU=$(CPU) TOP=.." install) install-sunos5: solaris - (cd SunOS5; $(MAKE) "CPU=$(CPU) TOP=.." install) + (cd SunOS5; $(MAKE) "CPUDIR=`uname -p`-`uname -r`" "CPU=$(CPU) TOP=.." install) install-irix: irix (cd IRIX; smake install "CPU=$(CPU) TOP=.." $(DEST) $(MFLAGS)) diff --git a/contrib/ipfilter/common.c b/contrib/ipfilter/common.c index afcc95c..e46e63e 100644 --- a/contrib/ipfilter/common.c +++ b/contrib/ipfilter/common.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <sys/types.h> #if !defined(__SVR4) && !defined(__svr4__) diff --git a/contrib/ipfilter/etc/services b/contrib/ipfilter/etc/services index 7afcde8..01c4b782 100644 --- a/contrib/ipfilter/etc/services +++ b/contrib/ipfilter/etc/services @@ -2360,6 +2360,7 @@ dpserve 7020/udp # DP Serve dpserveadmin 7021/tcp # DP Serve Admin dpserveadmin 7021/udp # DP Serve Admin arcp 7070/tcp # ARCP +raudio 7070/tcp # Real Audio arcp 7070/udp # ARCP clutild 7174/tcp # Clutild clutild 7174/udp # Clutild diff --git a/contrib/ipfilter/facpri.c b/contrib/ipfilter/facpri.c index f851918..79afdd2 100644 --- a/contrib/ipfilter/facpri.c +++ b/contrib/ipfilter/facpri.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <string.h> @@ -18,8 +16,12 @@ #include <syslog.h> #include "facpri.h" +#ifndef __STDC__ +# define const +#endif + #if !defined(lint) -static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3 2000/03/13 22:10:18 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3.2.4 2001/07/15 22:06:12 darrenr Exp $"; #endif typedef struct table { @@ -55,6 +57,9 @@ table_t facs[] = { #else { "cron2", LOG_CRON2 }, #endif +#ifdef LOG_SECURITY + { "security", LOG_SECURITY }, +#endif { "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 }, { "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 }, { "local4", LOG_LOCAL4 }, { "local5", LOG_LOCAL5 }, diff --git a/contrib/ipfilter/facpri.h b/contrib/ipfilter/facpri.h index b80dbe8..7b80377 100644 --- a/contrib/ipfilter/facpri.h +++ b/contrib/ipfilter/facpri.h @@ -1,10 +1,8 @@ /* - * Copyright (C) 1999-2000 by Darren Reed. + * Copyright (C) 1999-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. - * $Id: facpri.h,v 1.3 2000/03/13 22:10:18 darrenr Exp $ + * See the IPFILTER.LICENCE file for details on licencing. + * $Id: facpri.h,v 1.3.2.1 2001/06/26 10:43:11 darrenr Exp $ */ #ifndef __FACPRI_H__ diff --git a/contrib/ipfilter/fil.c b/contrib/ipfilter/fil.c index 02f075b..c4cd2e0 100644 --- a/contrib/ipfilter/fil.c +++ b/contrib/ipfilter/fil.c @@ -1,15 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $"; -#endif - #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> @@ -100,6 +93,11 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darr #endif #include "netinet/ipl.h" +#if !defined(lint) +static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; +static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $"; +#endif + #ifndef _KERNEL # include "ipf.h" # include "ipt.h" @@ -115,12 +113,6 @@ extern int opts; # if SOLARIS || defined(__sgi) extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat; extern kmutex_t ipf_rw; -# endif -# if SOLARIS -# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \ - ip, qif) -# else /* SOLARIS */ -# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip) # endif /* SOLARIS || __sgi */ #endif /* _KERNEL */ @@ -226,7 +218,7 @@ fr_info_t *fin; if (v == 4) { fin->fin_id = ip->ip_id; fi->fi_tos = ip->ip_tos; - off = (ip->ip_off & IP_OFFMASK) << 3; + off = (ip->ip_off & IP_OFFMASK); tcp = (tcphdr_t *)((char *)ip + hlen); (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4)); fi->fi_src.i6[1] = 0; @@ -239,7 +231,7 @@ fr_info_t *fin; fi->fi_daddr = ip->ip_dst.s_addr; p = ip->ip_p; fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0; - if (ip->ip_off & 0x3fff) + if (ip->ip_off & (IP_MF|IP_OFFMASK)) fi->fi_fl |= FI_FRAG; plen = ip->ip_len; fin->fin_dlen = plen - hlen; @@ -260,6 +252,7 @@ fr_info_t *fin; fi->fi_fl = 0; plen = ntohs(ip6->ip6_plen); fin->fin_dlen = plen; + plen += sizeof(*ip6); } #endif else @@ -268,6 +261,7 @@ fr_info_t *fin; fin->fin_off = off; fin->fin_plen = plen; fin->fin_dp = (void *)tcp; + off <<= 3; switch (p) { @@ -315,25 +309,34 @@ fr_info_t *fin; icmp = (icmphdr_t *)tcp; - if (icmp->icmp_type == ICMP_ECHOREPLY || - icmp->icmp_type == ICMP_ECHO) + switch (icmp->icmp_type) + { + case ICMP_ECHOREPLY : + case ICMP_ECHO : + /* Router discovery messages - RFC 1256 */ + case ICMP_ROUTERADVERT : + case ICMP_ROUTERSOLICIT : minicmpsz = ICMP_MINLEN; - + break; /* * type(1) + code(1) + cksum(2) + id(2) seq(2) + * 3*timestamp(3*4) */ - else if (icmp->icmp_type == ICMP_TSTAMP || - icmp->icmp_type == ICMP_TSTAMPREPLY) + case ICMP_TSTAMP : + case ICMP_TSTAMPREPLY : minicmpsz = 20; - + break; /* * type(1) + code(1) + cksum(2) + id(2) seq(2) + * mask(4) */ - else if (icmp->icmp_type == ICMP_MASKREQ || - icmp->icmp_type == ICMP_MASKREPLY) + case ICMP_MASKREQ : + case ICMP_MASKREPLY : minicmpsz = 12; + break; + default : + break; + } } if ((!(plen >= hlen + minicmpsz) && !off) || @@ -522,7 +525,7 @@ fr_info_t *fin; * satisfy the "short" class too). */ if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) { - if (fin->fin_fi.fi_fl & FI_SHORT) + if (fin->fin_fl & FI_SHORT) return !(ft->ftu_tcpf | ft->ftu_tcpfm); /* * Match the flags ? If not, abort this match. @@ -557,10 +560,7 @@ void *m; fin->fin_fr = NULL; fin->fin_rule = 0; fin->fin_group = 0; - if (fin->fin_v == 4) - off = ip->ip_off & IP_OFFMASK; - else - off = 0; + off = fin->fin_off; pass |= (fi->fi_fl << 24); if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) @@ -787,7 +787,7 @@ int out; mb_t *mc = NULL; # if !defined(__SVR4) && !defined(__svr4__) # ifdef __sgi - char hbuf[(0xf << 2) + sizeof(struct icmp) + sizeof(ip_t) + 8]; + char hbuf[128]; # endif int up; @@ -812,6 +812,9 @@ int out; # ifdef USE_INET6 if (v == 6) { len = ntohs(((ip6_t*)ip)->ip6_plen); + if (!len) + return -1; /* potential jumbo gram */ + len += sizeof(ip6_t); p = ((ip6_t *)ip)->ip6_nxt; } else # endif @@ -820,7 +823,8 @@ int out; len = ip->ip_len; } - if ((p == IPPROTO_TCP || p == IPPROTO_UDP || p == IPPROTO_ICMP + if ((p == IPPROTO_TCP || p == IPPROTO_UDP || + (v == 4 && p == IPPROTO_ICMP) # ifdef USE_INET6 || (v == 6 && p == IPPROTO_ICMPV6) # endif @@ -889,13 +893,6 @@ int out; # endif #endif /* _KERNEL */ - /* - * Be careful here: ip_id is in network byte order when called - * from ip_output() - */ - if ((out) && (v == 4)) - ip->ip_id = ntohs(ip->ip_id); - changed = 0; fin->fin_ifp = ifp; fin->fin_v = v; @@ -940,15 +937,12 @@ int out; } #endif pass = fr_pass; - if (fin->fin_fi.fi_fl & FI_SHORT) { + if (fin->fin_fl & FI_SHORT) { ATOMIC_INCL(frstats[out].fr_short); } READ_ENTER(&ipf_mutex); - if (fin->fin_fi.fi_fl & FI_SHORT) - ATOMIC_INCL(frstats[out].fr_short); - /* * Check auth now. This, combined with the check below to see if apass * is 0 is to ensure that we don't count the packet twice, which can @@ -972,8 +966,18 @@ int out; } } - if (apass || (!(fr = ipfr_knownfrag(ip, fin)) && - !(fr = fr_checkstate(ip, fin)))) { + if (!apass) { + if ((fin->fin_fl & FI_FRAG) == FI_FRAG) + fr = ipfr_knownfrag(ip, fin); + if (!fr && !(fin->fin_fl & FI_SHORT)) + fr = fr_checkstate(ip, fin); + if (fr != NULL) + pass = fr->fr_flags; + if (fr && (pass & FR_LOGFIRST)) + pass &= ~(FR_LOGFIRST|FR_LOG); + } + + if (apass || !fr) { /* * If a packet is found in the auth table, then skip checking * the access lists for permission but we do need to consider @@ -1008,22 +1012,26 @@ int out; ATOMIC_INCL(frstats[out].fr_nom); } } - fr = fin->fin_fr; } else pass = apass; + fr = fin->fin_fr; /* * If we fail to add a packet to the authorization queue, * then we drop the packet later. However, if it was added * then pretend we've dropped it already. */ - if ((pass & FR_AUTH)) - if (fr_newauth((mb_t *)m, fin, ip) != 0) + if ((pass & FR_AUTH)) { + if (fr_newauth((mb_t *)m, fin, ip) != 0) { #ifdef _KERNEL m = *mp = NULL; #else ; #endif + error = 0; + } else + error = ENOSPC; + } if (pass & FR_PREAUTH) { READ_ENTER(&ipf_auth); @@ -1038,7 +1046,7 @@ int out; fin->fin_fr = fr; if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) { - if (fin->fin_fi.fi_fl & FI_FRAG) { + if (fin->fin_fl & FI_FRAG) { if (ipfr_newfrag(ip, fin, pass) == -1) { ATOMIC_INCL(frstats[out].fr_bnfr); } else { @@ -1116,9 +1124,6 @@ logit: } #endif /* IPFILTER_LOG */ - if ((out) && (v == 4)) - ip->ip_id = htons(ip->ip_id); - #ifdef _KERNEL /* * Only allow FR_DUP to work if a rule matched - it makes no sense to @@ -1160,7 +1165,7 @@ logit: send_icmp_err(ip, ICMP_UNREACH, fin, dst); ATOMIC_INCL(frstats[0].fr_ret); } else if (((pass & FR_RETMASK) == FR_RETRST) && - !(fin->fin_fi.fi_fl & FI_SHORT)) { + !(fin->fin_fl & FI_SHORT)) { if (send_reset(ip, fin) == 0) { ATOMIC_INCL(frstats[1].fr_ret); } @@ -1173,7 +1178,7 @@ logit: verbose("- forged ICMP unreachable sent\n"); ATOMIC_INCL(frstats[0].fr_ret); } else if (((pass & FR_RETMASK) == FR_RETRST) && - !(fin->fin_fi.fi_fl & FI_SHORT)) { + !(fin->fin_fl & FI_SHORT)) { verbose("- TCP RST sent\n"); ATOMIC_INCL(frstats[1].fr_ret); } @@ -1202,15 +1207,17 @@ logit: frdest_t *fdp = &fr->fr_tif; if (((pass & FR_FASTROUTE) && !out) || - (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) { - if (ipfr_fastroute(m, fin, fdp) == 0) - m = *mp = NULL; - } - if (mc) - ipfr_fastroute(mc, fin, &fr->fr_dif); + (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) + (void) ipfr_fastroute(m, mp, fin, fdp); + + if (mc != NULL) + (void) ipfr_fastroute(mc, &mc, fin, &fr->fr_dif); } - if (!(pass & FR_PASS) && m) + + if (!(pass & FR_PASS) && m) { m_freem(m); + m = *mp = NULL; + } # ifdef __sgi else if (changed && up && m) m_copyback(m, 0, up, hbuf); @@ -1221,12 +1228,11 @@ logit: frdest_t *fdp = &fr->fr_tif; if (((pass & FR_FASTROUTE) && !out) || - (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) { - if (ipfr_fastroute(ip, m, mp, fin, fdp) == 0) - m = *mp = NULL; - } - if (mc) - ipfr_fastroute(ip, mc, mp, fin, &fr->fr_dif); + (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) + (void) ipfr_fastroute(ip, m, mp, fin, fdp); + + if (mc != NULL) + (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif); } # endif /* !SOLARIS */ return (pass & FR_PASS) ? 0 : error; @@ -1458,7 +1464,7 @@ nodata: * SUCH DAMAGE. * * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94 - * $Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $ + * $Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $ */ /* * Copy data from an mbuf chain starting "off" bytes from the beginning, @@ -1907,7 +1913,7 @@ void frsync() ip_statesync(ifp); } ip_natsync((struct ifnet *)-1); -# endif +# endif /* !SOLARIS */ WRITE_ENTER(&ipf_mutex); frsynclist(ipacct[0][fr_active]); diff --git a/contrib/ipfilter/fils.c b/contrib/ipfilter/fils.c index 3184e4c..3ed698a 100644 --- a/contrib/ipfilter/fils.c +++ b/contrib/ipfilter/fils.c @@ -1,12 +1,16 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#ifdef __FreeBSD__ -# include <osreldate.h> +#ifdef __FreeBSD__ +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif #endif #include <stdio.h> #include <string.h> @@ -25,10 +29,6 @@ #include <fcntl.h> #include <stddef.h> #include <nlist.h> -#ifdef STATETOP -#include <ctype.h> -#include <ncurses.h> -#endif #include <sys/socket.h> #include <sys/ioctl.h> #include <netinet/in.h> @@ -56,8 +56,17 @@ #include "netinet/ip_state.h" #include "netinet/ip_auth.h" #ifdef STATETOP -#include "netinet/ipl.h" -#endif +# include "netinet/ipl.h" +# include <ctype.h> +# if SOLARIS +# ifdef ERR +# undef ERR +# endif +# include <curses.h> +# else /* SOLARIS */ +# include <ncurses.h> +# endif /* SOLARIS */ +#endif /* STATETOP */ #include "kmem.h" #if defined(__NetBSD__) || (__OpenBSD__) # include <paths.h> @@ -65,10 +74,11 @@ #if !defined(lint) static const char sccsid[] = "@(#)fils.c 1.21 4/20/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.7 2000/12/02 00:13:56 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.17 2001/07/19 12:24:09 darrenr Exp $"; #endif extern char *optarg; +extern int optind; #define PRINTF (void)printf #define FPRINTF (void)fprintf @@ -86,6 +96,7 @@ int use_inet6 = 0; #ifdef STATETOP #define STSTRSIZE 80 #define STGROWSIZE 16 +#define HOSTNMLEN 40 #define STSORT_PR 0 #define STSORT_PKTS 1 @@ -128,6 +139,9 @@ static int sort_pkts __P((const void *, const void *)); static int sort_bytes __P((const void *, const void *)); static int sort_ttl __P((const void *, const void *)); #endif +#if SOLARIS +void showqiflist __P((char *)); +#endif static char *hostname(v, ip) int v; @@ -160,7 +174,11 @@ char *name; #else fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name); #endif - fprintf(stderr, " %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name); + fprintf(stderr, "\t\t[-M corefile]"); +#if SOLARIS + fprintf(stderr, " [-N symbol-list]"); +#endif + fprintf(stderr, "\n %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name); exit(1); } @@ -177,8 +195,11 @@ char *argv[]; ips_stat_t *ipsstp = &ipsst; ipfrstat_t ifrst; ipfrstat_t *ifrstp = &ifrst; - char *name = NULL, *device = IPL_NAME; - int c, fd; + char *name = NULL, *device = IPL_NAME, *memf = NULL; +#if SOLARIS + char *kern = NULL; +#endif + int c, fd, myoptind; struct protoent *proto; int protocol = -1; /* -1 = wild card for any protocol */ @@ -190,13 +211,50 @@ char *argv[]; saddr.s_addr = INADDR_ANY; /* default any source addr */ daddr.s_addr = INADDR_ANY; /* default any dest addr */ - if (openkmem() == -1) + /* + * Parse these two arguments now lest there be any buffer overflows + * in the parsing of the rest. + */ + myoptind = optind; +#if SOLARIS + while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1) +#else + while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:P:S:T:")) != -1) +#endif + switch (c) + { + case 'M' : + memf = optarg; + break; +#if SOLARIS + case 'N' : + kern = optarg; + break; +#endif + } + optind = myoptind; + +#if SOLARIS + if (kern != NULL || memf != NULL) +#else + if (memf != NULL) +#endif + { + (void)setuid(getuid()); + (void)setgid(getgid()); + } + + if (openkmem(memf) == -1) exit(-1); (void)setuid(getuid()); (void)setgid(getgid()); - while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:P:S:T:")) != -1) +#if SOLARIS + while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1) +#else + while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:M:P:S:T:")) != -1) +#endif { switch (c) { @@ -207,8 +265,7 @@ char *argv[]; #endif case 'a' : opts |= OPT_ACCNT|OPT_SHOWLIST; - break; - case 'A' : + break; case 'A' : device = IPAUTH_NAME; opts |= OPT_AUTHSTATS; break; @@ -239,6 +296,10 @@ char *argv[]; case 'l' : opts |= OPT_SHOWLIST; break; + case 'M' : + break; + case 'N' : + break; case 'n' : opts |= OPT_SHOWLINENO; break; @@ -255,6 +316,12 @@ char *argv[]; exit(-2); } break; +#if SOLARIS + case 'q' : + showqiflist(kern); + exit(0); + break; +#endif case 's' : opts |= OPT_IPSTATES; break; @@ -653,13 +720,52 @@ ips_stat_t *ipsp; PRINTF("\tpkt_security & %x = %x, pkt_auth & %x = %x\n", ips.is_secmsk, ips.is_sec, ips.is_authmsk, ips.is_auth); - PRINTF("interfaces: in %s[%p] ", + PRINTF("\tinterfaces: in %s[%p] ", get_ifname(ips.is_ifpin), ips.is_ifpin); PRINTF("out %s[%p]\n", get_ifname(ips.is_ifpout), ips.is_ifpout); } } + +#if SOLARIS +void showqiflist(kern) +char *kern; +{ + struct nlist qifnlist[2] = { + { "qif_head" }, + { NULL } + }; + qif_t qif, *qf; + + if (kern == NULL) + kern = "/dev/ksyms"; + + if (nlist(kern, qifnlist) == -1) { + fprintf(stderr, "nlist error\n"); + return; + } + + printf("List of interfaces bound by IPFilter:\n"); + if (kmemcpy((char *)&qf, (u_long)qifnlist[0].n_value, sizeof(qf))) + return; + while (qf) { + if (kmemcpy((char *)&qif, (u_long)qf, sizeof(qif))) + break; + printf("\tName: %-8s Header Length: %2d SAP: %s (%04x)\n", + qif.qf_name, qif.qf_hl, +#ifdef IP6_DL_SAP + (qif.qf_sap == IP6_DL_SAP) ? "IPv6" : "IPv4" +#else + "IPv4" +#endif + , qif.qf_sap); + qf = qif.qf_next; + } +} +#endif + + #ifdef STATETOP static void topipstates(fd, saddr, daddr, sport, dport, protocol, refreshtime, topclosed) @@ -679,9 +785,10 @@ int topclosed; ips_stat_t ipsst, *ipsstp = &ipsst; statetop_t *tstable = NULL, *tp; struct timeval selecttimeout; + char hostnm[HOSTNMLEN]; struct protoent *proto; fd_set readfd; - char c = '\0'; + int c = 0; time_t t; /* open state device */ @@ -694,7 +801,10 @@ int topclosed; initscr(); cbreak(); noecho(); - nodelay(stdscr, 1); + + /* init hostname */ + gethostname(hostnm, sizeof(hostnm) - 1); + hostnm[sizeof(hostnm) - 1] = '\0'; /* repeat until user aborts */ while ( 1 ) { @@ -799,8 +909,8 @@ int topclosed; attron(A_BOLD); winx = 0; move(winx,0); - sprintf(str1, "%s - state top", IPL_VERSION); - for(j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++) + sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION); + for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++) printw(" "); printw("%s", str1); attroff(A_BOLD); @@ -873,7 +983,9 @@ int topclosed; if (reverse) tp += tsentry; - for(i = 0; i <= tsentry; i++) { + if (tsentry > maxy - 6) + tsentry = maxy - 6; + for (i = 0; i <= tsentry; i++) { /* print src/dest and port */ if ((tp->st_p == IPPROTO_TCP) || (tp->st_p == IPPROTO_UDP)) { @@ -938,22 +1050,25 @@ int topclosed; select(1, &readfd, NULL, NULL, &selecttimeout); /* if key pressed, read all waiting keys */ - if (FD_ISSET(0, &readfd)) - while ((c = wgetch(stdscr)) != ERR) { - if (tolower(c) == 'l') { - redraw = 1; - } else if (tolower(c) == 'q') { - nocbreak(); - endwin(); - exit(0); - } else if (tolower(c) == 'r') { - reverse = !reverse; - } else if (tolower(c) == 's') { - sorting++; - if (sorting > STSORT_MAX) - sorting = 0; - } + if (FD_ISSET(0, &readfd)) { + c = wgetch(stdscr); + if (c == ERR) + continue; + + if (tolower(c) == 'l') { + redraw = 1; + } else if (tolower(c) == 'q') { + nocbreak(); + endwin(); + exit(0); + } else if (tolower(c) == 'r') { + reverse = !reverse; + } else if (tolower(c) == 's') { + sorting++; + if (sorting > STSORT_MAX) + sorting = 0; } + } } /* while */ close(sfd); diff --git a/contrib/ipfilter/inet_addr.c b/contrib/ipfilter/inet_addr.c index 49278a8..03bcf23 100644 --- a/contrib/ipfilter/inet_addr.c +++ b/contrib/ipfilter/inet_addr.c @@ -52,10 +52,20 @@ * - * --Copyright-- */ +#ifdef __STDC__ +# ifndef __P +# define __P(x) x +# endif +#else +# undef __P +# define __P(x) () +# undef const +# define const +#endif #if !defined(lint) static const char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93"; -static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1.4.1 2001/07/15 22:06:14 darrenr Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/param.h> @@ -63,13 +73,6 @@ static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darr #include <arpa/inet.h> #include <ctype.h> -#ifndef __P -# ifdef __STDC__ -# define __P(x) x -# else -# define __P(x) () -# endif -#endif int inet_aton __P((const char *, struct in_addr *)); /* diff --git a/contrib/ipfilter/ip_auth.c b/contrib/ipfilter/ip_auth.c index a453610..b22d470 100644 --- a/contrib/ipfilter/ip_auth.c +++ b/contrib/ipfilter/ip_auth.c @@ -1,14 +1,8 @@ /* - * Copyright (C) 1998-2000 by Darren Reed & Guido van Rooij. + * Copyright (C) 1998-2001 by Darren Reed & Guido van Rooij. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 darrenr Exp $"; -#endif - #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> @@ -77,7 +71,7 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 d #endif #include <netinet/tcp.h> #if defined(__sgi) && !defined(IFF_DRVRLOCK) /* IRIX < 6 */ -extern struct ifqueue ipintrq; /* ip packet input queue */ +extern struct ifqueue ipintrq; /* ip packet input queue */ #else # ifndef linux # if __FreeBSD_version >= 300000 @@ -107,10 +101,13 @@ extern struct ifqueue ipintrq; /* ip packet input queue */ # endif #endif +#if !defined(lint) +static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.12 2001/07/18 14:57:08 darrenr Exp $"; +#endif #if (SOLARIS || defined(__sgi)) && defined(_KERNEL) -extern KRWLOCK_T ipf_auth; +extern KRWLOCK_T ipf_auth, ipf_mutex; extern kmutex_t ipf_authmx; # if SOLARIS extern kcondvar_t ipfauthwait; @@ -129,7 +126,8 @@ static frauth_t fr_auth[FR_NUMAUTH]; mb_t *fr_authpkts[FR_NUMAUTH]; static int fr_authstart = 0, fr_authend = 0, fr_authnext = 0; static frauthent_t *fae_list = NULL; -frentry_t *ipauth = NULL; +frentry_t *ipauth = NULL, + *fr_authlist = NULL; /* @@ -142,10 +140,12 @@ ip_t *ip; fr_info_t *fin; { u_short id = ip->ip_id; + frentry_t *fr; + frauth_t *fra; u_32_t pass; int i; - if (fr_auth_lock) + if (fr_auth_lock || !fr_authused) return 0; READ_ENTER(&ipf_auth); @@ -155,24 +155,54 @@ fr_info_t *fin; * case the same packet gets sent again and it hasn't yet been * auth'd. */ - if ((fr_auth[i].fra_index == -2) && - (id == fr_auth[i].fra_info.fin_id) && - !bcmp((char *)fin,(char *)&fr_auth[i].fra_info,FI_CSIZE)) { + fra = fr_auth + i; + if ((fra->fra_index == -2) && (id == fra->fra_info.fin_id) && + !bcmp((char *)fin, (char *)&fra->fra_info, FI_CSIZE)) { /* * Avoid feedback loop. */ - if (!(pass = fr_auth[i].fra_pass) || (pass & FR_AUTH)) + if (!(pass = fra->fra_pass) || (pass & FR_AUTH)) pass = FR_BLOCK; + /* + * Create a dummy rule for the stateful checking to + * use and return. Zero out any values we don't + * trust from userland! + */ + if ((pass & FR_KEEPSTATE) || ((pass & FR_KEEPFRAG) && + (fin->fin_fi.fi_fl & FI_FRAG))) { + KMALLOC(fr, frentry_t *); + if (fr) { + bcopy((char *)fra->fra_info.fin_fr, + fr, sizeof(*fr)); + fr->fr_grp = NULL; + fr->fr_ifa = fin->fin_ifp; + fr->fr_func = NULL; + fr->fr_ref = 1; + fr->fr_flags = pass; +#if BSD >= 199306 + fr->fr_oifa = NULL; +#endif + } + } else + fr = fra->fra_info.fin_fr; + fin->fin_fr = fr; RWLOCK_EXIT(&ipf_auth); WRITE_ENTER(&ipf_auth); + if (fr && fr != fra->fra_info.fin_fr) { + fr->fr_next = fr_authlist; + fr_authlist = fr; + } fr_authstats.fas_hits++; - fr_auth[i].fra_index = -1; + fra->fra_index = -1; fr_authused--; if (i == fr_authstart) { - while (fr_auth[i].fra_index == -1) { + while (fra->fra_index == -1) { i++; - if (i == FR_NUMAUTH) + fra++; + if (i == FR_NUMAUTH) { i = 0; + fra = fr_auth; + } fr_authstart = i; if (i == fr_authend) break; @@ -208,6 +238,7 @@ ip_t *ip; #if defined(_KERNEL) && SOLARIS qif_t *qif = fin->fin_qif; #endif + frauth_t *fra; int i; if (fr_auth_lock) @@ -219,7 +250,7 @@ ip_t *ip; RWLOCK_EXIT(&ipf_auth); return 0; } else { - if ((fr_authstart == 0) && (fr_authend == FR_NUMAUTH - 1)) { + if (fr_authused == FR_NUMAUTH) { fr_authstats.fas_nospace++; RWLOCK_EXIT(&ipf_auth); return 0; @@ -232,51 +263,48 @@ ip_t *ip; if (fr_authend == FR_NUMAUTH) fr_authend = 0; RWLOCK_EXIT(&ipf_auth); - fr_auth[i].fra_index = i; - fr_auth[i].fra_pass = 0; - fr_auth[i].fra_age = fr_defaultauthage; - bcopy((char *)fin, (char *)&fr_auth[i].fra_info, sizeof(*fin)); -#if !defined(sparc) && !defined(m68k) + fra = fr_auth + i; + fra->fra_index = i; + fra->fra_pass = 0; + fra->fra_age = fr_defaultauthage; + bcopy((char *)fin, (char *)&fra->fra_info, sizeof(*fin)); +#if SOLARIS && defined(_KERNEL) +# if !defined(sparc) /* * No need to copyback here as we want to undo the changes, not keep * them. */ -# if SOLARIS && defined(_KERNEL) if ((ip == (ip_t *)m->b_rptr) && (ip->ip_v == 4)) -# endif { register u_short bo; bo = ip->ip_len; ip->ip_len = htons(bo); -# if !SOLARIS && !defined(__NetBSD__) - /* 4.4BSD converts this ip_input.c, but I don't in solaris.c */ - bo = ip->ip_id; - ip->ip_id = htons(bo); -# endif bo = ip->ip_off; ip->ip_off = htons(bo); } -#endif -#if SOLARIS && defined(_KERNEL) +# endif m->b_rptr -= qif->qf_off; fr_authpkts[i] = *(mblk_t **)fin->fin_mp; - fr_auth[i].fra_q = qif->qf_q; + fra->fra_q = qif->qf_q; cv_signal(&ipfauthwait); #else +# if defined(BSD) && !defined(sparc) && (BSD >= 199306) + if (!fin->fin_out) { + HTONS(ip->ip_len); + HTONS(ip->ip_off); + } +# endif fr_authpkts[i] = m; -# if defined(linux) && defined(_KERNEL) - wake_up_interruptible(&ipfauthwait); -# else WAKEUP(&fr_authnext); -# endif #endif return 1; } -int fr_auth_ioctl(data, cmd, fr, frptr) +int fr_auth_ioctl(data, mode, cmd, fr, frptr) caddr_t data; +int mode; #if defined(__NetBSD__) || defined(__OpenBSD__) || (FreeBSD_version >= 300003) u_long cmd; #else @@ -287,8 +315,9 @@ frentry_t *fr, **frptr; mb_t *m; #if defined(_KERNEL) && !SOLARIS struct ifqueue *ifq; + int s; #endif - frauth_t auth, *au = &auth; + frauth_t auth, *au = &auth, *fra; frauthent_t *fae, **faep; int i, error = 0; @@ -313,21 +342,26 @@ frentry_t *fr, **frptr; else faep = &fae->fae_next; if (cmd == SIOCRMAFR) { - if (!fae) + if (!fr || !frptr) + error = EINVAL; + else if (!fae) error = ESRCH; else { WRITE_ENTER(&ipf_auth); + SPL_NET(s); *faep = fae->fae_next; *frptr = fr->fr_next; + SPL_X(s); RWLOCK_EXIT(&ipf_auth); KFREE(fae); } - } else { + } else if (fr && frptr) { KMALLOC(fae, frauthent_t *); if (fae != NULL) { bcopy((char *)fr, (char *)&fae->fae_fr, sizeof(*fr)); WRITE_ENTER(&ipf_auth); + SPL_NET(s); fae->fae_age = fr_defaultauthage; fae->fae_fr.fr_hits = 0; fae->fae_fr.fr_next = *frptr; @@ -335,10 +369,12 @@ frentry_t *fr, **frptr; fae->fae_next = *faep; *faep = fae; ipauth = &fae_list->fae_fr; + SPL_X(s); RWLOCK_EXIT(&ipf_auth); } else error = ENOMEM; - } + } else + error = EINVAL; break; case SIOCATHST: READ_ENTER(&ipf_auth); @@ -348,6 +384,10 @@ frentry_t *fr, **frptr; sizeof(fr_authstats)); break; case SIOCAUTHW: + if (!(mode & FWRITE)) { + error = EPERM; + break; + } fr_authioctlloop: READ_ENTER(&ipf_auth); if ((fr_authnext != fr_authend) && fr_authpkts[fr_authnext]) { @@ -357,9 +397,11 @@ fr_authioctlloop: if (error) break; WRITE_ENTER(&ipf_auth); + SPL_NET(s); fr_authnext++; if (fr_authnext == FR_NUMAUTH) fr_authnext = 0; + SPL_X(s); RWLOCK_EXIT(&ipf_auth); return 0; } @@ -372,55 +414,62 @@ fr_authioctlloop: } mutex_exit(&ipf_authmx); # else -# ifdef linux - interruptible_sleep_on(&ipfauthwait); - if (current->signal & ~current->blocked) - error = -EINTR; -# else error = SLEEP(&fr_authnext, "fr_authnext"); # endif -# endif #endif RWLOCK_EXIT(&ipf_auth); if (!error) goto fr_authioctlloop; break; case SIOCAUTHR: + if (!(mode & FWRITE)) { + error = EPERM; + break; + } error = IRCOPYPTR(data, (caddr_t)&auth, sizeof(auth)); if (error) return error; WRITE_ENTER(&ipf_auth); + SPL_NET(s); i = au->fra_index; + fra = fr_auth + i; if ((i < 0) || (i > FR_NUMAUTH) || - (fr_auth[i].fra_info.fin_id != au->fra_info.fin_id)) { + (fra->fra_info.fin_id != au->fra_info.fin_id)) { + SPL_X(s); RWLOCK_EXIT(&ipf_auth); return EINVAL; } m = fr_authpkts[i]; - fr_auth[i].fra_index = -2; - fr_auth[i].fra_pass = au->fra_pass; + fra->fra_index = -2; + fra->fra_pass = au->fra_pass; fr_authpkts[i] = NULL; -#ifdef _KERNEL RWLOCK_EXIT(&ipf_auth); -# ifndef linux +#ifdef _KERNEL if (m && au->fra_info.fin_out) { -# if SOLARIS - error = fr_qout(fr_auth[i].fra_q, m); -# else /* SOLARIS */ -# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__) - error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL, +# if SOLARIS + error = fr_qout(fra->fra_q, m); +# else /* SOLARIS */ + struct route ro; + + bzero((char *)&ro, sizeof(ro)); +# if ((_BSDI_VERSION >= 199802) && (_BSDI_VERSION < 200005)) || \ + defined(__OpenBSD__) + error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL); -# else - error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL); -# endif -# endif /* SOLARIS */ +# else + error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL); +# endif + if (ro.ro_rt) { + RTFREE(ro.ro_rt); + } +# endif /* SOLARIS */ if (error) fr_authstats.fas_sendfail++; else fr_authstats.fas_sendok++; } else if (m) { # if SOLARIS - error = fr_qin(fr_auth[i].fra_q, m); + error = fr_qin(fra->fra_q, m); # else /* SOLARIS */ ifq = &ipintrq; if (IF_QFULL(ifq)) { @@ -438,7 +487,6 @@ fr_authioctlloop: fr_authstats.fas_queok++; } else error = EINVAL; -# endif # if SOLARIS if (error) error = EINVAL; @@ -449,10 +497,10 @@ fr_authioctlloop: */ if (error == ENOBUFS) { fr_authused--; - fr_auth[i].fra_index = -1; - fr_auth[i].fra_pass = 0; + fra->fra_index = -1; + fra->fra_pass = 0; if (i == fr_authstart) { - while (fr_auth[i].fra_index == -1) { + while (fra->fra_index == -1) { i++; if (i == FR_NUMAUTH) i = 0; @@ -468,6 +516,7 @@ fr_authioctlloop: } # endif #endif /* _KERNEL */ + SPL_X(s); break; default : error = EINVAL; @@ -485,6 +534,7 @@ void fr_authunload() { register int i; register frauthent_t *fae, **faep; + frentry_t *fr, **frp; mb_t *m; WRITE_ENTER(&ipf_auth); @@ -503,6 +553,26 @@ void fr_authunload() } ipauth = NULL; RWLOCK_EXIT(&ipf_auth); + + if (fr_authlist) { + /* + * We *MuST* reget ipf_auth because otherwise we won't get the + * locks in the right order and risk deadlock. + * We need ipf_mutex here to prevent a rule from using it + * inside fr_check(). + */ + WRITE_ENTER(&ipf_mutex); + WRITE_ENTER(&ipf_auth); + for (frp = &fr_authlist; (fr = *frp); ) { + if (fr->fr_ref == 1) { + *frp = fr->fr_next; + KFREE(fr); + } else + frp = &fr->fr_next; + } + RWLOCK_EXIT(&ipf_auth); + RWLOCK_EXIT(&ipf_mutex); + } } @@ -515,6 +585,7 @@ void fr_authexpire() register int i; register frauth_t *fra; register frauthent_t *fae, **faep; + register frentry_t *fr, **frp; mb_t *m; #if !SOLARIS int s; @@ -544,6 +615,14 @@ void fr_authexpire() faep = &fae->fae_next; } ipauth = &fae_list->fae_fr; + + for (frp = &fr_authlist; (fr = *frp); ) { + if (fr->fr_ref == 1) { + *frp = fr->fr_next; + KFREE(fr); + } else + frp = &fr->fr_next; + } RWLOCK_EXIT(&ipf_auth); SPL_X(s); } diff --git a/contrib/ipfilter/ip_auth.h b/contrib/ipfilter/ip_auth.h index 681a6e5..7d3e463 100644 --- a/contrib/ipfilter/ip_auth.h +++ b/contrib/ipfilter/ip_auth.h @@ -1,11 +1,9 @@ /* - * Copyright (C) 1997-2000 by Darren Reed & Guido Van Rooij. + * Copyright (C) 1997-2001 by Darren Reed & Guido Van Rooij. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * - * $Id: ip_auth.h,v 2.3.2.2 2000/10/19 15:38:44 darrenr Exp $ + * $Id: ip_auth.h,v 2.3.2.4 2001/07/18 14:57:08 darrenr Exp $ * */ #ifndef __IP_AUTH_H__ @@ -55,8 +53,8 @@ extern void fr_authunload __P((void)); extern mb_t *fr_authpkts[]; extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *)); #if defined(__NetBSD__) || defined(__OpenBSD__) -extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **)); +extern int fr_auth_ioctl __P((caddr_t, int, u_long, frentry_t *, frentry_t **)); #else -extern int fr_auth_ioctl __P((caddr_t, int, frentry_t *, frentry_t **)); +extern int fr_auth_ioctl __P((caddr_t, int, int, frentry_t *, frentry_t **)); #endif #endif /* __IP_AUTH_H__ */ diff --git a/contrib/ipfilter/ip_compat.h b/contrib/ipfilter/ip_compat.h index ed71f36..a7d0db4 100644 --- a/contrib/ipfilter/ip_compat.h +++ b/contrib/ipfilter/ip_compat.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ip_compat.h 1.8 1/14/96 - * $Id: ip_compat.h,v 2.26.2.9 2001/01/14 14:58:01 darrenr Exp $ + * $Id: ip_compat.h,v 2.26.2.17 2001/07/23 04:22:48 darrenr Exp $ */ #ifndef __IP_COMPAT_H__ @@ -27,6 +25,9 @@ #ifndef SOLARIS #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) #endif +#if SOLARIS && !defined(SOLARIS2) +# define SOLARIS2 4 /* Pick an old version */ +#endif #if SOLARIS2 >= 8 # ifndef USE_INET6 # define USE_INET6 @@ -119,10 +120,34 @@ struct ether_addr { # define V4_PART_OF_V6(v6) v6.s6_addr32[3] # endif # endif -#else + +typedef struct qif { + struct qif *qf_next; + ill_t *qf_ill; + kmutex_t qf_lock; + void *qf_iptr; + void *qf_optr; + queue_t *qf_in; + queue_t *qf_out; + struct qinit *qf_wqinfo; + struct qinit *qf_rqinfo; + struct qinit qf_wqinit; + struct qinit qf_rqinit; + mblk_t *qf_m; /* These three fields are for passing data up from */ + queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */ + size_t qf_off; + size_t qf_len; /* this field is used for in ipfr_fastroute */ + char qf_name[8]; + /* + * in case the ILL has disappeared... + */ + size_t qf_hl; /* header length */ + int qf_sap; +} qif_t; +#else /* SOLARIS */ # if !defined(__sgi) typedef int minor_t; -#endif +# endif #endif /* SOLARIS */ #define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h))) @@ -264,10 +289,26 @@ union i6addr { #if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL)) # ifdef IPFILTER_LKM -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# else +# include <sys/param.h> +# endif +# endif # define ACTUALLY_LKM_NOT_KERNEL # else -# include <sys/osreldate.h> +# ifndef __FreeBSD_cc_version +# include <sys/osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <sys/osreldate.h> +# else +# include <sys/param.h> +# endif +# endif # endif # if __FreeBSD__ < 3 # include <machine/spl.h> @@ -325,6 +366,7 @@ typedef struct { # define ATOMIC_DEC32(x) atomic_add_32((uint32_t*)&(x), -1) # define ATOMIC_DEC16(x) atomic_add_16((uint16_t*)&(x), -1) # else +# define IRE_CACHE IRE_ROUTE # define ATOMIC_INC(x) { mutex_enter(&ipf_rw); (x)++; \ mutex_exit(&ipf_rw); } # define ATOMIC_DEC(x) { mutex_enter(&ipf_rw); (x)--; \ @@ -374,29 +416,6 @@ typedef struct { # define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP) # define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP) # define GET_MINOR(x) getminor(x) -typedef struct qif { - struct qif *qf_next; - ill_t *qf_ill; - kmutex_t qf_lock; - void *qf_iptr; - void *qf_optr; - queue_t *qf_in; - queue_t *qf_out; - struct qinit *qf_wqinfo; - struct qinit *qf_rqinfo; - struct qinit qf_wqinit; - struct qinit qf_rqinit; - mblk_t *qf_m; /* These three fields are for passing data up from */ - queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */ - size_t qf_off; - size_t qf_len; /* this field is used for in ipfr_fastroute */ - char qf_name[8]; - /* - * in case the ILL has disappeared... - */ - size_t qf_hl; /* header length */ - int qf_sap; -} qif_t; extern ill_t *get_unit __P((char *, int)); # define GETUNIT(n, v) get_unit(n, v) # define IFNAME(x) ((ill_t *)x)->ill_name @@ -452,7 +471,9 @@ extern ill_t *get_unit __P((char *, int)); (defined(OpenBSD) && (OpenBSD >= 199603)) # define IFNAME(x) ((struct ifnet *)x)->if_xname # else -# define IFNAME(x) ((struct ifnet *)x)->if_name +# define USE_GETIFNAME 1 +# define IFNAME(x) get_ifname((struct ifnet *)x) +extern char *get_ifname __P((struct ifnet *)); # endif # endif # endif /* sun */ @@ -508,7 +529,8 @@ extern vm_map_t kmem_map; # define SLEEP(id, n) tsleep((id), PPAUSE|PCATCH, n, 0) # define WAKEUP(id) wakeup(id) # endif /* BSD */ -# if defined(NetBSD) && NetBSD <= 1991011 && NetBSD >= 199407 +# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199407)) || \ + (defined(OpenBSD) && (OpenBSD >= 200006)) # define SPL_NET(x) x = splsoftnet() # define SPL_X(x) (void) splx(x) # else @@ -517,7 +539,7 @@ extern vm_map_t kmem_map; # define SPL_NET(x) x = splnet() # define SPL_X(x) (void) splx(x) # endif -# endif /* NetBSD && NetBSD <= 1991011 && NetBSD >= 199407 */ +# endif /* NetBSD && (NetBSD <= 1991011) && (NetBSD >= 199407) */ # define PANIC(x,y) if (x) panic y #else /* KERNEL */ # define SLEEP(x,y) ; @@ -576,7 +598,6 @@ typedef struct mbuf mb_t; # endif #endif /* SOLARIS */ -#if defined(linux) || defined(__sgi) /* * These #ifdef's are here mainly for linux, but who knows, they may * not be in other places or maybe one day linux will grow up and some @@ -615,6 +636,9 @@ typedef struct mbuf mb_t; #ifndef ICMP_MASKREPLY # define ICMP_MASKREPLY ICMP_ADDRESSREPLY #endif +#ifndef ICMP_PARAMPROB_OPTABSENT +# define ICMP_PARAMPROB_OPTABSENT 1 +#endif #ifndef IPVERSION # define IPVERSION 4 #endif @@ -702,7 +726,6 @@ typedef struct mbuf mb_t; #ifndef IPOPT_OLEN # define IPOPT_OLEN 1 #endif -#endif /* linux || __sgi */ #ifdef linux #include <linux/in_systm.h> diff --git a/contrib/ipfilter/ip_fil.c b/contrib/ipfilter/ip_fil.c index 9253775..e15ff67 100644 --- a/contrib/ipfilter/ip_fil.c +++ b/contrib/ipfilter/ip_fil.c @@ -1,15 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 darrenr Exp $"; -#endif - #ifndef SOLARIS #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) #endif @@ -118,6 +111,11 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 d extern int ip_optcopy __P((struct ip *, struct ip *)); #endif +#if !defined(lint) +static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.34 2001/07/23 13:49:57 darrenr Exp $"; +#endif + extern struct protosw inetsw[]; @@ -131,7 +129,11 @@ extern int tcp_ttl; # endif #endif +#ifdef ICMP_UNREACH_FILTER_PROHIB +int ipl_unreach = ICMP_UNREACH_FILTER_PROHIB; +#else int ipl_unreach = ICMP_UNREACH_FILTER; +#endif u_long ipl_frouteok[2] = {0, 0}; static int frzerostats __P((caddr_t)); @@ -171,6 +173,10 @@ struct callout_handle ipfr_slowtimer_ch; # include <sys/callout.h> struct callout ipfr_slowtimer_ch; #endif +#if defined(__OpenBSD__) +# include <sys/timeout.h> +struct timeout ipfr_slowtimer_ch; +#endif #if defined(__sgi) && defined(_KERNEL) toid_t ipfr_slowtimer_ch; #endif @@ -246,12 +252,18 @@ int iplattach() # ifdef IPFILTER_LOG ipflog_init(); # endif - if (nat_init() == -1) - return -1; - if (fr_stateinit() == -1) - return -1; - if (appr_init() == -1) - return -1; + if (nat_init() == -1) { + SPL_X(s); + return EIO; + } + if (fr_stateinit() == -1) { + SPL_X(s); + return EIO; + } + if (appr_init() == -1) { + SPL_X(s); + return EIO; + } # ifdef NETBSD_PF # if __NetBSD_Version__ >= 104200000 @@ -261,6 +273,7 @@ int iplattach() # ifdef USE_INET6 goto pfil_error; # else + SPL_X(s); appr_unload(); ip_natunload(); fr_stateunload(); @@ -277,6 +290,7 @@ int iplattach() pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); pfil_error: + SPL_X(s); appr_unload(); ip_natunload(); fr_stateunload(); @@ -321,10 +335,15 @@ pfil_error: callout_init(&ipfr_slowtimer_ch); callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL); # else -# if (__FreeBSD_version >= 300000) || defined(__sgi) - ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2); +# if defined(__OpenBSD__) + timeout_set(&ipfr_slowtimer_ch, ipfr_slowtimer, NULL); + timeout_add(&ipfr_slowtimer_ch, hz/2); # else +# if (__FreeBSD_version >= 300000) || defined(__sgi) + ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2); +# else timeout(ipfr_slowtimer, NULL, hz/2); +# endif # endif # endif #endif @@ -353,8 +372,12 @@ int ipldetach() # ifdef __sgi untimeout(ipfr_slowtimer_ch); # else +# if defined(__OpenBSD__) + timeout_del(&ipfr_slowtimer_ch); +# else untimeout(ipfr_slowtimer, NULL); -# endif +# endif /* OpenBSD */ +# endif /* __sgi */ # endif /* FreeBSD */ # endif /* NetBSD */ #endif @@ -376,16 +399,20 @@ int ipldetach() # if __NetBSD_Version__ >= 104200000 error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); - if (error) + if (error) { + SPL_X(s); return error; + } # else pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT); # endif # ifdef USE_INET6 error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT, &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); - if (error) + if (error) { + SPL_X(s); return error; + } # endif # endif @@ -489,8 +516,9 @@ int mode; } if (unit == IPL_LOGAUTH) { if (!fr_running) - return EIO; - error = fr_auth_ioctl(data, cmd, NULL, NULL); + error = EIO; + else + error = fr_auth_ioctl(data, mode, cmd, NULL, NULL); SPL_X(s); return error; } @@ -564,7 +592,7 @@ int mode; fr_getstat(&fio); error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio)); if (error) - return EFAULT; + error = EFAULT; break; } case SIOCFRZST : @@ -607,7 +635,7 @@ int mode; error = IWCOPYPTR((caddr_t)ipfr_fragstats(), data, sizeof(ipfrstat_t)); if (error) - return EFAULT; + error = EFAULT; break; case SIOCAUTHW : case SIOCAUTHR : @@ -820,8 +848,6 @@ caddr_t data; return EBUSY; if (fg && fg->fg_head) fg->fg_head->fr_ref--; - if (unit == IPL_LOGAUTH) - return fr_auth_ioctl(data, req, f, ftail); if (f->fr_grhead) fr_delgroup((u_int)f->fr_grhead, fp->fr_flags, unit, set); @@ -835,8 +861,6 @@ caddr_t data; if (f) error = EEXIST; else { - if (unit == IPL_LOGAUTH) - return fr_auth_ioctl(data, req, fp, ftail); KMALLOC(f, frentry_t *); if (f != NULL) { if (fg && fg->fg_head) @@ -1068,7 +1092,7 @@ struct mbuf *m; # ifdef IPSEC m->m_pkthdr.rcvif = NULL; # endif - return ipfr_fastroute(m, fin, NULL); + return ipfr_fastroute(m, fin->fin_mp, fin, NULL); } @@ -1079,6 +1103,7 @@ fr_info_t *fin; int dst; { int err, hlen = 0, xtra = 0, iclen, ohlen = 0, avail, code; + u_short shlen, slen = 0, soff = 0; struct in_addr dst4; struct icmp *icmp; struct mbuf *m; @@ -1220,6 +1245,11 @@ int dst; } else #endif { + slen = oip->ip_len; + oip->ip_len = htons(oip->ip_len); + soff = oip->ip_off; + oip->ip_off = htons(ip->ip_off); + ip->ip_src.s_addr = dst4.s_addr; ip->ip_dst.s_addr = oip->ip_src.s_addr; @@ -1233,7 +1263,18 @@ int dst; ip->ip_len = iclen; ip->ip_p = IPPROTO_ICMP; } + + shlen = fin->fin_hlen; + fin->fin_hlen = hlen; err = send_ip(oip, fin, m); + fin->fin_hlen = shlen; +#ifdef USE_INET6 + if (fin->fin_v == 4) +#endif + { + oip->ip_len = slen; + oip->ip_off = soff; + } return err; } @@ -1268,8 +1309,8 @@ register struct mbuf *m0; } -int ipfr_fastroute(m0, fin, fdp) -struct mbuf *m0; +int ipfr_fastroute(m0, mpp, fin, fdp) +struct mbuf *m0, **mpp; fr_info_t *fin; frdest_t *fdp; { @@ -1282,16 +1323,49 @@ frdest_t *fdp; struct route iproute; frentry_t *fr; +#ifdef M_WRITABLE + /* + * HOT FIX/KLUDGE: + * + * If the mbuf we're about to send is not writable (because of + * a cluster reference, for example) we'll need to make a copy + * of it since this routine modifies the contents. + * + * If you have non-crappy network hardware that can transmit data + * from the mbuf, rather than making a copy, this is gonna be a + * problem. + */ + if (M_WRITABLE(m) == 0) { + if ((m0 = m_dup(m, M_DONTWAIT)) != 0) { + m_freem(m); + m = m0; + } else { + error = ENOBUFS; + m_freem(m); + ipl_frouteok[1]++; + } + } +#endif + hlen = fin->fin_hlen; ip = mtod(m0, struct ip *); +#if defined(__NetBSD__) && defined(M_CSUM_IPv4) + /* + * Clear any in-bound checksum flags for this packet. + */ + m0->m_pkthdr.csuminfo = 0; +#endif /* __NetBSD__ && M_CSUM_IPv4 */ + #ifdef USE_INET6 if (ip->ip_v == 6) { /* * currently "to <if>" and "to <if>:ip#" are not supported * for IPv6 */ - return ip6_output(m0, NULL, NULL, 0, NULL, NULL); + error = ip6_output(m0, NULL, NULL, 0, NULL, NULL); + *mpp = NULL; + return error; } #endif /* @@ -1316,10 +1390,15 @@ frdest_t *fdp; */ if ((fr != NULL) && (fin->fin_rev != 0)) { if ((ifp != NULL) && (fdp == &fr->fr_tif)) - return -1; + return 0; dst->sin_addr = ip->ip_dst; - } else if (fdp) - dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst; + } else if (fdp) { + if (fdp->fd_ip.s_addr) { + dst->sin_addr = fdp->fd_ip; + ip->ip_dst = fdp->fd_ip; + } else + dst->sin_addr = ip->ip_dst; + } # if BSD >= 199306 dst->sin_len = sizeof(*dst); @@ -1374,36 +1453,44 @@ frdest_t *fdp; * If small enough for interface, can just send directly. */ if (ip->ip_len <= ifp->if_mtu) { -# if BSD >= 199306 +# if defined(MCLISREFERENCED) && !defined(sparc) int i = 0; -# ifdef MCLISREFERENCED if ((m->m_flags & M_EXT) && MCLISREFERENCED(m)) -# else - if (m->m_flags & M_EXT) -# endif i = 1; # endif # ifndef sparc +# if !(_BSDI_VERSION >= 199510) ip->ip_id = htons(ip->ip_id); +# endif ip->ip_len = htons(ip->ip_len); ip->ip_off = htons(ip->ip_off); # endif +# if defined(__NetBSD__) && defined(M_CSUM_IPv4) + if (ifp->if_capabilities & IFCAP_CSUM_IPv4) + m->m_pkthdr.csuminfo |= M_CSUM_IPv4; + else if (ip->ip_sum == 0) + ip->ip_sum = in_cksum(m, hlen); +# else if (!ip->ip_sum) ip->ip_sum = in_cksum(m, hlen); +# endif /* __NetBSD__ && M_CSUM_IPv4 */ # if BSD >= 199306 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro->ro_rt); +# if defined(MCLISREFERENCED) && !defined(sparc) if (i) { ip->ip_id = ntohs(ip->ip_id); ip->ip_len = ntohs(ip->ip_len); ip->ip_off = ntohs(ip->ip_off); } +# endif # else error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst); # endif goto done; } + /* * Too large for interface; fragment if possible. * Must be able to put at least 8 bytes per fragment. @@ -1506,9 +1593,11 @@ done: else ipl_frouteok[1]++; - if (ro->ro_rt) + if (ro->ro_rt) { RTFREE(ro->ro_rt); - return 0; + } + *mpp = NULL; + return error; bad: if (error == EMSGSIZE) { sifp = fin->fin_ifp; @@ -1550,6 +1639,18 @@ void *ifp; return (ifp == iproute.ro_rt->rt_ifp); } + +# ifdef USE_GETIFNAME +char * +get_ifname(ifp) +struct ifnet *ifp; +{ + static char workbuf[64]; + + sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit); + return workbuf; +} +# endif #else /* #ifdef _KERNEL */ @@ -1586,9 +1687,9 @@ ip_t *ip; # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \ (defined(OpenBSD) && (OpenBSD >= 199603)) - sprintf(fname, "/tmp/%s", ifp->if_xname); + sprintf(fname, "%s", ifp->if_xname); # else - sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit); + sprintf(fname, "%s%d", ifp->if_name, ifp->if_unit); # endif fd = open(fname, O_WRONLY|O_APPEND); if (fd == -1) { @@ -1605,7 +1706,7 @@ struct ifnet *get_unit(name, v) char *name; int v; { - struct ifnet *ifp, **ifa; + struct ifnet *ifp, **ifa, **old_ifneta; # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \ (defined(OpenBSD) && (OpenBSD >= 199603)) for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) { @@ -1634,10 +1735,12 @@ int v; } nifs = 1; } else { + old_ifneta = ifneta; nifs++; ifneta = (struct ifnet **)realloc(ifneta, (nifs + 1) * sizeof(*ifa)); if (!ifneta) { + free(old_ifneta); nifs = 0; return NULL; } @@ -1704,28 +1807,6 @@ void init_ifp() } -int ipfr_fastroute(ip, fin, fdp) -ip_t *ip; -fr_info_t *fin; -frdest_t *fdp; -{ - struct ifnet *ifp = fdp->fd_ifp; - - if (!ifp) - return 0; /* no routing table out here */ - - ip->ip_len = htons((u_short)ip->ip_len); - ip->ip_off = htons((u_short)(ip->ip_off | IP_MF)); - ip->ip_sum = 0; -#ifdef __sgi - (*ifp->if_output)(ifp, (void *)ip, NULL); -#else - (*ifp->if_output)(ifp, (void *)ip, NULL, 0); -#endif - return 0; -} - - int ipllog __P((void)) { verbose("l"); diff --git a/contrib/ipfilter/ip_fil.h b/contrib/ipfilter/ip_fil.h index ed1cfc4..6d51ced 100644 --- a/contrib/ipfilter/ip_fil.h +++ b/contrib/ipfilter/ip_fil.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ip_fil.h 1.35 6/5/96 - * $Id: ip_fil.h,v 2.29.2.4 2000/11/12 11:54:53 darrenr Exp $ + * $Id: ip_fil.h,v 2.29.2.10 2001/07/15 13:51:42 darrenr Exp $ */ #ifndef __IP_FIL_H__ @@ -59,7 +57,7 @@ # define SIOCSTLCK _IOWR('r', 79, u_int) # define SIOCSTPUT _IOWR('r', 80, struct ipstate_save *) # define SIOCSTGET _IOWR('r', 81, struct ipstate_save *) -# define SIOCSTGSZ _IOWR('r', 82, struct natget *) +# define SIOCSTGSZ _IOWR('r', 82, struct natget) # define SIOCGFRST _IOWR('r', 83, struct ipfrstat *) #else # define SIOCADAFR _IOW(r, 60, struct frentry *) @@ -84,7 +82,7 @@ # define SIOCSTLCK _IOWR(r, 79, u_int) # define SIOCSTPUT _IOWR(r, 80, struct ipstate_save *) # define SIOCSTGET _IOWR(r, 81, struct ipstate_save *) -# define SIOCSTGSZ _IOWR(r, 82, struct natget *) +# define SIOCSTGSZ _IOWR(r, 82, struct natget) # define SIOCGFRST _IOWR(r, 83, struct ipfrstat *) #endif #define SIOCADDFR SIOCADAFR @@ -152,7 +150,10 @@ typedef struct fr_info { u_short fin_off; } fr_info_t; -#define fin_v fin_fi.fi_v +#define fin_v fin_fi.fi_v +#define fin_saddr fin_fi.fi_saddr +#define fin_daddr fin_fi.fi_daddr +#define fin_fl fin_fi.fi_fl /* * Size for compares on fr_info structures @@ -168,6 +169,9 @@ typedef struct frdest { void *fd_ifp; struct in_addr fd_ip; char fd_ifname[IFNAMSIZ]; +#if SOLARIS + mb_t *fd_mp; /* cache resolver for to/dup-to */ +#endif } frdest_t; typedef struct frpcmp { @@ -192,8 +196,6 @@ typedef struct frtuc { typedef struct frentry { struct frentry *fr_next; - u_32_t fr_group; /* group to which this rule belongs */ - u_32_t fr_grhead; /* group # which this rule starts */ struct frentry *fr_grp; int fr_ref; /* reference count - for grouping */ void *fr_ifa; @@ -217,6 +219,8 @@ typedef struct frentry { u_short fr_icmp; frtuc_t fr_tuc; + u_32_t fr_group; /* group to which this rule belongs */ + u_32_t fr_grhead; /* group # which this rule starts */ u_32_t fr_flags; /* per-rule flags && options (see below) */ u_int fr_skip; /* # of rules to skip */ u_int fr_loglevel; /* syslog log facility + priority */ @@ -436,6 +440,8 @@ typedef struct ipflog { #define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h))) #define IPLLOGSIZE 8192 +#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */ + /* * Device filenames for reading log information. Use ipf on Solaris2 because * ipl is already a name used by something else. @@ -484,7 +490,6 @@ extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **)); extern int send_reset __P((ip_t *, struct ifnet *)); extern int icmp_error __P((ip_t *, struct ifnet *)); extern int ipf_log __P((void)); -extern int ipfr_fastroute __P((ip_t *, fr_info_t *, frdest_t *)); extern struct ifnet *get_unit __P((char *, int)); # if defined(__NetBSD__) || defined(__OpenBSD__) || \ (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000) @@ -530,7 +535,7 @@ extern int iplread __P((dev_t, struct uio *, cred_t *)); # else /* SOLARIS */ extern int fr_check __P((ip_t *, int, void *, int, mb_t **)); extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **)); -extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *)); +extern int ipfr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *)); extern size_t mbufchainlen __P((mb_t *)); # ifdef __sgi # include <sys/cred.h> diff --git a/contrib/ipfilter/ip_frag.c b/contrib/ipfilter/ip_frag.c index 556478d..b0e63a9 100644 --- a/contrib/ipfilter/ip_frag.c +++ b/contrib/ipfilter/ip_frag.c @@ -1,15 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 darrenr Exp $"; -#endif - #if defined(KERNEL) && !defined(_KERNEL) # define _KERNEL #endif @@ -81,7 +74,7 @@ static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 d # ifndef IPFILTER_LKM # include <sys/libkern.h> # include <sys/systm.h> -# endif +# endif extern struct callout_handle ipfr_slowtimer_ch; # endif #endif @@ -89,6 +82,15 @@ extern struct callout_handle ipfr_slowtimer_ch; # include <sys/callout.h> extern struct callout ipfr_slowtimer_ch; #endif +#if defined(__OpenBSD__) +# include <sys/timeout.h> +extern struct timeout ipfr_slowtimer_ch; +#endif + +#if !defined(lint) +static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.14 2001/07/15 22:06:15 darrenr Exp $"; +#endif static ipfr_t *ipfr_heads[IPFT_SIZE]; @@ -141,12 +143,15 @@ fr_info_t *fin; u_int pass; ipfr_t *table[]; { - ipfr_t **fp, *fra, frag; - u_int idx; + ipfr_t **fp, *fra, frag; + u_int idx, off; if (ipfr_inuse >= IPFT_SIZE) return NULL; + if (!(fin->fin_fl & FI_FRAG)) + return NULL; + frag.ipfr_p = ip->ip_p; idx = ip->ip_p; frag.ipfr_id = ip->ip_id; @@ -160,6 +165,10 @@ ipfr_t *table[]; idx *= 127; idx %= IPFT_SIZE; + frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY; + frag.ipfr_secmsk = fin->fin_fi.fi_secmsk; + frag.ipfr_auth = fin->fin_fi.fi_auth; + /* * first, make sure it isn't already there... */ @@ -200,7 +209,10 @@ ipfr_t *table[]; /* * Compute the offset of the expected start of the next packet. */ - fra->ipfr_off = (ip->ip_off & IP_OFFMASK) + (fin->fin_dlen >> 3); + off = ip->ip_off & IP_OFFMASK; + if (!off) + fra->ipfr_seen0 = 1; + fra->ipfr_off = off + (fin->fin_dlen >> 3); ATOMIC_INCL(ipfr_stats.ifs_new); ATOMIC_INC32(ipfr_inuse); return fra; @@ -219,7 +231,12 @@ u_int pass; WRITE_ENTER(&ipf_frag); ipf = ipfr_new(ip, fin, pass, ipfr_heads); RWLOCK_EXIT(&ipf_frag); - return ipf ? 0 : -1; + if (ipf == NULL) { + ATOMIC_INCL(frstats[fin->fin_out].fr_bnfr); + return -1; + } + ATOMIC_INCL(frstats[fin->fin_out].fr_nfr); + return 0; } @@ -230,9 +247,16 @@ u_int pass; nat_t *nat; { ipfr_t *ipf; + int off; if ((ip->ip_v != 4) || (fr_frag_lock)) return -1; + + off = fin->fin_off; + off <<= 3; + if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0)) + return NULL; + WRITE_ENTER(&ipf_natfrag); ipf = ipfr_new(ip, fin, pass, ipfr_nattab); if (ipf != NULL) { @@ -254,8 +278,8 @@ fr_info_t *fin; ipfr_t *table[]; { ipfr_t *f, frag; - u_int idx; - + u_int idx; + /* * For fragments, we record protocol, packet id, TOS and both IP#'s * (these should all be the same for all fragments of a packet). @@ -275,6 +299,10 @@ ipfr_t *table[]; idx *= 127; idx %= IPFT_SIZE; + frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY; + frag.ipfr_secmsk = fin->fin_fi.fi_secmsk; + frag.ipfr_auth = fin->fin_fi.fi_auth; + /* * check the table, careful to only compare the right amount of data */ @@ -283,6 +311,20 @@ ipfr_t *table[]; IPFR_CMPSZ)) { u_short atoff, off; + off = fin->fin_off; + + /* + * XXX - We really need to be guarding against the + * retransmission of (src,dst,id,offset-range) here + * because a fragmented packet is never resent with + * the same IP ID#. + */ + if (f->ipfr_seen0) { + if (!off || (fin->fin_fl & FI_SHORT)) + continue; + } else if (!off) + f->ipfr_seen0 = 1; + if (f != table[idx]) { /* * move fragment info. to the top of the list @@ -295,7 +337,6 @@ ipfr_t *table[]; f->ipfr_prev = NULL; table[idx] = f; } - off = ip->ip_off & IP_OFFMASK; atoff = off + (fin->fin_dlen >> 3); /* * If we've follwed the fragments, and this is the @@ -321,11 +362,18 @@ nat_t *ipfr_nat_knownfrag(ip, fin) ip_t *ip; fr_info_t *fin; { - nat_t *nat; - ipfr_t *ipf; + ipfr_t *ipf; + nat_t *nat; + int off; - if ((ip->ip_v != 4) || (fr_frag_lock)) + if ((fin->fin_v != 4) || (fr_frag_lock)) + return NULL; + + off = fin->fin_off; + off <<= 3; + if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0)) return NULL; + READ_ENTER(&ipf_natfrag); ipf = ipfr_lookup(ip, fin, ipfr_nattab); if (ipf != NULL) { @@ -351,15 +399,24 @@ frentry_t *ipfr_knownfrag(ip, fin) ip_t *ip; fr_info_t *fin; { - frentry_t *fr = NULL; - ipfr_t *fra; + frentry_t *fr; + ipfr_t *fra; + int off; - if ((ip->ip_v != 4) || (fr_frag_lock)) + if ((fin->fin_v != 4) || (fr_frag_lock)) + return NULL; + + off = fin->fin_off; + off <<= 3; + if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0)) return NULL; + READ_ENTER(&ipf_frag); fra = ipfr_lookup(ip, fin, ipfr_heads); if (fra != NULL) fr = fra->ipfr_rule; + else + fr = NULL; RWLOCK_EXIT(&ipf_frag); return fr; } @@ -544,7 +601,11 @@ int ipfr_slowtimer() # if (__FreeBSD_version >= 300000) ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2); # else +# if defined(__OpenBSD_) + timeout_add(&ipfr_slowtimer_ch, hz/2, ipfr_slowtimer, NULL); +# else timeout(ipfr_slowtimer, NULL, hz/2); +# endif # endif # if (BSD < 199306) && !defined(__sgi) return 0; diff --git a/contrib/ipfilter/ip_frag.h b/contrib/ipfilter/ip_frag.h index 362bcdd..446510f 100644 --- a/contrib/ipfilter/ip_frag.h +++ b/contrib/ipfilter/ip_frag.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ip_frag.h 1.5 3/24/96 - * $Id: ip_frag.h,v 2.4.2.2 2000/11/10 13:10:54 darrenr Exp $ + * $Id: ip_frag.h,v 2.4.2.5 2001/06/26 10:43:13 darrenr Exp $ */ #ifndef __IP_FRAG_H__ @@ -20,11 +18,15 @@ typedef struct ipfr { struct in_addr ipfr_src; struct in_addr ipfr_dst; void *ipfr_ifp; + u_32_t ipfr_optmsk; + u_short ipfr_secmsk; + u_short ipfr_auth; u_short ipfr_id; u_char ipfr_p; u_char ipfr_tos; u_short ipfr_off; - u_short ipfr_ttl; + u_char ipfr_ttl; + u_char ipfr_seen0; frentry_t *ipfr_rule; } ipfr_t; @@ -40,7 +42,8 @@ typedef struct ipfrstat { struct ipfr **ifs_nattab; } ipfrstat_t; -#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1) +#define IPFR_CMPSZ (offsetof(ipfr_t, ipfr_off) - \ + offsetof(ipfr_t, ipfr_src)) extern int fr_ipfrttl; extern int fr_frag_lock; diff --git a/contrib/ipfilter/ip_ftp_pxy.c b/contrib/ipfilter/ip_ftp_pxy.c index ddca889..830a4f6 100644 --- a/contrib/ipfilter/ip_ftp_pxy.c +++ b/contrib/ipfilter/ip_ftp_pxy.c @@ -2,7 +2,7 @@ * Simple FTP transparent proxy for in-kernel use. For use with the NAT * code. * - * $Id: ip_ftp_pxy.c,v 2.7.2.20 2000/12/02 00:15:06 darrenr Exp $ + * $Id: ip_ftp_pxy.c,v 2.7.2.26 2001/07/15 13:50:54 darrenr Exp $ */ #if SOLARIS && defined(_KERNEL) extern kmutex_t ipf_rw; @@ -22,6 +22,22 @@ extern kmutex_t ipf_rw; #define IPF_MAX227LEN 51 #define IPF_FTPBUFSZ 96 /* This *MUST* be >= 53! */ +#define FTPXY_GO 0 +#define FTPXY_INIT 1 +#define FTPXY_USER_1 2 +#define FTPXY_USOK_1 3 +#define FTPXY_PASS_1 4 +#define FTPXY_PAOK_1 5 +#define FTPXY_AUTH_1 6 +#define FTPXY_AUOK_1 7 +#define FTPXY_ADAT_1 8 +#define FTPXY_ADOK_1 9 +#define FTPXY_ACCT_1 10 +#define FTPXY_ACOK_1 11 +#define FTPXY_USER_2 12 +#define FTPXY_USOK_2 13 +#define FTPXY_PASS_2 14 +#define FTPXY_PAOK_2 15 int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int)); int ippr_ftp_complete __P((char *, size_t)); @@ -75,6 +91,7 @@ nat_t *nat; f = &ftp->ftp_side[1]; f->ftps_rptr = f->ftps_buf; f->ftps_wptr = f->ftps_buf; + ftp->ftp_passok = FTPXY_INIT; return 0; } @@ -215,7 +232,7 @@ int dlen; sum2 -= sum1; sum2 = (sum2 & 0xffff) + (sum2 >> 16); - fix_outcksum(&ip->ip_sum, sum2); + fix_outcksum(fin, &ip->ip_sum, sum2); #endif ip->ip_len += inc; } @@ -255,6 +272,7 @@ int dlen; fi.fin_dlen = sizeof(*tcp2); fi.fin_dp = (char *)tcp2; fi.fin_fr = &natfr; + fi.fin_out = 1; swip = ip->ip_src; fi.fin_fi.fi_saddr = nat->nat_inip.s_addr; ip->ip_src = nat->nat_inip; @@ -297,11 +315,36 @@ int dlen; } cmd[i] = '\0'; - if ((ftp->ftp_passok == 0) && !strncmp(cmd, "USER ", 5)) - ftp->ftp_passok = 1; - else if ((ftp->ftp_passok == 2) && !strncmp(cmd, "PASS ", 5)) - ftp->ftp_passok = 3; - else if ((ftp->ftp_passok == 4) && !ippr_ftp_pasvonly && + ftp->ftp_incok = 0; + if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) { + if (ftp->ftp_passok == FTPXY_ADOK_1 || + ftp->ftp_passok == FTPXY_AUOK_1) { + ftp->ftp_passok = FTPXY_USER_2; + ftp->ftp_incok = 1; + } else { + ftp->ftp_passok = FTPXY_USER_1; + ftp->ftp_incok = 1; + } + } else if (!strncmp(cmd, "AUTH ", 5)) { + ftp->ftp_passok = FTPXY_AUTH_1; + ftp->ftp_incok = 1; + } else if (!strncmp(cmd, "PASS ", 5)) { + if (ftp->ftp_passok == FTPXY_USOK_1) { + ftp->ftp_passok = FTPXY_PASS_1; + ftp->ftp_incok = 1; + } else if (ftp->ftp_passok == FTPXY_USOK_2) { + ftp->ftp_passok = FTPXY_PASS_2; + ftp->ftp_incok = 1; + } + } else if ((ftp->ftp_passok == FTPXY_AUOK_1) && + !strncmp(cmd, "ADAT ", 5)) { + ftp->ftp_passok = FTPXY_ADAT_1; + ftp->ftp_incok = 1; + } else if ((ftp->ftp_passok == FTPXY_PAOK_2) && + !strncmp(cmd, "ACCT ", 5)) { + ftp->ftp_passok = FTPXY_ACCT_1; + ftp->ftp_incok = 1; + } else if ((ftp->ftp_passok == FTPXY_GO) && !ippr_ftp_pasvonly && !strncmp(cmd, "PORT ", 5)) { inc = ippr_ftp_port(fin, ip, nat, f, dlen); } else if (ippr_ftp_insecure && !ippr_ftp_pasvonly && @@ -332,12 +375,13 @@ int dlen; int inc; char *s; +#define PASV_REPLEN 24 /* * Check for PASV reply message. */ if (dlen < IPF_MIN227LEN) return 0; - else if (strncmp(f->ftps_rptr, "227 Entering Passive Mode", 25)) + else if (strncmp(f->ftps_rptr, "227 Entering Passive Mod", PASV_REPLEN)) return 0; tcp = (tcphdr_t *)fin->fin_dp; @@ -345,7 +389,7 @@ int dlen; /* * Skip the PORT command + space */ - s = f->ftps_rptr + 25; + s = f->ftps_rptr + PASV_REPLEN; while (*s && !isdigit(*s)) s++; /* @@ -373,6 +417,8 @@ int dlen; if (*s == ')') s++; + if (*s == '.') + s++; if (*s == '\n') s--; /* @@ -445,7 +491,7 @@ int dlen; sum2 -= sum1; sum2 = (sum2 & 0xffff) + (sum2 >> 16); - fix_outcksum(&ip->ip_sum, sum2); + fix_outcksum(fin, &ip->ip_sum, sum2); #endif /* SOLARIS || defined(__sgi) */ ip->ip_len += inc; } @@ -469,12 +515,13 @@ int dlen; tcp2->th_win = htons(8192); tcp2->th_sport = 0; /* XXX - fake it for nat_new */ tcp2->th_off = 5; - fi.fin_data[1] = a5 << 8 | a6; + fi.fin_data[0] = a5 << 8 | a6; fi.fin_dlen = sizeof(*tcp2); - tcp2->th_dport = htons(fi.fin_data[1]); - fi.fin_data[0] = 0; + tcp2->th_dport = htons(fi.fin_data[0]); + fi.fin_data[1] = 0; fi.fin_dp = (char *)tcp2; fi.fin_fr = &natfr; + fi.fin_out = 1; swip = ip->ip_src; swip2 = ip->ip_dst; fi.fin_fi.fi_daddr = ip->ip_src.s_addr; @@ -511,17 +558,38 @@ int dlen; rptr = f->ftps_rptr; wptr = f->ftps_wptr; - if ((ftp->ftp_passok == 1) && !strncmp(rptr, "331", 3)) - ftp->ftp_passok = 2; - else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "230", 3)) - ftp->ftp_passok = 4; - else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "530", 3)) - ftp->ftp_passok = 0; - else if ((ftp->ftp_passok == 4) && !strncmp(rptr, "227 ", 4)) { - inc = ippr_ftp_pasv(fin, ip, nat, f, dlen); + if (!isdigit(*rptr) || !isdigit(*(rptr + 1)) || !isdigit(*(rptr + 2))) + return inc; + if (ftp->ftp_passok == FTPXY_GO) { + if (!strncmp(rptr, "227 ", 4)) + inc = ippr_ftp_pasv(fin, ip, nat, f, dlen); } else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) { inc = ippr_ftp_pasv(fin, ip, nat, f, dlen); + } else if (*rptr == '5' || *rptr == '4') + ftp->ftp_passok = FTPXY_INIT; + else if (ftp->ftp_incok) { + if (*rptr == '3') { + if (ftp->ftp_passok == FTPXY_ACCT_1) + ftp->ftp_passok = FTPXY_GO; + else + ftp->ftp_passok++; + } else if (*rptr == '2') { + switch (ftp->ftp_passok) + { + case FTPXY_USER_1 : + case FTPXY_USER_2 : + case FTPXY_PASS_1 : + case FTPXY_PASS_2 : + case FTPXY_ACCT_1 : + ftp->ftp_passok = FTPXY_GO; + break; + default : + ftp->ftp_passok += 3; + break; + } + } } + ftp->ftp_incok = 0; while ((*rptr++ != '\n') && (rptr < wptr)) ; f->ftps_rptr = rptr; diff --git a/contrib/ipfilter/ip_lfil.c b/contrib/ipfilter/ip_lfil.c index 4763ad7..14e6b42 100644 --- a/contrib/ipfilter/ip_lfil.c +++ b/contrib/ipfilter/ip_lfil.c @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #if !defined(lint) -static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6 2000/03/13 22:10:21 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6.2.2 2001/07/18 14:57:09 darrenr Exp $"; #endif #if defined(KERNEL) && !defined(_KERNEL) @@ -337,7 +335,7 @@ int iplioctl(dev_t dev, int cmd, caddr_t data, int mode) break; } case SIOCATHST : - error = fr_auth_ioctl(data, cmd, NULL, NULL); + error = fr_auth_ioctl(data, mode, cmd, NULL, NULL); break; case SIOCFRSYN : if (!(mode & FWRITE)) @@ -484,7 +482,7 @@ caddr_t data; if (fg && fg->fg_head) fg->fg_head->fr_ref--; if (unit == IPL_LOGAUTH) - return fr_auth_ioctl(data, req, f, ftail); + return fr_auth_ioctl(data, mode, req, f, ftail); if (f->fr_grhead) fr_delgroup((u_int)f->fr_grhead, fp->fr_flags, unit, set); @@ -497,7 +495,7 @@ caddr_t data; error = EEXIST; else { if (unit == IPL_LOGAUTH) - return fr_auth_ioctl(data, req, f, ftail); + return fr_auth_ioctl(data, mode, req, f, ftail); KMALLOC(f, frentry_t *); if (f != NULL) { if (fg && fg->fg_head) diff --git a/contrib/ipfilter/ip_log.c b/contrib/ipfilter/ip_log.c index 8adc410..5968f46 100644 --- a/contrib/ipfilter/ip_log.c +++ b/contrib/ipfilter/ip_log.c @@ -1,11 +1,9 @@ /* - * Copyright (C) 1997-2000 by Darren Reed. + * Copyright (C) 1997-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * - * $Id: ip_log.c,v 2.5.2.2 2000/08/13 03:50:41 darrenr Exp $ + * $Id: ip_log.c,v 2.5.2.5 2001/06/26 10:43:14 darrenr Exp $ */ #include <sys/param.h> #if defined(KERNEL) && !defined(_KERNEL) @@ -21,7 +19,13 @@ # endif # else # ifdef KLD_MODULE -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif # endif # endif #endif @@ -45,7 +49,7 @@ # include <sys/ioctl.h> # endif # include <sys/time.h> -# if defined(_KERNEL) && !defined(linux) +# if defined(_KERNEL) # include <sys/systm.h> # endif # include <sys/uio.h> @@ -55,9 +59,7 @@ # else # include <sys/dir.h> # endif -# ifndef linux -# include <sys/mbuf.h> -# endif +# include <sys/mbuf.h> # else # include <sys/filio.h> # include <sys/cred.h> @@ -69,9 +71,7 @@ # include <sys/dditypes.h> # include <sys/cmn_err.h> # endif -# ifndef linux -# include <sys/protosw.h> -# endif +# include <sys/protosw.h> # include <sys/socket.h> # include <net/if.h> @@ -89,7 +89,7 @@ # include <sys/hashing.h> # endif # endif -# if !defined(linux) && !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/ +# if !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/ # include <netinet/in_var.h> # endif # include <netinet/in_systm.h> @@ -97,9 +97,7 @@ # include <netinet/tcp.h> # include <netinet/udp.h> # include <netinet/ip_icmp.h> -# ifndef linux -# include <netinet/ip_var.h> -# endif +# include <netinet/ip_var.h> # ifndef _KERNEL # include <syslog.h> # endif @@ -130,9 +128,6 @@ extern kcondvar_t iplwait; iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1], *ipll[IPL_LOGMAX+1]; size_t iplused[IPL_LOGMAX+1]; static fr_info_t iplcrc[IPL_LOGMAX+1]; -# ifdef linux -static struct wait_queue *iplwait[IPL_LOGMAX+1]; -# endif /* @@ -229,9 +224,7 @@ mb_t *m; (defined(OpenBSD) && (OpenBSD >= 199603)) strncpy(ipfl.fl_ifname, ifp->if_xname, IFNAMSIZ); # else -# ifndef linux ipfl.fl_unit = (u_char)ifp->if_unit; -# endif if ((ipfl.fl_ifname[0] = ifp->if_name[0])) if ((ipfl.fl_ifname[1] = ifp->if_name[1])) if ((ipfl.fl_ifname[2] = ifp->if_name[2])) @@ -337,7 +330,7 @@ int *types, cnt; ipl->ipl_count = 1; ipl->ipl_next = NULL; ipl->ipl_dsize = len; -# if SOLARIS || defined(sun) || defined(linux) +# if SOLARIS || defined(sun) uniqtime((struct timeval *)&ipl->ipl_sec); # else # if BSD >= 199306 || defined(__FreeBSD__) || defined(__sgi) @@ -370,11 +363,7 @@ int *types, cnt; mutex_exit(&ipl_mutex); # else MUTEX_EXIT(&ipl_mutex); -# ifdef linux - wake_up_interruptible(&iplwait[dev]); -# else wakeup(&iplh[dev]); -# endif # endif return 1; } @@ -399,8 +388,7 @@ struct uio *uio; return ENXIO; if (!uio->uio_resid) return 0; - if ((uio->uio_resid < sizeof(iplog_t)) || - (uio->uio_resid > IPLLOGSIZE)) + if (uio->uio_resid < sizeof(iplog_t)) return EINVAL; /* @@ -417,19 +405,13 @@ struct uio *uio; return EINTR; } # else -# ifdef linux - interruptible_sleep_on(&iplwait[unit]); - if (current->signal & ~current->blocked) - return -EINTR; -# else MUTEX_EXIT(&ipl_mutex); - SPL_X(s); error = SLEEP(&iplh[unit], "ipl sleep"); - if (error) + if (error) { + SPL_X(s); return error; - SPL_NET(s); + } MUTEX_ENTER(&ipl_mutex); -# endif /* linux */ # endif /* SOLARIS */ } @@ -447,10 +429,8 @@ struct uio *uio; iplt[unit] = ipl->ipl_next; iplused[unit] -= dlen; MUTEX_EXIT(&ipl_mutex); - SPL_X(s); error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio); if (error) { - SPL_NET(s); MUTEX_ENTER(&ipl_mutex); ipl->ipl_next = iplt[unit]; iplt[unit] = ipl; @@ -458,7 +438,6 @@ struct uio *uio; break; } KFREES((caddr_t)ipl, dlen); - SPL_NET(s); MUTEX_ENTER(&ipl_mutex); } if (!iplt[unit]) { @@ -469,13 +448,7 @@ struct uio *uio; MUTEX_EXIT(&ipl_mutex); SPL_X(s); -# ifdef linux - if (!error) - return (int)copied; - return -error; -# else return error; -# endif } diff --git a/contrib/ipfilter/ip_nat.c b/contrib/ipfilter/ip_nat.c index e7e121a..eb6e133 100644 --- a/contrib/ipfilter/ip_nat.c +++ b/contrib/ipfilter/ip_nat.c @@ -1,17 +1,10 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com) */ -#if !defined(lint) -static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.32 2001/01/10 06:19:11 darrenr Exp $"; -#endif - #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) #define _KERNEL #endif @@ -91,6 +84,7 @@ extern struct ifnet vpnif; #ifndef linux # include <netinet/ip_var.h> +# include <netinet/tcp_fsm.h> #endif #include <netinet/tcp.h> #include <netinet/udp.h> @@ -111,6 +105,11 @@ extern struct ifnet vpnif; #undef SOCKADDR_IN #define SOCKADDR_IN struct sockaddr_in +#if !defined(lint) +static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.44 2001/07/21 07:17:22 darrenr Exp $"; +#endif + nat_t **nat_table[2] = { NULL, NULL }, *nat_instances = NULL; ipnat_t *nat_list = NULL; @@ -301,7 +300,8 @@ struct hostmap *hm; } -void fix_outcksum(sp, n) +void fix_outcksum(fin, sp, n) +fr_info_t *fin; u_short *sp; u_32_t n; { @@ -310,12 +310,13 @@ u_32_t n; if (!n) return; -#if SOLARIS2 >= 6 else if (n & NAT_HW_CKSUM) { + n &= 0xffff; + n += fin->fin_dlen; + n = (n & 0xffff) + (n >> 16); *sp = n & 0xffff; return; } -#endif sum1 = (~ntohs(*sp)) & 0xffff; sum1 += (n); sum1 = (sum1 >> 16) + (sum1 & 0xffff); @@ -326,7 +327,8 @@ u_32_t n; } -void fix_incksum(sp, n) +void fix_incksum(fin, sp, n) +fr_info_t *fin; u_short *sp; u_32_t n; { @@ -335,12 +337,13 @@ u_32_t n; if (!n) return; -#if SOLARIS2 >= 6 else if (n & NAT_HW_CKSUM) { + n &= 0xffff; + n += fin->fin_dlen; + n = (n & 0xffff) + (n >> 16); *sp = n & 0xffff; return; } -#endif #ifdef sparc sum1 = (~(*sp)) & 0xffff; #else @@ -625,9 +628,11 @@ int mode; nat_stats.ns_table[0] = nat_table[0]; nat_stats.ns_table[1] = nat_table[1]; nat_stats.ns_list = nat_list; + nat_stats.ns_maptable = maptable; nat_stats.ns_nattab_sz = ipf_nattable_sz; nat_stats.ns_rultab_sz = ipf_natrules_sz; nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz; + nat_stats.ns_hostmap_sz = ipf_hostmap_sz; nat_stats.ns_instances = nat_instances; nat_stats.ns_apslist = ap_sess_list; error = IWCOPYPTR((char *)&nat_stats, (char *)data, @@ -1395,14 +1400,14 @@ int direction; CALC_SUMD(sum1, sum2, sumd); nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) - if ((flags == IPN_TCP) && dohwcksum && + if ((flags & IPN_TCPUDP) && dohwcksum && (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) { if (direction == NAT_OUTBOUND) sum1 = LONG_SUM(ntohl(in.s_addr)); else sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr)); - sum1 += 30; + sum1 += IPPROTO_TCP; sum1 = (sum1 & 0xffff) + (sum1 >> 16); nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff); } else @@ -1463,8 +1468,8 @@ badnat: void nat_insert(nat) nat_t *nat; { + u_int hv1, hv2; nat_t **natp; - u_int hv; MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL); @@ -1477,18 +1482,30 @@ nat_t *nat; nat->nat_next = nat_instances; nat_instances = nat; - hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, - ipf_nattable_sz); - natp = &nat_table[0][hv]; + if (!(nat->nat_flags & (FI_W_SPORT|FI_W_DPORT))) { + hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, + 0xffffffff); + hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport, + ipf_nattable_sz); + hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, + 0xffffffff); + hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport, + ipf_nattable_sz); + } else { + hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff); + hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, ipf_nattable_sz); + hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff); + hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, ipf_nattable_sz); + } + + natp = &nat_table[0][hv1]; if (*natp) (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; nat->nat_phnext[0] = natp; nat->nat_hnext[0] = *natp; *natp = nat; - hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, - ipf_nattable_sz); - natp = &nat_table[1][hv]; + natp = &nat_table[1][hv2]; if (*natp) (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; nat->nat_phnext[1] = natp; @@ -1604,7 +1621,7 @@ int dir; ip_t *oip; int flags = 0; - if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) + if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) return NULL; /* * nat_icmplookup() will return NULL for `defective' packets. @@ -1878,13 +1895,14 @@ int dir; sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); if (nat->nat_dir == NAT_OUTBOUND) { - fix_outcksum(&icmp->icmp_cksum, sumd2); + fix_outcksum(fin, &icmp->icmp_cksum, sumd2); } else { - fix_incksum(&icmp->icmp_cksum, sumd2); + fix_incksum(fin, &icmp->icmp_cksum, sumd2); } } } - nat->nat_age = fr_defnaticmpage; + if (oip->ip_p == IPPROTO_ICMP) + nat->nat_age = fr_defnaticmpage; return nat; } @@ -1917,7 +1935,8 @@ int rw; sport = ports & 0xffff; flags &= IPN_TCPUDP; - hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz); + hv = NAT_HASH_FN(dst, dport, 0xffffffff); + hv = NAT_HASH_FN(src.s_addr, hv + sport, ipf_nattable_sz); nat = nat_table[1][hv]; for (; nat; nat = nat->nat_hnext[1]) { nflags = nat->nat_flags; @@ -1935,7 +1954,8 @@ int rw; if (!rw) { RWLOCK_EXIT(&ipf_nat); } - hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz); + hv = NAT_HASH_FN(dst, 0, 0xffffffff); + hv = NAT_HASH_FN(src.s_addr, hv, ipf_nattable_sz); if (!rw) { WRITE_ENTER(&ipf_nat); } @@ -1999,7 +2019,8 @@ u_32_t ports; /* * Add into the NAT table in the new position */ - hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, ipf_nattable_sz); + hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, 0xffffffff); + hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz); natp = &nat_table[0][hv]; if (*natp) (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; @@ -2007,7 +2028,8 @@ u_32_t ports; nat->nat_hnext[0] = *natp; *natp = nat; - hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, ipf_nattable_sz); + hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, 0xffffffff); + hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz); natp = &nat_table[1][hv]; if (*natp) (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; @@ -2041,7 +2063,8 @@ int rw; flags &= IPN_TCPUDP; srcip = src.s_addr; - hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz); + hv = NAT_HASH_FN(srcip, sport, 0xffffffff); + hv = NAT_HASH_FN(dst.s_addr, hv + dport, ipf_nattable_sz); nat = nat_table[0][hv]; for (; nat; nat = nat->nat_hnext[0]) { nflags = nat->nat_flags; @@ -2061,6 +2084,7 @@ int rw; RWLOCK_EXIT(&ipf_nat); } hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz); + hv = NAT_HASH_FN(dst.s_addr, hv, ipf_nattable_sz); if (!rw) { WRITE_ENTER(&ipf_nat); } @@ -2145,8 +2169,8 @@ ip_t *ip; } ft = &np->in_tuc; - if (!(fin->fin_fi.fi_fl & FI_TCPUDP) || - (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) { + if (!(fin->fin_fl & FI_TCPUDP) || + (fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) { if (ft->ftu_scmp || ft->ftu_dcmp) return 0; return 1; @@ -2168,13 +2192,12 @@ fr_info_t *fin; register u_32_t ipa; tcphdr_t *tcp = NULL; u_short sport = 0, dport = 0, *csump = NULL; + int natadd = 1, i, icmpset = 1; + u_int nflags = 0, hv, msk; struct ifnet *ifp; - int natadd = 1; frentry_t *fr; - u_int nflags = 0, hv, msk; u_32_t iph; nat_t *nat; - int i; if (nat_list == NULL || (fr_nat_lock)) return 0; @@ -2185,7 +2208,7 @@ fr_info_t *fin; else ifp = fin->fin_ifp; - if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { + if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) { if (ip->ip_p == IPPROTO_TCP) nflags = IPN_TCP; else if (ip->ip_p == IPPROTO_UDP) @@ -2203,8 +2226,8 @@ fr_info_t *fin; if ((ip->ip_p == IPPROTO_ICMP) && (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND))) - ; - else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && + icmpset = 1; + else if ((fin->fin_fl & FI_FRAG) && (nat = ipfr_nat_knownfrag(ip, fin))) natadd = 0; else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p, @@ -2238,8 +2261,7 @@ maskloop: hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz); for (np = nat_rules[hv]; np; np = np->in_mnext) { - if ((np->in_ifp && (np->in_ifp != ifp)) || - !np->in_space) + if (np->in_ifp && (np->in_ifp != ifp)) continue; if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) @@ -2283,7 +2305,7 @@ maskloop: */ if (nat) { np = nat->nat_ptr; - if (natadd && fin->fin_fi.fi_fl & FI_FRAG) + if (natadd && (fin->fin_fl & FI_FRAG) && np) ipfr_nat_newfrag(ip, fin, 0, nat); MUTEX_ENTER(&nat->nat_lock); nat->nat_age = fr_defnatage; @@ -2303,22 +2325,21 @@ maskloop: CALC_SUMD(s1, s2, sumd); if (nat->nat_dir == NAT_OUTBOUND) - fix_incksum(&ip->ip_sum, sumd); + fix_incksum(fin, &ip->ip_sum, sumd); else - fix_outcksum(&ip->ip_sum, sumd); + fix_outcksum(fin, &ip->ip_sum, sumd); } #if SOLARIS || defined(__sgi) else { if (nat->nat_dir == NAT_OUTBOUND) - fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); + fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd); else - fix_incksum(&ip->ip_sum, nat->nat_ipsumd); + fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd); } #endif ip->ip_src = nat->nat_outip; - if (!(ip->ip_off & IP_OFFMASK) && - !(fin->fin_fi.fi_fl & FI_SHORT)) { + if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) { if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { tcp->th_sport = nat->nat_outport; @@ -2351,14 +2372,15 @@ maskloop: if (udp->uh_sum) csump = &udp->uh_sum; } else if (ip->ip_p == IPPROTO_ICMP) { - nat->nat_age = fr_defnaticmpage; + if (!icmpset) + nat->nat_age = fr_defnaticmpage; } if (csump) { if (nat->nat_dir == NAT_OUTBOUND) - fix_outcksum(csump, nat->nat_sumd[1]); + fix_outcksum(fin, csump, nat->nat_sumd[1]); else - fix_incksum(csump, nat->nat_sumd[1]); + fix_incksum(fin, csump, nat->nat_sumd[1]); } } @@ -2389,18 +2411,18 @@ fr_info_t *fin; register struct in_addr src; register struct in_addr in; register ipnat_t *np; + u_short sport = 0, dport = 0, *csump = NULL; u_int nflags = 0, natadd = 1, hv, msk; struct ifnet *ifp = fin->fin_ifp; tcphdr_t *tcp = NULL; - u_short sport = 0, dport = 0, *csump = NULL; + int i, icmpset = 0; nat_t *nat; u_32_t iph; - int i; if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock)) return 0; - if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { + if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) { if (ip->ip_p == IPPROTO_TCP) nflags = IPN_TCP; else if (ip->ip_p == IPPROTO_UDP) @@ -2420,8 +2442,8 @@ fr_info_t *fin; if ((ip->ip_p == IPPROTO_ICMP) && (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND))) - ; - else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && + icmpset = 1; + else if ((fin->fin_fl & FI_FRAG) && (nat = ipfr_nat_knownfrag(ip, fin))) natadd = 0; else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p, @@ -2488,7 +2510,7 @@ maskloop: if (nat) { np = nat->nat_ptr; fin->fin_fr = nat->nat_fr; - if (natadd && fin->fin_fi.fi_fl & FI_FRAG) + if (natadd && (fin->fin_fl & FI_FRAG) && np) ipfr_nat_newfrag(ip, fin, 0, nat); if ((np->in_apr != NULL) && (np->in_dport == 0 || (tcp != NULL && sport == np->in_dport))) { @@ -2515,12 +2537,11 @@ maskloop: */ #if SOLARIS || defined(__sgi) if (nat->nat_dir == NAT_OUTBOUND) - fix_incksum(&ip->ip_sum, nat->nat_ipsumd); + fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd); else - fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); + fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd); #endif - if (!(ip->ip_off & IP_OFFMASK) && - !(fin->fin_fi.fi_fl & FI_SHORT)) { + if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) { if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { tcp->th_dport = nat->nat_inport; @@ -2553,14 +2574,15 @@ maskloop: if (udp->uh_sum) csump = &udp->uh_sum; } else if (ip->ip_p == IPPROTO_ICMP) { - nat->nat_age = fr_defnaticmpage; + if (!icmpset) + nat->nat_age = fr_defnaticmpage; } if (csump) { if (nat->nat_dir == NAT_OUTBOUND) - fix_incksum(csump, nat->nat_sumd[0]); + fix_incksum(fin, csump, nat->nat_sumd[0]); else - fix_outcksum(csump, nat->nat_sumd[0]); + fix_outcksum(fin, csump, nat->nat_sumd[0]); } } ATOMIC_INCL(nat_stats.ns_mapped[0]); diff --git a/contrib/ipfilter/ip_nat.h b/contrib/ipfilter/ip_nat.h index 22f8503..f712dfc 100644 --- a/contrib/ipfilter/ip_nat.h +++ b/contrib/ipfilter/ip_nat.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ip_nat.h 1.5 2/4/96 - * $Id: ip_nat.h,v 2.17.2.14 2000/11/18 03:58:04 darrenr Exp $ + * $Id: ip_nat.h,v 2.17.2.20 2001/06/26 10:43:15 darrenr Exp $ */ #ifndef __IP_NAT_H__ @@ -35,10 +33,18 @@ * appropriate sizes. The figures below were used for * a setup with 1000-2000 networks to NAT. */ -#define NAT_SIZE 127 -#define RDR_SIZE 127 -#define HOSTMAP_SIZE 127 -#define NAT_TABLE_SZ 127 +#ifndef NAT_SIZE +# define NAT_SIZE 127 +#endif +#ifndef RDR_SIZE +# define RDR_SIZE 127 +#endif +#ifndef HOSTMAP_SIZE +# define HOSTMAP_SIZE 127 +#endif +#ifndef NAT_TABLE_SZ +# define NAT_TABLE_SZ 127 +#endif #ifdef LARGE_NAT #undef NAT_SIZE #undef RDR_SIZE @@ -201,11 +207,13 @@ typedef struct natstat { u_long ns_memfail; u_long ns_badnat; nat_t **ns_table[2]; + hostmap_t **ns_maptable; ipnat_t *ns_list; void *ns_apslist; u_int ns_nattab_sz; u_int ns_rultab_sz; u_int ns_rdrtab_sz; + u_int ns_hostmap_sz; nat_t *ns_instances; u_int ns_wilds; } natstat_t; @@ -220,12 +228,13 @@ typedef struct natstat { #define IPN_AUTOPORTMAP 0x010 #define IPN_IPRANGE 0x020 #define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\ - IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST) + IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|IPN_FRAG) #define IPN_FILTER 0x040 #define IPN_SPLIT 0x080 #define IPN_ROUNDR 0x100 #define IPN_NOTSRC 0x080000 #define IPN_NOTDST 0x100000 +#define IPN_FRAG 0x200000 typedef struct natlog { @@ -300,8 +309,8 @@ extern int ip_natout __P((ip_t *, fr_info_t *)); extern int ip_natin __P((ip_t *, fr_info_t *)); extern void ip_natunload __P((void)), ip_natexpire __P((void)); extern void nat_log __P((struct nat *, u_int)); -extern void fix_incksum __P((u_short *, u_32_t)); -extern void fix_outcksum __P((u_short *, u_32_t)); +extern void fix_incksum __P((fr_info_t *, u_short *, u_32_t)); +extern void fix_outcksum __P((fr_info_t *, u_short *, u_32_t)); extern void fix_datacksum __P((u_short *, u_32_t)); #endif /* __IP_NAT_H__ */ diff --git a/contrib/ipfilter/ip_proxy.c b/contrib/ipfilter/ip_proxy.c index e1e55f1..325f362 100644 --- a/contrib/ipfilter/ip_proxy.c +++ b/contrib/ipfilter/ip_proxy.c @@ -1,14 +1,8 @@ /* - * Copyright (C) 1997-2000 by Darren Reed. + * Copyright (C) 1997-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 darrenr Exp $"; -#endif - #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) # define _KERNEL #endif @@ -78,6 +72,10 @@ static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 d # include <sys/malloc.h> #endif +#if !defined(lint) +static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.6 2001/07/15 22:06:15 darrenr Exp $"; +#endif + #ifndef MIN #define MIN(a,b) (((a)<(b))?(a):(b)) @@ -216,9 +214,13 @@ ip_t *ip; fr_info_t *fin; nat_t *nat; { +#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) + mb_t *m = fin->fin_qfm; + int dosum = 1; +#endif + tcphdr_t *tcp = NULL; ap_session_t *aps; aproxy_t *apr; - tcphdr_t *tcp = NULL; u_32_t sum; short rv; int err; @@ -234,8 +236,13 @@ nat_t *nat; * verify that the checksum is correct. If not, then * don't do anything with this packet. */ -#if SOLARIS && defined(_KERNEL) - sum = fr_tcpsum(fin->fin_qfm, ip, tcp); +#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) + if (dohwcksum && (m->b_ick_flag == ICK_VALID)) { + sum = tcp->th_sum; + dosum = 0; + } + if (dosum) + sum = fr_tcpsum(fin->fin_qfm, ip, tcp); #else sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp); #endif @@ -261,8 +268,9 @@ nat_t *nat; if (tcp != NULL) { err = appr_fixseqack(fin, ip, aps, APR_INC(err)); -#if SOLARIS && defined(_KERNEL) - tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp); +#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) + if (dosum) + tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp); #else tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp); #endif diff --git a/contrib/ipfilter/ip_proxy.h b/contrib/ipfilter/ip_proxy.h index 212900f..b8c8eb0 100644 --- a/contrib/ipfilter/ip_proxy.h +++ b/contrib/ipfilter/ip_proxy.h @@ -1,11 +1,9 @@ /* - * Copyright (C) 1997-2000 by Darren Reed. + * Copyright (C) 1997-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * - * $Id: ip_proxy.h,v 2.8.2.4 2000/12/02 00:15:03 darrenr Exp $ + * $Id: ip_proxy.h,v 2.8.2.7 2001/06/26 10:43:16 darrenr Exp $ */ #ifndef __IP_PROXY_H__ @@ -102,7 +100,8 @@ typedef struct ftpside { } ftpside_t; typedef struct ftpinfo { - u_int ftp_passok; + int ftp_passok; + int ftp_incok; ftpside_t ftp_side[2]; } ftpinfo_t; diff --git a/contrib/ipfilter/ip_raudio_pxy.c b/contrib/ipfilter/ip_raudio_pxy.c index 9ea437c..476e159 100644 --- a/contrib/ipfilter/ip_raudio_pxy.c +++ b/contrib/ipfilter/ip_raudio_pxy.c @@ -1,5 +1,5 @@ /* - * $Id: ip_raudio_pxy.c,v 1.7.2.3 2000/10/27 22:54:04 darrenr Exp $ + * $Id: ip_raudio_pxy.c,v 1.7.2.6 2001/07/23 04:17:56 darrenr Exp $ */ #if SOLARIS && defined(_KERNEL) extern kmutex_t ipf_rw; @@ -62,8 +62,8 @@ nat_t *nat; raudio_t *rap = aps->aps_data; unsigned char membuf[512 + 1], *s; u_short id = 0; - tcphdr_t *tcp; int off, dlen; + tcphdr_t *tcp; int len = 0; mb_t *m; #if SOLARIS @@ -86,14 +86,16 @@ nat_t *nat; dlen = msgdsize(m) - off; if (dlen <= 0) return 0; - copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf); + dlen = MIN(sizeof(membuf), dlen); + copyout_mblk(m, off, dlen, (char *)membuf); #else m = *(mb_t **)fin->fin_mp; dlen = mbufchainlen(m) - off; if (dlen <= 0) return 0; - m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf); + dlen = MIN(sizeof(membuf), dlen); + m_copydata(m, off, dlen, (char *)membuf); #endif /* * In all the startup parsing, ensure that we don't go outside @@ -170,8 +172,8 @@ nat_t *nat; unsigned char membuf[IPF_MAXPORTLEN + 1], *s; tcphdr_t *tcp, tcph, *tcp2 = &tcph; raudio_t *rap = aps->aps_data; + int off, dlen, slen, clen; struct in_addr swa, swb; - int off, dlen, slen; int a1, a2, a3, a4; u_short sp, dp; fr_info_t fi; @@ -202,13 +204,15 @@ nat_t *nat; if (dlen <= 0) return 0; bzero(membuf, sizeof(membuf)); - copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf); + clen = MIN(sizeof(membuf), dlen); + copyout_mblk(m, off, clen, (char *)membuf); #else dlen = mbufchainlen(m) - off; if (dlen <= 0) return 0; bzero(membuf, sizeof(membuf)); - m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf); + clen = MIN(sizeof(membuf), dlen); + m_copydata(m, off, clen, (char *)membuf); #endif seq = ntohl(tcp->th_seq); @@ -217,7 +221,7 @@ nat_t *nat; * We only care for the first 19 bytes coming back from the server. */ if (rap->rap_sseq == 0) { - s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen); + s = (u_char *)memstr("PNA", (char *)membuf, 3, clen); if (s == NULL) return 0; a1 = s - membuf; @@ -278,6 +282,7 @@ nat_t *nat; tcp2->th_dport = htons(dp); fi.fin_data[0] = dp; fi.fin_data[1] = sp; + fi.fin_out = 0; ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP | (sp ? 0 : FI_W_SPORT), NAT_OUTBOUND); if (ipn != NULL) { @@ -292,6 +297,7 @@ nat_t *nat; tcp2->th_dport = 0; /* XXX - don't specify remote port */ fi.fin_data[0] = sp; fi.fin_data[1] = 0; + fi.fin_out = 1; ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT, NAT_OUTBOUND); if (ipn != NULL) { diff --git a/contrib/ipfilter/ip_sfil.c b/contrib/ipfilter/ip_sfil.c index f6373811..26ef65f 100644 --- a/contrib/ipfilter/ip_sfil.c +++ b/contrib/ipfilter/ip_sfil.c @@ -1,15 +1,13 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * I hate legaleese, don't you ? */ #if !defined(lint) static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.9 2000/11/12 11:55:17 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.12 2001/07/18 14:57:09 darrenr Exp $"; #endif #include <sys/types.h> @@ -197,7 +195,7 @@ int *rp; return error; } if (unit == IPL_LOGAUTH) { - error = fr_auth_ioctl((caddr_t)data, cmd, NULL, NULL); + error = fr_auth_ioctl((caddr_t)data, mode, cmd, NULL, NULL); RWLOCK_EXIT(&ipf_solaris); return error; } @@ -458,6 +456,7 @@ caddr_t data; } fdp = &fp->fr_dif; + fdp->fd_mp = NULL; fp->fr_flags &= ~FR_DUP; if (*fdp->fd_ifname) { ill = get_unit(fdp->fd_ifname, (int)fp->fr_v); @@ -491,6 +490,7 @@ caddr_t data; } fdp = &fp->fr_tif; + fdp->fd_mp = NULL; if (*fdp->fd_ifname) { ill = get_unit(fdp->fd_ifname, (int)fp->fr_v); if (!ill) @@ -577,10 +577,6 @@ caddr_t data; } if (fg && fg->fg_head) fg->fg_head->fr_ref--; - if (unit == IPL_LOGAUTH) { - error = fr_auth_ioctl(data, req, fp, ftail); - goto out; - } if (f->fr_grhead) fr_delgroup(f->fr_grhead, fp->fr_flags, unit, set); @@ -594,10 +590,6 @@ caddr_t data; if (f) { error = EEXIST; } else { - if (unit == IPL_LOGAUTH) { - error = fr_auth_ioctl(data, req, fp, ftail); - goto out; - } KMALLOC(f, frentry_t *); if (f != NULL) { if (fg && fg->fg_head) diff --git a/contrib/ipfilter/ip_state.c b/contrib/ipfilter/ip_state.c index 5d63969..649ad93 100644 --- a/contrib/ipfilter/ip_state.c +++ b/contrib/ipfilter/ip_state.c @@ -1,15 +1,8 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46 darrenr Exp $"; -#endif - #include <sys/errno.h> #include <sys/types.h> #include <sys/param.h> @@ -97,6 +90,11 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46 # endif #endif +#if !defined(lint) +static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.38 2001/07/23 13:49:46 darrenr Exp $"; +#endif + #ifndef MIN # define MIN(a,b) (((a)<(b))?(a):(b)) #endif @@ -140,7 +138,9 @@ u_long fr_tcpidletimeout = FIVE_DAYS, fr_tcpclosed = 120, fr_tcphalfclosed = 2 * 2 * 3600, /* 2 hours */ fr_udptimeout = 240, - fr_icmptimeout = 120; + fr_udpacktimeout = 24, + fr_icmptimeout = 120, + fr_icmpacktimeout = 12; int fr_statemax = IPSTATE_MAX, fr_statesize = IPSTATE_SIZE; int fr_state_doflush = 0, @@ -241,6 +241,7 @@ caddr_t data; if (error) return EFAULT; + WRITE_ENTER(&ipf_state); for (sp = ips_list; sp; sp = sp->is_next) if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && !bcmp((char *)&sp->is_src, (char *)&st.is_src, @@ -249,7 +250,6 @@ caddr_t data; sizeof(st.is_dst)) && !bcmp((char *)&sp->is_ps, (char *)&st.is_ps, sizeof(st.is_ps))) { - WRITE_ENTER(&ipf_state); #ifdef IPFILTER_LOG ipstate_log(sp, ISL_REMOVE); #endif @@ -257,6 +257,7 @@ caddr_t data; RWLOCK_EXIT(&ipf_state); return 0; } + RWLOCK_EXIT(&ipf_state); return ESRCH; } @@ -502,8 +503,7 @@ u_int flags; u_int pass; int out; - if (fr_state_lock || (fin->fin_off & IP_OFFMASK) || - (fin->fin_fi.fi_fl & FI_SHORT)) + if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT)) return NULL; if (ips_num == fr_statemax) { ips_stats.iss_max++; @@ -663,7 +663,7 @@ u_int flags; is->is_secmsk = 0xffff; is->is_auth = fin->fin_fi.fi_auth; is->is_authmsk = 0xffff; - is->is_flags = fin->fin_fi.fi_fl & FI_CMP; + is->is_flags = fin->fin_fl & FI_CMP; is->is_flags |= FI_CMP << 4; is->is_flags |= flags & (FI_WILDP|FI_WILDA); if (flags & (FI_WILDP|FI_WILDA)) @@ -688,7 +688,7 @@ u_int flags; #endif RWLOCK_EXIT(&ipf_state); fin->fin_rev = IP6NEQ(is->is_dst, fin->fin_fi.fi_dst); - if (fin->fin_fi.fi_fl & FI_FRAG) + if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG)) ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE); return is; } @@ -717,6 +717,8 @@ tcphdr_t *tcp; * Find difference between last checked packet and this packet. */ source = IP6EQ(fin->fin_fi.fi_src, is->is_src); + if (source && (ntohs(is->is_sport) != fin->fin_data[0])) + source = 0; fdata = &is->is_tcp.ts_data[!source]; tdata = &is->is_tcp.ts_data[source]; seq = ntohl(tcp->th_seq); @@ -809,7 +811,7 @@ tcphdr_t *tcp; u_short sp, dp; void *ifp; - rev = fin->fin_rev = IP6NEQ(is->is_dst, dst); + rev = IP6NEQ(is->is_dst, dst); ifp = fin->fin_ifp; out = fin->fin_out; @@ -817,6 +819,12 @@ tcphdr_t *tcp; flags = is->is_flags; sp = tcp->th_sport; dp = tcp->th_dport; + if (!rev) { + if (!(flags & FI_W_SPORT) && (sp != is->is_sport)) + rev = 1; + else if (!(flags & FI_W_DPORT) && (dp != is->is_dport)) + rev = 1; + } } else { flags = is->is_flags & FI_WILDA; sp = 0; @@ -871,10 +879,10 @@ tcphdr_t *tcp; if (tcp == NULL) flags = is->is_flags & (FI_CMP|(FI_CMP<<4)); - if (((fin->fin_fi.fi_fl & (flags >> 4)) != (flags & FI_CMP)) || - ((fin->fin_fi.fi_optmsk & is->is_optmsk) != is->is_opt) || - ((fin->fin_fi.fi_secmsk & is->is_secmsk) != is->is_sec) || - ((fin->fin_fi.fi_auth & is->is_authmsk) != is->is_auth)) + if (((fin->fin_fl & (flags >> 4)) != (flags & FI_CMP)) || + (fin->fin_fi.fi_optmsk != is->is_opt) || + (fin->fin_fi.fi_secmsk != is->is_sec) || + (fin->fin_fi.fi_auth != is->is_auth)) return 0; if ((flags & (FI_W_SPORT|FI_W_DPORT))) { @@ -924,16 +932,11 @@ tcphdr_t *tcp; if (ret >= 0) { is->is_ifp[ret] = ifp; #ifdef _KERNEL - strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp), - sizeof(is->is_ifname[1])); + strncpy(is->is_ifname[ret], IFNAME(fin->fin_ifp), + sizeof(is->is_ifname[ret])); #endif } -#ifdef _KERNEL - if (ret >= 0) { - strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp), - sizeof(is->is_ifname[1])); - } -#endif + fin->fin_rev = rev; return 1; } @@ -1209,8 +1212,7 @@ fr_info_t *fin; frentry_t *fr; tcphdr_t *tcp; - if (fr_state_lock || (fin->fin_off & IP_OFFMASK) || - (fin->fin_fi.fi_fl & FI_SHORT)) + if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT)) return NULL; is = NULL; @@ -1254,7 +1256,10 @@ fr_info_t *fin; if ((is->is_p == pr) && (is->is_v == v) && fr_matchsrcdst(is, src, dst, fin, NULL) && fr_matchicmpqueryreply(v, is, ic)) { - is->is_age = fr_icmptimeout; + if (fin->fin_rev) + is->is_age = fr_icmpacktimeout; + else + is->is_age = fr_icmptimeout; break; } } @@ -1302,6 +1307,11 @@ retry_tcpudp: if (!fr_tcpstate(is, fin, ip, tcp)) { continue; } + } else if ((pr == IPPROTO_UDP)) { + if (fin->fin_rev) + is->is_age = fr_udpacktimeout; + else + is->is_age = fr_udptimeout; } break; } @@ -1345,7 +1355,7 @@ retry_tcpudp: fr_delstate(is); #endif RWLOCK_EXIT(&ipf_state); - if (fin->fin_fi.fi_fl & FI_FRAG) + if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG)) ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE); return fr; } @@ -1420,7 +1430,8 @@ void fr_stateunload() ips_stats.iss_inuse = 0; ips_num = 0; RWLOCK_EXIT(&ipf_state); - KFREES(ips_table, fr_statesize * sizeof(ipstate_t *)); + if (ips_table) + KFREES(ips_table, fr_statesize * sizeof(ipstate_t *)); ips_table = NULL; } diff --git a/contrib/ipfilter/ip_state.h b/contrib/ipfilter/ip_state.h index 1d1bc00..b940d77 100644 --- a/contrib/ipfilter/ip_state.h +++ b/contrib/ipfilter/ip_state.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed - * $Id: ip_state.h,v 2.13.2.2 2000/08/23 11:01:31 darrenr Exp $ + * $Id: ip_state.h,v 2.13.2.4 2001/06/26 10:43:17 darrenr Exp $ */ #ifndef __IP_STATE_H__ #define __IP_STATE_H__ @@ -17,8 +15,12 @@ # define SIOCDELST _IOW(r, 61, struct ipstate *) #endif -#define IPSTATE_SIZE 5737 -#define IPSTATE_MAX 4013 /* Maximum number of states held */ +#ifndef IPSTATE_SIZE +# define IPSTATE_SIZE 5737 +#endif +#ifndef IPSTATE_MAX +# define IPSTATE_MAX 4013 /* Maximum number of states held */ +#endif #define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\ (((s1) == (d2)) && ((d1) == (s2)))) diff --git a/contrib/ipfilter/ipf.c b/contrib/ipfilter/ipf.c index 355c42a..4d25fce 100644 --- a/contrib/ipfilter/ipf.c +++ b/contrib/ipfilter/ipf.c @@ -1,12 +1,16 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #ifdef __FreeBSD__ -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif #endif #include <stdio.h> #include <unistd.h> @@ -43,7 +47,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.5 2000/10/25 10:37:11 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.10 2001/07/18 11:34:19 darrenr Exp $"; #endif #if SOLARIS @@ -74,13 +78,19 @@ static void closedevice __P((void)); static char *getline __P((char *, size_t, FILE *, int *)); static char *ipfname = IPL_NAME; static void usage __P((void)); -static void showversion __P((void)); +static int showversion __P((void)); static int get_flags __P((void)); +#if SOLARIS +# define OPTS "6AdDEf:F:Il:noPrsUvVyzZ" +#else +# define OPTS "6AdDEf:F:Il:noPrsvVyzZ" +#endif + static void usage() { - fprintf(stderr, "usage: ipf [-6AdDEInoPrsUvVyzZ] %s %s %s\n", + fprintf(stderr, "usage: ipf [-%s] %s %s %s\n", OPTS, "[-l block|pass|nomatch]", "[-F i|o|a|s|S]", "[-f filename]"); exit(1); } @@ -92,11 +102,9 @@ char *argv[]; { int c; - while ((c = getopt(argc, argv, "6AdDEf:F:Il:noPrsUvVyzZ")) != -1) { + while ((c = getopt(argc, argv, OPTS)) != -1) { switch (c) { - case '?' : - usage(); #ifdef USE_INET6 case '6' : use_inet6 = 1; @@ -146,10 +154,11 @@ char *argv[]; break; #endif case 'v' : - opts |= OPT_VERBOSE; + opts += OPT_VERBOSE; break; case 'V' : - showversion(); + if (showversion()) + exit(1); break; case 'y' : frsync(); @@ -160,6 +169,9 @@ char *argv[]; case 'Z' : zerostats(); break; + default : + usage(); + break; } } @@ -553,7 +565,7 @@ static void blockunknown() #endif -static void showversion() +static int showversion() { struct friostat fio; struct friostat *fiop=&fio; @@ -565,13 +577,13 @@ static void showversion() if ((vfd = open(ipfname, O_RDONLY)) == -1) { perror("open device"); - return; + return 1; } if (ioctl(vfd, SIOCGETFS, &fiop)) { perror("ioctl(SIOCGETFS)"); close(vfd); - return; + return 1; } close(vfd); flags = get_flags(); @@ -610,4 +622,6 @@ static void showversion() s = "nomatch -> block"; printf("%s all, Logging: %savailable\n", s, fio.f_logging ? "" : "un"); printf("Active list: %d\n", fio.f_active); + + return 0; } diff --git a/contrib/ipfilter/ipf.h b/contrib/ipfilter/ipf.h index ee6ae4d..e7a70ca 100644 --- a/contrib/ipfilter/ipf.h +++ b/contrib/ipfilter/ipf.h @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ipf.h 1.12 6/5/96 - * $Id: ipf.h,v 2.9.2.2 2000/05/06 11:20:20 darrenr Exp $ + * $Id: ipf.h,v 2.9.2.3 2001/06/26 10:43:18 darrenr Exp $ */ #ifndef __IPF_H__ diff --git a/contrib/ipfilter/ipfs.c b/contrib/ipfilter/ipfs.c index d43fc56..baf3d1c 100644 --- a/contrib/ipfilter/ipfs.c +++ b/contrib/ipfilter/ipfs.c @@ -1,12 +1,16 @@ /* - * Copyright (C) 1999 by Darren Reed. + * Copyright (C) 1999-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #ifdef __FreeBSD__ -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif #endif #include <stdio.h> #include <unistd.h> @@ -41,7 +45,7 @@ #include "ipf.h" #if !defined(lint) -static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.3 2001/01/10 06:20:12 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.7 2001/06/26 10:43:18 darrenr Exp $"; #endif #ifndef IPF_SAVEDIR @@ -532,6 +536,7 @@ char *file; } bzero((char *)&ipn, sizeof(ipn)); + ipnp = &ipn; /* * 1. Read all state information in. @@ -573,7 +578,7 @@ char *file; } } else in = (nat_save_t *)malloc(sizeof(*in)); - bcopy((char *)&ipnp, (char *)in, sizeof(ipn)); + bcopy((char *)ipnp, (char *)in, sizeof(ipn)); /* * Check to see if this is the first state entry that will diff --git a/contrib/ipfilter/ipft_ef.c b/contrib/ipfilter/ipft_ef.c index cbdc599..0cb4623 100644 --- a/contrib/ipfilter/ipft_ef.c +++ b/contrib/ipfilter/ipft_ef.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* @@ -51,7 +49,7 @@ etherfind -n -t #if !defined(lint) static const char sccsid[] = "@(#)ipft_ef.c 1.6 2/4/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $"; #endif static int etherf_open __P((char *)); diff --git a/contrib/ipfilter/ipft_hx.c b/contrib/ipfilter/ipft_hx.c index ccbc3ee..2be1698 100644 --- a/contrib/ipfilter/ipft_hx.c +++ b/contrib/ipfilter/ipft_hx.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <ctype.h> @@ -42,7 +40,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)ipft_hx.c 1.1 3/9/96 (C) 1996 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $"; #endif extern int opts; diff --git a/contrib/ipfilter/ipft_pc.c b/contrib/ipfilter/ipft_pc.c index 061b7e4..eced91f 100644 --- a/contrib/ipfilter/ipft_pc.c +++ b/contrib/ipfilter/ipft_pc.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <string.h> @@ -33,7 +31,7 @@ #include "ipt.h" #if !defined(lint) -static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $"; #endif struct llc { @@ -46,7 +44,7 @@ struct llc { * While many of these maybe the same, some do have different header formats * which make this useful. */ -#define DLT_MAX 10 +#define DLT_MAX 14 static struct llc llcs[DLT_MAX+1] = { { 0, 0, 0 }, /* DLT_NULL */ @@ -59,7 +57,10 @@ static struct llc llcs[DLT_MAX+1] = { { 0, 0, 0 }, /* DLT_ARCNET */ { 0, 0, 0 }, /* DLT_SLIP */ { 0, 0, 0 }, /* DLT_PPP */ - { 0, 0, 0 } /* DLT_FDDI */ + { 0, 0, 0 }, /* DLT_FDDI */ + { 0, 0, 0 }, /* DLT_ATMRFC1483 */ + { 0, 0, 0 }, /* DLT_LOOP */ + { 0, 0, 0 } /* DLT_ENC */ }; static int pcap_open __P((char *)); @@ -114,7 +115,7 @@ char *fname; swap_hdr(&ph); } - if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type > DLT_MAX) { + if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type >= DLT_MAX) { (void) close(fd); return -2; } diff --git a/contrib/ipfilter/ipft_sn.c b/contrib/ipfilter/ipft_sn.c index 573c007..1b5e219 100644 --- a/contrib/ipfilter/ipft_sn.c +++ b/contrib/ipfilter/ipft_sn.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* @@ -37,7 +35,7 @@ #include "ipt.h" #if !defined(lint) -static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $"; #endif struct llc { @@ -78,6 +76,7 @@ char *fname; { struct snoophdr sh; int fd; + int s_v; if (sfd != -1) return sfd; @@ -90,16 +89,18 @@ char *fname; if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh)) return -2; - if (sh.s_v != SNOOP_VERSION || - sh.s_type < 0 || sh.s_type > SDL_MAX) { + s_v = (int)ntohl(sh.s_v); + s_type = (int)ntohl(sh.s_type); + + if (s_v != SNOOP_VERSION || + s_type < 0 || s_type > SDL_MAX) { (void) close(fd); return -2; } sfd = fd; - s_type = sh.s_type; printf("opened snoop file %s:\n", fname); - printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, sh.s_v, s_type); + printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type); return fd; } @@ -118,20 +119,22 @@ static int snoop_close() static int snoop_read_rec(rec) struct snooppkt *rec; { - int n, p; + int n, plen, ilen; if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec)) return -2; - if (rec->sp_ilen > rec->sp_plen || rec->sp_plen < sizeof(*rec)) + ilen = (int)ntohl(rec->sp_ilen); + plen = (int)ntohl(rec->sp_plen); + if (ilen > plen || plen < sizeof(*rec)) return -2; - p = rec->sp_plen - sizeof(*rec); - n = MIN(p, rec->sp_ilen); + plen -= sizeof(*rec); + n = MIN(plen, ilen); if (!n || n < 0) return -3; - return p; + return plen; } diff --git a/contrib/ipfilter/ipft_td.c b/contrib/ipfilter/ipft_td.c index 457591c..5f470ee 100644 --- a/contrib/ipfilter/ipft_td.c +++ b/contrib/ipfilter/ipft_td.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* @@ -60,7 +58,7 @@ tcpdump -nqte #if !defined(lint) static const char sccsid[] = "@(#)ipft_td.c 1.8 2/4/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $"; #endif static int tcpd_open __P((char *)); diff --git a/contrib/ipfilter/ipft_tx.c b/contrib/ipfilter/ipft_tx.c index 2668976..1e650f5 100644 --- a/contrib/ipfilter/ipft_tx.c +++ b/contrib/ipfilter/ipft_tx.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1995-2000 by Darren Reed. + * Copyright (C) 1995-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <ctype.h> @@ -43,7 +41,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.1 2001/01/10 06:19:53 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.4 2001/06/26 10:43:18 darrenr Exp $"; #endif extern int opts; @@ -223,12 +221,12 @@ int *out; bzero(ipopts, sizeof(ipopts)); ip->ip_hl = sizeof(*ip) >> 2; ip->ip_v = IPVERSION; - for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; ) + for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && (i < 19); ) cps[++i] = strtok(NULL, " \b\t\r\n"); - if (i < 2) - return 1; cpp = cps; + if (!*cpp) + return 1; c = **cpp; if (!isalpha(c) || (tolower(c) != 'o' && tolower(c) != 'i')) { @@ -237,12 +235,16 @@ int *out; } *out = (tolower(c) == 'o') ? 1 : 0; cpp++; + if (!*cpp) + return 1; if (!strcasecmp(*cpp, "on")) { cpp++; if (!*cpp) return 1; *ifn = strdup(*cpp++); + if (!*cpp) + return 1; } c = **cpp; diff --git a/contrib/ipfilter/ipl.h b/contrib/ipfilter/ipl.h index 3529d65..472bcce 100644 --- a/contrib/ipfilter/ipl.h +++ b/contrib/ipfilter/ipl.h @@ -1,17 +1,15 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)ipl.h 1.21 6/5/96 - * $Id: ipl.h,v 2.15.2.17 2001/01/14 13:47:15 darrenr Exp $ + * $Id: ipl.h,v 2.15.2.23 2001/07/23 13:52:10 darrenr Exp $ */ #ifndef __IPL_H__ #define __IPL_H__ -#define IPL_VERSION "IP Filter: v3.4.16" +#define IPL_VERSION "IP Filter: v3.4.20" #endif diff --git a/contrib/ipfilter/iplang/iplang.h b/contrib/ipfilter/iplang/iplang.h index d8986c8..f36a384 100644 --- a/contrib/ipfilter/iplang/iplang.h +++ b/contrib/ipfilter/iplang/iplang.h @@ -1,9 +1,7 @@ /* * Copyright (C) 1997-1998 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ typedef struct iface { int if_MTU; diff --git a/contrib/ipfilter/ipmon.c b/contrib/ipfilter/ipmon.c index 9250e24..0ccc947 100644 --- a/contrib/ipfilter/ipmon.c +++ b/contrib/ipfilter/ipmon.c @@ -1,15 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 darrenr Exp $"; -#endif - #ifndef SOLARIS #define SOLARIS (defined(__SVR4) || defined(__svr4__)) && defined(sun) #endif @@ -37,7 +30,9 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar # include <sys/filio.h> # include <sys/byteorder.h> #endif -#include <strings.h> +#if !defined(__SVR4) && !defined(__GNUC__) +# include <strings.h> +#endif #include <signal.h> #include <stdlib.h> #include <stddef.h> @@ -70,6 +65,11 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar #include "netinet/ip_nat.h" #include "netinet/ip_state.h" +#if !defined(lint) +static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.13 2001/07/19 12:24:59 darrenr Exp $"; +#endif + #if defined(sun) && !defined(SOLARIS2) #define STRERROR(x) sys_errlist[x] @@ -121,6 +121,7 @@ static void print_statelog __P((FILE *, char *, int)); static void dumphex __P((FILE *, u_char *, int)); static int read_log __P((int, int *, char *, int)); static void write_pid __P((char *)); +static char *icmpname __P((u_int, u_int)); char *hostname __P((int, int, u_32_t *)); char *portname __P((int, char *, u_int)); @@ -133,7 +134,7 @@ static char *getproto __P((u_int)); static char **protocols = NULL; static char **udp_ports = NULL; static char **tcp_ports = NULL; - +static char *argv0 = "ipmon"; #define OPT_SYSLOG 0x001 #define OPT_RESOLVE 0x002 @@ -155,7 +156,49 @@ static char **tcp_ports = NULL; #endif -void handlehup(sig) +#define ICMPUNREACHNAMES 14 +static char *icmpunreachnames[ICMPUNREACHNAMES] = { + "net", + "host", + "protocol", + "port", + "needfrag", + "srcfail", + "net_unknown", + "host_unknown", + "isolated", + "net_prohib", + "host_prohib", + "tosnet", + "toshost", + "admin_prohibit" +}; + +#define ICMPTYPES 19 +static char *icmptypes[ICMPTYPES] = { + "echoreply", + NULL, + NULL, + "unreach", + "sourcequench", + "redirect", + NULL, + NULL, + "echo", + "routeradvert", + "routersolicit", + "timxceed", + "paramprob", + "timestamp", + "timestampreply", + "inforeq", + "inforeply", + "maskreq", + "maskreply" +}; + + +static void handlehup(sig) int sig; { FILE *fp; @@ -265,6 +308,8 @@ char *hostname(res, v, ip) int res, v; u_32_t *ip; { +# define MAX_INETA 16 + static char hname[MAXHOSTNAMELEN + MAX_INETA + 3]; #ifdef USE_INET6 static char hostbuf[MAXHOSTNAMELEN+1]; #endif @@ -278,8 +323,8 @@ u_32_t *ip; hp = gethostbyaddr((char *)ip, sizeof(ip), AF_INET); if (!hp) return inet_ntoa(ipa); - return hp->h_name; - + sprintf(hname, "%.*s[%s]", MAXHOSTNAMELEN, hp->h_name, inet_ntoa(ipa)); + return hname; } #ifdef USE_INET6 (void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1); @@ -315,6 +360,67 @@ u_int port; } +#define TYPECODE(x,y) (((x) << 8) | (y)) + +static char *icmpname(type, code) +u_int type; +u_int code; +{ + static char name[80]; + char codeval[8], *s; + u_int typecode; + + sprintf(codeval, "%d", code); + + s = NULL; + if (type < ICMPTYPES) + s = icmptypes[type]; + if (s == NULL) + sprintf(name, "icmptype(%d)/", type); + else + sprintf(name, "%s/", s); + + if (type == ICMP_UNREACH) { + if (code >= ICMPUNREACHNAMES) + sprintf(name + strlen(name), "%d", code); + else + strcat(name, icmpunreachnames[code]); + } else { + typecode = (type << 8) | code; + + switch (typecode) + { + case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_NET) : + strcat(name, "net"); + break; + case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_HOST) : + strcat(name, "host"); + break; + case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSNET) : + strcat(name, "tosnet"); + break; + case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST) : + strcat(name, "toshost"); + break; + case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS) : + strcat(name, "intrans"); + break; + case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_REASS) : + strcat(name, "reass"); + break; + case TYPECODE(ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT) : + strcat(name, "optabsent"); + break; + default: + strcat(name, codeval); + break; + } + } + + return name; +} + + static void dumphex(log, buf, len) FILE *log; u_char *buf; @@ -739,9 +845,9 @@ int blen; ic = (struct icmp *)((char *)ip + hl); (void) sprintf(t, "%s -> ", hostname(res, v, s)); t += strlen(t); - (void) sprintf(t, "%s PR icmp len %hu %hu icmp %d/%d", + (void) sprintf(t, "%s PR icmp len %hu %hu icmp %s", hostname(res, v, d), hl, plen, - ic->icmp_type, ic->icmp_code); + icmpname((u_int) ic->icmp_type, (u_int) ic->icmp_code)); if (ic->icmp_type == ICMP_UNREACH || ic->icmp_type == ICMP_SOURCEQUENCH || ic->icmp_type == ICMP_PARAMPROB || @@ -879,7 +985,7 @@ FILE *log; if ((fd = open(file, O_RDWR)) == -1) { (void) fprintf(stderr, "%s: open: %s\n", file,STRERROR(errno)); - exit(-1); + exit(1); } if (ioctl(fd, SIOCIPFFB, &flushed) == 0) { @@ -942,7 +1048,7 @@ char *argv[]; int fd[3], doread, n, i; int tr, nr, regular[3], c; int fdt[3], devices = 0, make_daemon = 0; - char buf[512], *iplfile[3], *s; + char buf[512], *iplfile[3]; extern int optind; extern char *optarg; @@ -952,6 +1058,12 @@ char *argv[]; iplfile[1] = IPNAT_NAME; iplfile[2] = IPSTATE_NAME; + argv0 = strrchr(argv[0], '/'); + if (argv0 == NULL) + argv0 = argv[0]; + else + argv0++; + while ((c = getopt(argc, argv, "?abDf:FhnN:o:O:pP:sS:tvxX")) != -1) switch (c) { @@ -1002,14 +1114,9 @@ char *argv[]; pidfile = optarg; break; case 's' : - s = strrchr(argv[0], '/'); - if (s == NULL) - s = argv[0]; - else - s++; - openlog(s, LOG_NDELAY|LOG_PID, LOGFAC); - s = NULL; + openlog(argv0, LOG_NDELAY|LOG_PID, LOGFAC); opts |= OPT_SYSLOG; + log = NULL; break; case 'S' : opts |= OPT_STATE; @@ -1031,7 +1138,7 @@ char *argv[]; default : case 'h' : case '?' : - usage(argv[0]); + usage(argv0); } init_tabs(); @@ -1052,13 +1159,14 @@ char *argv[]; (void) fprintf(stderr, "%s: open: %s\n", iplfile[i], STRERROR(errno)); - exit(-1); + exit(1); + /* NOTREACHED */ } - if (fstat(fd[i], &sb) == -1) { (void) fprintf(stderr, "%d: fstat: %s\n",fd[i], STRERROR(errno)); - exit(-1); + exit(1); + /* NOTREACHED */ } if (!(regular[i] = !S_ISCHR(sb.st_mode))) devices++; @@ -1069,25 +1177,36 @@ char *argv[]; logfile = argv[optind]; log = logfile ? fopen(logfile, "a") : stdout; if (log == NULL) { - (void) fprintf(stderr, "%s: fopen: %s\n", argv[optind], STRERROR(errno)); - exit(-1); + exit(1); + /* NOTREACHED */ } setvbuf(log, NULL, _IONBF, 0); } else log = NULL; if (make_daemon && ((log != stdout) || (opts & OPT_SYSLOG))) { - if (fork() > 0) +#if BSD + daemon(0, !(opts & OPT_SYSLOG)); +#else + int pid; + if ((pid = fork()) > 0) exit(0); - write_pid(pidfile); + if (pid < 0) { + (void) fprintf(stderr, "%s: fork() failed: %s\n", argv0, + STRERROR(errno)); + exit(1); + /* NOTREACHED */ + } + setsid(); + if ((opts & OPT_SYSLOG)) + close(2); +#endif /* !BSD */ close(0); close(1); - close(2); - setsid(); - } else - write_pid(pidfile); + } + write_pid(pidfile); signal(SIGHUP, handlehup); @@ -1100,8 +1219,12 @@ char *argv[]; continue; if (!regular[i]) { if (ioctl(fd[i], FIONREAD, &tr) == -1) { - perror("ioctl(FIONREAD)"); - exit(-1); + if (opts & OPT_SYSLOG) + syslog(LOG_CRIT, "ioctl(FIONREAD): %m"); + else + perror("ioctl(FIONREAD)"); + exit(1); + /* NOTREACHED */ } } else { tr = (lseek(fd[i], 0, SEEK_CUR) < sb.st_size); @@ -1126,14 +1249,14 @@ char *argv[]; { case -1 : if (opts & OPT_SYSLOG) - syslog(LOG_ERR, "read: %m\n"); + syslog(LOG_CRIT, "read: %m\n"); else perror("read"); doread = 0; break; case 1 : if (opts & OPT_SYSLOG) - syslog(LOG_ERR, "aborting logging\n"); + syslog(LOG_CRIT, "aborting logging\n"); else fprintf(log, "aborting logging\n"); doread = 0; diff --git a/contrib/ipfilter/ipnat.c b/contrib/ipfilter/ipnat.c index 51af2e1..b8cb37e 100644 --- a/contrib/ipfilter/ipnat.c +++ b/contrib/ipfilter/ipnat.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) */ @@ -57,7 +55,7 @@ extern char *sys_errlist[]; #if !defined(lint) static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.5 2000/12/02 00:15:04 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.9 2001/07/18 15:06:33 darrenr Exp $"; #endif @@ -110,10 +108,10 @@ int main(argc, argv) int argc; char *argv[]; { - char *file = NULL; int fd = -1, opts = 0, c, mode = O_RDWR; + char *file = NULL, *core = NULL; - while ((c = getopt(argc, argv, "CdFf:hlnrsv")) != -1) + while ((c = getopt(argc, argv, "CdFf:hlM:nrsv")) != -1) switch (c) { case 'C' : @@ -135,6 +133,9 @@ char *argv[]; opts |= OPT_LIST; mode = O_RDONLY; break; + case 'M' : + core = optarg; + break; case 'n' : opts |= OPT_NODO; mode = O_RDONLY; @@ -153,6 +154,13 @@ char *argv[]; usage(argv[0]); } + if (core != NULL) { + if (openkmem(core) == -1) + exit(1); + (void) setgid(getgid()); + (void) setuid(getuid()); + } + gethostname(thishost, sizeof(thishost)); thishost[sizeof(thishost) - 1] = '\0'; @@ -292,8 +300,10 @@ ipnat_t *ipnat; void dostats(fd, opts) int fd, opts; { + hostmap_t hm, *hmp, **maptable; natstat_t ns, *nsp = &ns; nat_t **nt[2], *np, nat; + u_int hv, hv1, hv2; ipnat_t ipn; bzero((char *)&ns, sizeof(ns)); @@ -353,15 +363,21 @@ int fd, opts; printf("\n\tage %lu use %hu sumd %s/", nat.nat_age, nat.nat_use, getsumd(nat.nat_sumd[0])); + hv1 = NAT_HASH_FN(nat.nat_inip.s_addr, + nat.nat_inport, + 0xffffffff), + hv1 = NAT_HASH_FN(nat.nat_oip.s_addr, + hv1 + nat.nat_oport, + NAT_TABLE_SZ), + hv2 = NAT_HASH_FN(nat.nat_outip.s_addr, + nat.nat_outport, + 0xffffffff), + hv2 = NAT_HASH_FN(nat.nat_oip.s_addr, + hv2 + nat.nat_oport, + NAT_TABLE_SZ), printf("%s pr %u bkt %d/%d flags %x ", getsumd(nat.nat_sumd[1]), nat.nat_p, - (int)NAT_HASH_FN(nat.nat_inip.s_addr, - nat.nat_inport, - NAT_TABLE_SZ), - (int)NAT_HASH_FN(nat.nat_outip.s_addr, - nat.nat_outport, - NAT_TABLE_SZ), - nat.nat_flags); + hv1, hv2, nat.nat_flags); #ifdef USE_QUAD_T printf("bytes %qu pkts %qu", (unsigned long long)nat.nat_bytes, @@ -379,6 +395,38 @@ int fd, opts; printaps(nat.nat_aps, opts); } + if (opts & OPT_VERBOSE) { + printf("\nList of active host mappings:\n"); + + maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) * + ns.ns_hostmap_sz); + if (kmemcpy((char *)maptable, (u_long)ns.ns_maptable, + sizeof(hostmap_t *) * ns.ns_hostmap_sz)) { + perror("kmemcpy (maptable)"); + return; + } + + for (hv = 0; hv < ns.ns_hostmap_sz; hv++) { + hmp = maptable[hv]; + + while(hmp) { + + if (kmemcpy((char *)&hm, (u_long)hmp, + sizeof(hostmap_t))) { + perror("kmemcpy (hostmap)"); + return; + } + + printf("%s -> ", + inet_ntoa(hm.hm_realip)); + printf("%s ", inet_ntoa(hm.hm_mapip)); + printf("(use = %d hv = %u)\n", + hm.hm_ref, hv); + hmp = hm.hm_next; + } + } + free(maptable); + } free(nt[0]); } } diff --git a/contrib/ipfilter/ipsd/ipsd.c b/contrib/ipfilter/ipsd/ipsd.c index 4ed6d70..261ad89 100644 --- a/contrib/ipfilter/ipsd/ipsd.c +++ b/contrib/ipfilter/ipsd/ipsd.c @@ -1,9 +1,7 @@ /* * (C)opyright 1995-1998 Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * The author of this software makes no garuntee about the * performance of this package or its suitability to fulfill any purpose. @@ -37,7 +35,7 @@ #ifndef lint static const char sccsid[] = "@(#)ipsd.c 1.3 12/3/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1 1999/08/04 17:30:56 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $"; #endif extern char *optarg; diff --git a/contrib/ipfilter/ipsd/ipsd.h b/contrib/ipfilter/ipsd/ipsd.h index 1dbe1c4..a8f58c3 100644 --- a/contrib/ipfilter/ipsd/ipsd.h +++ b/contrib/ipfilter/ipsd/ipsd.h @@ -1,9 +1,7 @@ /* * (C)opyright 1995-1998 Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * The author of this software makes no garuntee about the * performance of this package or its suitability to fulfill any purpose. diff --git a/contrib/ipfilter/ipsd/ipsdr.c b/contrib/ipfilter/ipsd/ipsdr.c index 3b95ca0..298f655 100644 --- a/contrib/ipfilter/ipsd/ipsdr.c +++ b/contrib/ipfilter/ipsd/ipsdr.c @@ -1,9 +1,7 @@ /* * (C)opyright 1995-1998 Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * The author of this software makes no garuntee about the * performance of this package or its suitability to fulfill any purpose. @@ -38,7 +36,7 @@ #ifndef lint static const char sccsid[] = "@(#)ipsdr.c 1.3 12/3/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1 1999/08/04 17:30:57 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $"; #endif extern char *optarg; diff --git a/contrib/ipfilter/ipsd/linux.h b/contrib/ipfilter/ipsd/linux.h index 61f52b3..d9606cb 100644 --- a/contrib/ipfilter/ipsd/linux.h +++ b/contrib/ipfilter/ipsd/linux.h @@ -1,9 +1,7 @@ /* * Copyright (C) 1997-1998 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)linux.h 1.1 8/19/95 */ diff --git a/contrib/ipfilter/ipsd/sbpf.c b/contrib/ipfilter/ipsd/sbpf.c index 5d128c4..97bb4ce 100644 --- a/contrib/ipfilter/ipsd/sbpf.c +++ b/contrib/ipfilter/ipsd/sbpf.c @@ -1,9 +1,7 @@ /* * (C)opyright 1995-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * */ #include <stdio.h> diff --git a/contrib/ipfilter/ipsd/sdlpi.c b/contrib/ipfilter/ipsd/sdlpi.c index 9ec7b3f..c08fe69 100644 --- a/contrib/ipfilter/ipsd/sdlpi.c +++ b/contrib/ipfilter/ipsd/sdlpi.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * */ diff --git a/contrib/ipfilter/ipsd/slinux.c b/contrib/ipfilter/ipsd/slinux.c index 5b2734b..2c5aa97d 100644 --- a/contrib/ipfilter/ipsd/slinux.c +++ b/contrib/ipfilter/ipsd/slinux.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * The author of this software makes no garuntee about the * performance of this package or its suitability to fulfill any purpose. diff --git a/contrib/ipfilter/ipsd/snit.c b/contrib/ipfilter/ipsd/snit.c index 3f3aa50..ec7178f 100644 --- a/contrib/ipfilter/ipsd/snit.c +++ b/contrib/ipfilter/ipsd/snit.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. * * The author of this software makes no garuntee about the * performance of this package or its suitability to fulfill any purpose. diff --git a/contrib/ipfilter/ipsend/arp.c b/contrib/ipfilter/ipsend/arp.c index e4159fa..898815a 100644 --- a/contrib/ipfilter/ipsend/arp.c +++ b/contrib/ipfilter/ipsend/arp.c @@ -1,14 +1,8 @@ /* * arp.c (C) 1995-1998 Darren Reed * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Exp $"; -#endif #include <stdio.h> #include <errno.h> #include <sys/types.h> @@ -30,6 +24,11 @@ static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Ex #include "ipsend.h" #include "iplang/iplang.h" +#if !defined(lint) +static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: arp.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $"; +#endif + /* * lookup host and return diff --git a/contrib/ipfilter/ipsend/hpux.c b/contrib/ipfilter/ipsend/hpux.c index 42078e3..463fdbf 100644 --- a/contrib/ipfilter/ipsend/hpux.c +++ b/contrib/ipfilter/ipsend/hpux.c @@ -1,9 +1,7 @@ /* * (C)opyright 1997-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <strings.h> diff --git a/contrib/ipfilter/ipsend/ip.c b/contrib/ipfilter/ipsend/ip.c index c5eacb3..db6d477 100644 --- a/contrib/ipfilter/ipsend/ip.c +++ b/contrib/ipfilter/ipsend/ip.c @@ -1,14 +1,8 @@ /* * ip.c (C) 1995-1998 Darren Reed * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "%W% %G% (C)1995"; -static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr Exp $"; -#endif #include <errno.h> #include <stdio.h> #include <stdlib.h> @@ -33,6 +27,10 @@ static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr #endif #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "%W% %G% (C)1995"; +static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.3 2001/07/15 22:00:13 darrenr Exp $"; +#endif static char *ipbuf = NULL, *ethbuf = NULL; diff --git a/contrib/ipfilter/ipsend/ipresend.1 b/contrib/ipfilter/ipsend/ipresend.1 index ab90471..6014313 100644 --- a/contrib/ipfilter/ipsend/ipresend.1 +++ b/contrib/ipfilter/ipsend/ipresend.1 @@ -2,7 +2,7 @@ .SH NAME ipresend \- resend IP packets out to network .SH SYNOPSIS -.B ipsend +.B ipresend [ .B \-EHPRSTX ] [ diff --git a/contrib/ipfilter/ipsend/ipresend.c b/contrib/ipfilter/ipsend/ipresend.c index bad0f67..4a4ec1c 100644 --- a/contrib/ipfilter/ipsend/ipresend.c +++ b/contrib/ipfilter/ipsend/ipresend.c @@ -6,14 +6,8 @@ * conditions, enough of the TCP header is missing for unpredictable * results unless the filter is aware that this can happen. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darrenr Exp $"; -#endif #include <stdio.h> #include <stdlib.h> #include <unistd.h> @@ -34,6 +28,11 @@ static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darre #endif #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $"; +#endif + extern char *optarg; extern int optind; diff --git a/contrib/ipfilter/ipsend/ipsend.c b/contrib/ipfilter/ipsend/ipsend.c index 3dd39af..74f624e 100644 --- a/contrib/ipfilter/ipsend/ipsend.c +++ b/contrib/ipfilter/ipsend/ipsend.c @@ -6,14 +6,8 @@ * conditions, enough of the TCP header is missing for unpredictable * results unless the filter is aware that this can happen. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 darrenr Exp $"; -#endif #include <stdio.h> #include <stdlib.h> #include <unistd.h> @@ -36,6 +30,11 @@ static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 dar #include "ipsend.h" #include "ipf.h" +#if !defined(lint) +static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.3 2001/07/15 22:00:14 darrenr Exp $"; +#endif + extern char *optarg; extern int optind; diff --git a/contrib/ipfilter/ipsend/ipsend.h b/contrib/ipfilter/ipsend/ipsend.h index e2f8ff8..71e5490 100644 --- a/contrib/ipfilter/ipsend/ipsend.h +++ b/contrib/ipfilter/ipsend/ipsend.h @@ -6,11 +6,7 @@ * conditions, enough of the TCP header is missing for unpredictable * results unless the filter is aware that this can happen. * - * The author provides this program as-is, with no gaurantee for its - * suitability for any specific purpose. The author takes no responsibility - * for the misuse/abuse of this program and provides it for the sole purpose - * of testing packet filter policies. This file maybe distributed freely - * providing it is not modified and that this notice remains in tact. + * See the IPFILTER.LICENCE file for details on licencing. * */ #ifndef __P @@ -67,3 +63,9 @@ extern int kmemcpy __P((char *, void *, int)); #ifndef OPT_RAW #define OPT_RAW 0x80000 #endif + +#ifndef __STDC__ +# ifndef const +# define const +# endif +#endif diff --git a/contrib/ipfilter/ipsend/ipsopt.c b/contrib/ipfilter/ipsend/ipsopt.c index 2827c77..691ee7d 100644 --- a/contrib/ipfilter/ipsend/ipsopt.c +++ b/contrib/ipfilter/ipsend/ipsopt.c @@ -1,14 +1,8 @@ /* * Copyright (C) 1995-1998 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr Exp $"; -#endif #include <stdio.h> #include <string.h> #include <stdlib.h> @@ -25,13 +19,9 @@ static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr #include <arpa/inet.h> #include "ipsend.h" - -#ifndef __P -# ifdef __STDC__ -# define __P(x) x -# else -# define __P(x) () -# endif +#if !defined(lint) +static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $"; #endif diff --git a/contrib/ipfilter/ipsend/iptest.c b/contrib/ipfilter/ipsend/iptest.c index dffee98..d4d37ba 100644 --- a/contrib/ipfilter/ipsend/iptest.c +++ b/contrib/ipfilter/ipsend/iptest.c @@ -6,14 +6,8 @@ * conditions, enough of the TCP header is missing for unpredictable * results unless the filter is aware that this can happen. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr Exp $"; -#endif #include <stdio.h> #include <netdb.h> #include <unistd.h> @@ -38,6 +32,11 @@ static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr #endif #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2.2.2 2001/07/15 22:00:14 darrenr Exp $"; +#endif + extern char *optarg; extern int optind; diff --git a/contrib/ipfilter/ipsend/iptests.c b/contrib/ipfilter/ipsend/iptests.c index 0eb263b..a133e34 100644 --- a/contrib/ipfilter/ipsend/iptests.c +++ b/contrib/ipfilter/ipsend/iptests.c @@ -1,14 +1,8 @@ /* * Copyright (C) 1993-1998 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darrenr Exp $"; -#endif #include <stdio.h> #include <unistd.h> #include <stdlib.h> @@ -80,6 +74,11 @@ static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darren #endif #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "%W% %G% (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $"; +#endif + #define PAUSE() tv.tv_sec = 0; tv.tv_usec = 10000; \ (void) select(0, NULL, NULL, NULL, &tv) diff --git a/contrib/ipfilter/ipsend/larp.c b/contrib/ipfilter/ipsend/larp.c index d64e701..d178d64 100644 --- a/contrib/ipfilter/ipsend/larp.c +++ b/contrib/ipfilter/ipsend/larp.c @@ -1,13 +1,11 @@ /* * larp.c (C) 1995-1998 Darren Reed * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #if !defined(lint) static const char sccsid[] = "@(#)larp.c 1.1 8/19/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: larp.c,v 2.1 1999/08/04 17:31:10 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: larp.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $"; #endif #include <stdio.h> #include <errno.h> diff --git a/contrib/ipfilter/ipsend/linux.h b/contrib/ipfilter/ipsend/linux.h index ae2e05f..2d2a243 100644 --- a/contrib/ipfilter/ipsend/linux.h +++ b/contrib/ipfilter/ipsend/linux.h @@ -1,9 +1,7 @@ /* * Copyright (C) 1995-1998 by Darren Reed. * - * This code may be freely distributed as long as it retains this notice - * and is not changed in any way. The author accepts no responsibility - * for the use of this software. I hate legaleese, don't you ? + * See the IPFILTER.LICENCE file for details on licencing. * * @(#)linux.h 1.1 8/19/95 */ diff --git a/contrib/ipfilter/ipsend/lsock.c b/contrib/ipfilter/ipsend/lsock.c index a430e19..058ab40 100644 --- a/contrib/ipfilter/ipsend/lsock.c +++ b/contrib/ipfilter/ipsend/lsock.c @@ -1,13 +1,11 @@ /* * lsock.c (C) 1995-1998 Darren Reed * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #if !defined(lint) static const char sccsid[] = "@(#)lsock.c 1.2 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1 1999/08/04 17:31:11 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $"; #endif #include <stdio.h> #include <unistd.h> diff --git a/contrib/ipfilter/ipsend/resend.c b/contrib/ipfilter/ipsend/resend.c index 095aa9e..0d4102c 100644 --- a/contrib/ipfilter/ipsend/resend.c +++ b/contrib/ipfilter/ipsend/resend.c @@ -6,14 +6,8 @@ * conditions, enough of the TCP header is missing for unpredictable * results unless the filter is aware that this can happen. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 darrenr Exp $"; -#endif #include <stdio.h> #include <netdb.h> #include <string.h> @@ -39,6 +33,12 @@ static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 dar #endif #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $"; +#endif + + extern int opts; static u_char pbuf[65536]; /* 1 big packet */ diff --git a/contrib/ipfilter/ipsend/sbpf.c b/contrib/ipfilter/ipsend/sbpf.c index f84deb9..5b8428c 100644 --- a/contrib/ipfilter/ipsend/sbpf.c +++ b/contrib/ipfilter/ipsend/sbpf.c @@ -1,9 +1,7 @@ /* * (C)opyright 1995-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <netdb.h> @@ -43,7 +41,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)sbpf.c 1.3 8/25/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $"; #endif /* diff --git a/contrib/ipfilter/ipsend/sdlpi.c b/contrib/ipfilter/ipsend/sdlpi.c index 3d797c1..dcd8422 100644 --- a/contrib/ipfilter/ipsend/sdlpi.c +++ b/contrib/ipfilter/ipsend/sdlpi.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> @@ -40,7 +38,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)sdlpi.c 1.3 10/30/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1.4.2 2001/06/26 10:43:22 darrenr Exp $"; #endif #define CHUNKSIZE 8192 @@ -58,7 +56,8 @@ int sport, tout; char devname[16], *s, buf[256]; int i, fd; - (void) sprintf(devname, "/dev/%s", device); + (void) strcpy(devname, "/dev/"); + (void) strncat(devname, device, sizeof(devname) - strlen(devname)); s = devname + 5; while (*s && !isdigit(*s)) diff --git a/contrib/ipfilter/ipsend/sirix.c b/contrib/ipfilter/ipsend/sirix.c index 5317a90..4178c0e 100644 --- a/contrib/ipfilter/ipsend/sirix.c +++ b/contrib/ipfilter/ipsend/sirix.c @@ -2,9 +2,7 @@ * (C)opyright 1992-1998 Darren Reed. * (C)opyright 1997 Marc Boucher. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <sys/types.h> diff --git a/contrib/ipfilter/ipsend/slinux.c b/contrib/ipfilter/ipsend/slinux.c index 353f3ad..7438d1c 100644 --- a/contrib/ipfilter/ipsend/slinux.c +++ b/contrib/ipfilter/ipsend/slinux.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> @@ -29,7 +27,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)slinux.c 1.2 8/25/95"; -static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1 1999/08/04 17:31:14 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $"; #endif #define CHUNKSIZE 8192 diff --git a/contrib/ipfilter/ipsend/snit.c b/contrib/ipfilter/ipsend/snit.c index 40aaae5..6f2c662 100644 --- a/contrib/ipfilter/ipsend/snit.c +++ b/contrib/ipfilter/ipsend/snit.c @@ -1,9 +1,7 @@ /* * (C)opyright 1992-1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> @@ -40,7 +38,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)snit.c 1.5 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: snit.c,v 2.1 1999/08/04 17:31:15 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: snit.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $"; #endif #define CHUNKSIZE 8192 diff --git a/contrib/ipfilter/ipsend/sock.c b/contrib/ipfilter/ipsend/sock.c index 2ee5028..b20bf93 100644 --- a/contrib/ipfilter/ipsend/sock.c +++ b/contrib/ipfilter/ipsend/sock.c @@ -1,14 +1,8 @@ /* * sock.c (C) 1995-1998 Darren Reed * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ -#if !defined(lint) -static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darrenr Exp $"; -#endif #include <stdio.h> #include <unistd.h> #include <string.h> @@ -66,6 +60,12 @@ static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darre #include <netinet/tcp_var.h> #include "ipsend.h" +#if !defined(lint) +static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed"; +static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $"; +#endif + + int nproc; struct proc *proc; diff --git a/contrib/ipfilter/ipsend/ultrix.c b/contrib/ipfilter/ipsend/ultrix.c index ffab2ce..f41a8a9 100644 --- a/contrib/ipfilter/ipsend/ultrix.c +++ b/contrib/ipfilter/ipsend/ultrix.c @@ -1,9 +1,7 @@ /* * (C)opyright 1998 Darren Reed. (from tcplog) * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <strings.h> diff --git a/contrib/ipfilter/ipt.c b/contrib/ipfilter/ipt.c index 34a35e9..4749e38 100644 --- a/contrib/ipfilter/ipt.c +++ b/contrib/ipfilter/ipt.c @@ -1,12 +1,16 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #ifdef __FreeBSD__ -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif #endif #include <stdio.h> #include <assert.h> @@ -55,7 +59,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6 2000/03/13 22:10:25 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6.2.2 2001/06/26 10:43:19 darrenr Exp $"; #endif extern char *optarg; diff --git a/contrib/ipfilter/ipt.h b/contrib/ipfilter/ipt.h index bdc6a29..677c74a 100644 --- a/contrib/ipfilter/ipt.h +++ b/contrib/ipfilter/ipt.h @@ -1,10 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. - * $Id: ipt.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $ + * See the IPFILTER.LICENCE file for details on licencing. + * $Id: ipt.h,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $ */ #ifndef __IPT_H__ diff --git a/contrib/ipfilter/kmem.c b/contrib/ipfilter/kmem.c index ab90bba..3cad5a0 100644 --- a/contrib/ipfilter/kmem.c +++ b/contrib/ipfilter/kmem.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* * kmemcpy() - copies n bytes from kernel memory into user buffer. @@ -18,16 +16,24 @@ #include <sys/file.h> #include "kmem.h" +#ifndef __STDC__ +# define const +#endif + #if !defined(lint) static const char sccsid[] = "@(#)kmem.c 1.4 1/12/96 (C) 1992 Darren Reed"; -static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2.2.3 2001/07/15 22:06:16 darrenr Exp $"; #endif static int kmemfd = -1; -int openkmem() +int openkmem(core) +char *core; { - if ((kmemfd = open(KMEM,O_RDONLY)) == -1) + if (core == NULL) + core = KMEM; + + if ((kmemfd = open(core, O_RDONLY)) == -1) { perror("kmeminit:open"); return -1; @@ -45,7 +51,7 @@ register int n; if (!n) return 0; if (kmemfd == -1) - if (openkmem() == -1) + if (openkmem(NULL) == -1) return -1; if (lseek(kmemfd, pos, 0) == -1) { @@ -76,7 +82,7 @@ register int n; if (!n) return 0; if (kmemfd == -1) - if (openkmem() == -1) + if (openkmem(NULL) == -1) return -1; if (lseek(kmemfd, pos, 0) == -1) { diff --git a/contrib/ipfilter/kmem.h b/contrib/ipfilter/kmem.h index d6ed3c4..08a6c5e 100644 --- a/contrib/ipfilter/kmem.h +++ b/contrib/ipfilter/kmem.h @@ -1,10 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. - * $Id: kmem.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $ + * See the IPFILTER.LICENCE file for details on licencing. + * $Id: kmem.h,v 2.2.2.2 2001/06/26 10:43:19 darrenr Exp $ */ #ifndef __KMEM_H__ @@ -17,7 +15,7 @@ # define __P(x) () # endif #endif -extern int openkmem __P((void)); +extern int openkmem __P((char *)); extern int kmemcpy __P((char *, long, int)); extern int kstrncpy __P((char *, long, int)); diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5 index 243edac..c359703 100644 --- a/contrib/ipfilter/man/ipf.5 +++ b/contrib/ipfilter/man/ipf.5 @@ -374,7 +374,7 @@ against, e.g.: # packets with ONLY the SYN flag set. ... flags SA - # becomes "flags SA/AUPRFS" and will match any + # becomes "flags SA/AUPRFSC" and will match any # packet with only the SYN and ACK flags set. ... flags S/SA diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4 index 26aa604..15f587b 100644 --- a/contrib/ipfilter/man/ipl.4 +++ b/contrib/ipfilter/man/ipl.4 @@ -76,4 +76,4 @@ ipf(4) .SH BUGS Packet headers are dropped when the internal buffer (static size) fills. .SH FILES -/dev/ipl0 +/dev/ipl diff --git a/contrib/ipfilter/misc.c b/contrib/ipfilter/misc.c index 38b385d..df65e2c 100644 --- a/contrib/ipfilter/misc.c +++ b/contrib/ipfilter/misc.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #if (SOLARIS2 >= 7) # define _SYS_VARARGS_H @@ -52,7 +50,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)misc.c 1.3 2/4/96 (C) 1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: misc.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: misc.c,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $"; #endif extern int opts; diff --git a/contrib/ipfilter/ml_ipl.c b/contrib/ipfilter/ml_ipl.c index 0ee29cb..4db9a9b 100644 --- a/contrib/ipfilter/ml_ipl.c +++ b/contrib/ipfilter/ml_ipl.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. The author accepts no + * See the IPFILTER.LICENCE file for details on licencing. * responsibility and is not changed in any way. * * I hate legaleese, don't you ? diff --git a/contrib/ipfilter/mlf_ipl.c b/contrib/ipfilter/mlf_ipl.c index 3ca7df3..50c2d94 100644 --- a/contrib/ipfilter/mlf_ipl.c +++ b/contrib/ipfilter/mlf_ipl.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* * 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate @@ -13,12 +11,24 @@ #include <sys/param.h> -#if defined(__FreeBSD__) && (__FreeBSD__ > 1) +#if defined(__FreeBSD__) # ifdef IPFILTER_LKM -# include <osreldate.h> +# ifndef __FreeBSD_cc_version +# include <osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <osreldate.h> +# endif +# endif # define ACTUALLY_LKM_NOT_KERNEL # else -# include <sys/osreldate.h> +# ifndef __FreeBSD_cc_version +# include <sys/osreldate.h> +# else +# if __FreeBSD_cc_version < 430000 +# include <sys/osreldate.h> +# endif +# endif # endif #endif #include <sys/systm.h> @@ -53,19 +63,16 @@ #if (__FreeBSD_version >= 300000) # include <sys/socket.h> #endif -#if (__FreeBSD_version >= 199511) #include <net/if.h> #include <netinet/in_systm.h> #include <netinet/in.h> #include <netinet/ip.h> #include <net/route.h> +#include <net/if.h> #include <netinet/ip_var.h> #include <netinet/tcp.h> #include <netinet/tcpip.h> -#endif -#if (__FreeBSD__ > 1) -# include <sys/sysent.h> -#endif +#include <sys/sysent.h> #include <sys/lkm.h> #include "netinet/ipl.h" #include "netinet/ip_compat.h" @@ -392,7 +399,7 @@ int cmd, ver; # endif } # endif /* IPFILTER_LKM */ -static ipl_devsw_installed = 0; +static int ipl_devsw_installed = 0; static void ipl_drvinit __P((void *unused)) { diff --git a/contrib/ipfilter/mli_ipl.c b/contrib/ipfilter/mli_ipl.c index a451a10..2412029 100644 --- a/contrib/ipfilter/mli_ipl.c +++ b/contrib/ipfilter/mli_ipl.c @@ -1,10 +1,8 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * (C)opyright 1997 by Marc Boucher. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original authors and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* TODO: (MARCXXX) diff --git a/contrib/ipfilter/mln_ipl.c b/contrib/ipfilter/mln_ipl.c index 777ca9f..bda0f2e 100644 --- a/contrib/ipfilter/mln_ipl.c +++ b/contrib/ipfilter/mln_ipl.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* * 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate diff --git a/contrib/ipfilter/mls_ipl.c b/contrib/ipfilter/mls_ipl.c index 391b814..bc8f3ed 100644 --- a/contrib/ipfilter/mls_ipl.c +++ b/contrib/ipfilter/mls_ipl.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* * 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate @@ -42,7 +40,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)mls_ipl.c 2.6 10/15/95 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $"; #endif extern int ipldetach __P((void)); diff --git a/contrib/ipfilter/natparse.c b/contrib/ipfilter/natparse.c index 9655615..f237708 100644 --- a/contrib/ipfilter/natparse.c +++ b/contrib/ipfilter/natparse.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <string.h> @@ -54,7 +52,7 @@ extern char *sys_errlist[]; #if !defined(lint) static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed"; -static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.6 2000/07/08 02:14:40 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.11 2001/07/17 14:33:09 darrenr Exp $"; #endif @@ -160,6 +158,8 @@ void *ptr; printf(" udp"); if (np->in_flags & IPN_ROUNDR) printf(" round-robin"); + if (np->in_flags & IPN_FRAG) + printf(" frag"); printf("\n"); if (opts & OPT_DEBUG) printf("\t%p %lu %#x %u %p %d\n", np->in_ifp, @@ -231,6 +231,8 @@ void *ptr; ntohs(np->in_pmax)); } } + if (np->in_flags & IPN_FRAG) + printf(" frag"); printf("\n"); if (opts & OPT_DEBUG) { printf("\tifp %p space %lu nextip %s pnext %d", @@ -277,6 +279,7 @@ int linenum; char *s, *t, *cps[31], **cpp; int i, cnt; + proto = NULL; if ((s = strchr(line, '\n'))) *s = '\0'; @@ -553,7 +556,7 @@ int linenum; } else ipn.in_pmin = 0; } else if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) { - if (strrchr(*cpp, '/') != NULL) { + if (!*cpp || strrchr(*cpp, '/') != NULL) { fprintf(stderr, "%d: No netmask supported in %s\n", linenum, "destination host for redirect"); return NULL; @@ -623,6 +626,11 @@ int linenum; ipn.in_flags |= IPN_ROUNDR; } + if (*cpp && !strcasecmp(*cpp, "frag")) { + cpp++; + ipn.in_flags |= IPN_FRAG; + } + if (*cpp) { fprintf(stderr, "%d: extra junk at the end of rdr: %s\n", @@ -641,6 +649,11 @@ int linenum; if ((ipn.in_redir & NAT_MAPBLK) != 0) nat_setgroupmap(&ipn); + if (*cpp && !strcasecmp(*cpp, "frag")) { + cpp++; + ipn.in_flags |= IPN_FRAG; + } + if (!*cpp) return &ipn; diff --git a/contrib/ipfilter/opt.c b/contrib/ipfilter/opt.c index ae153a1..e0dd125 100644 --- a/contrib/ipfilter/opt.c +++ b/contrib/ipfilter/opt.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <stdio.h> #include <string.h> @@ -27,7 +25,7 @@ #if !defined(lint) static const char sccsid[] = "@(#)opt.c 1.8 4/10/96 (C) 1993-2000 Darren Reed"; -static const char rcsid[] = "@(#)$Id: opt.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $"; +static const char rcsid[] = "@(#)$Id: opt.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $"; #endif extern int opts; diff --git a/contrib/ipfilter/parse.c b/contrib/ipfilter/parse.c index 0441ad5..56bc3fc 100644 --- a/contrib/ipfilter/parse.c +++ b/contrib/ipfilter/parse.c @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #include <sys/types.h> #if !defined(__SVR4) && !defined(__svr4__) @@ -394,7 +392,15 @@ int linenum; linenum); return NULL; } - if (**cpp == '!') { + if (!strcmp(*cpp, "!")) { + fil.fr_flags |= FR_NOTSRCIP; + if (!*++cpp) { + fprintf(stderr, + "%d: missing host after from\n", + linenum); + return NULL; + } + } else if (**cpp == '!') { fil.fr_flags |= FR_NOTSRCIP; (*cpp)++; } @@ -424,7 +430,15 @@ int linenum; return NULL; } ch = 0; - if (**cpp == '!') { + if (!strcmp(*cpp, "!")) { + fil.fr_flags |= FR_NOTDSTIP; + if (!*++cpp) { + fprintf(stderr, + "%d: missing host after from\n", + linenum); + return NULL; + } + } else if (**cpp == '!') { fil.fr_flags |= FR_NOTDSTIP; (*cpp)++; } diff --git a/contrib/ipfilter/pcap.h b/contrib/ipfilter/pcap.h index 1a53382..aa24798 100644 --- a/contrib/ipfilter/pcap.h +++ b/contrib/ipfilter/pcap.h @@ -1,10 +1,9 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. - * $Id: pcap.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $ + * See the IPFILTER.LICENCE file for details on licencing. + * + * $Id: pcap.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $ */ /* * This header file is constructed to match the version described by diff --git a/contrib/ipfilter/relay.c b/contrib/ipfilter/relay.c index 5919086..58a44f0 100644 --- a/contrib/ipfilter/relay.c +++ b/contrib/ipfilter/relay.c @@ -107,7 +107,7 @@ char *argv[]; int fd, sl = sizeof(sl), se; openlog(argv[0], LOG_PID|LOG_NDELAY, LOG_DAEMON); - if ((fd = open("/dev/ipl", O_RDONLY)) == -1) { + if ((fd = open("/dev/ipnat", O_RDONLY)) == -1) { se = errno; perror("open"); errno = se; @@ -115,6 +115,9 @@ char *argv[]; exit(-1); } + bzero(&nl, sizeof(nl)); + nl.nl_flags = IPN_TCP; + bzero(&sin, sizeof(sin)); sin.sin_family = AF_INET; sl = sizeof(sin); @@ -151,8 +154,8 @@ char *argv[]; exit(-1); } - sin.sin_port = nl.nl_inport; - sin.sin_addr = nl.nl_inip; + sin.sin_port = nl.nl_realport; + sin.sin_addr = nl.nl_realip; sl = sizeof(sin); fd = socket(AF_INET, SOCK_STREAM, 0); diff --git a/contrib/ipfilter/snoop.h b/contrib/ipfilter/snoop.h index df800ae..2f6c305 100644 --- a/contrib/ipfilter/snoop.h +++ b/contrib/ipfilter/snoop.h @@ -1,9 +1,7 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ #ifndef __SNOOP_H__ @@ -11,7 +9,7 @@ /* * written to comply with the RFC (1761) from Sun. - * $Id: snoop.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $ + * $Id: snoop.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $ */ struct snoophdr { char s_id[8]; diff --git a/contrib/ipfilter/solaris.c b/contrib/ipfilter/solaris.c index 1e82ec0..b526327 100644 --- a/contrib/ipfilter/solaris.c +++ b/contrib/ipfilter/solaris.c @@ -1,12 +1,10 @@ /* - * Copyright (C) 1993-2000 by Darren Reed. + * Copyright (C) 1993-2001 by Darren Reed. * - * Redistribution and use in source and binary forms are permitted - * provided that this notice is preserved and due credit is given - * to the original author and the contributors. + * See the IPFILTER.LICENCE file for details on licencing. */ /* #pragma ident "@(#)solaris.c 1.12 6/5/96 (C) 1995 Darren Reed"*/ -#pragma ident "@(#)$Id: solaris.c,v 2.15.2.8 2000/11/27 10:28:41 darrenr Exp $" +#pragma ident "@(#)$Id: solaris.c,v 2.15.2.20 2001/07/18 14:58:28 darrenr Exp $" #include <sys/systm.h> #include <sys/types.h> @@ -147,7 +145,7 @@ static struct modlinkage modlink1 = { MODREV_1, &iplmod, NULL }; static size_t hdrsizes[57][2] = { { 0, 0 }, { IFT_OTHER, 0 }, - { IFT_1822, 0 }, + { IFT_1822, 14 }, /* 14 for ire0 ?? */ { IFT_HDH1822, 0 }, { IFT_X25DDN, 0 }, { IFT_X25, 0 }, @@ -210,8 +208,6 @@ int _init() { int ipfinst; - if (fr_running < 0) - return -1; ipfinst = mod_install(&modlink1); #ifdef IPFDEBUG cmn_err(CE_NOTE, "IP Filter: _init() = %d", ipfinst); @@ -224,8 +220,6 @@ int _fini(void) { int ipfinst; - if (fr_running < 0) - return -1; ipfinst = mod_remove(&modlink1); #ifdef IPFDEBUG cmn_err(CE_NOTE, "IP Filter: _fini() = %d", ipfinst); @@ -239,8 +233,6 @@ struct modinfo *modinfop; { int ipfinst; - if (fr_running < 0) - return -1; ipfinst = mod_info(&modlink1, modinfop); #ifdef IPFDEBUG cmn_err(CE_NOTE, "IP Filter: _info(%x) = %x", modinfop, ipfinst); @@ -275,6 +267,31 @@ dev_info_t *dip; } +static void ipf_ire_walk(ire, arg) +ire_t *ire; +void *arg; +{ + qif_t *qif = arg; + + if ((ire->ire_type == IRE_CACHE) && +#if SOLARIS2 >= 6 + (ire->ire_ipif != NULL) && + (ire->ire_ipif->ipif_ill == qif->qf_ill) +#else + (ire_to_ill(ire) == qif->qf_ill) +#endif + ) { +#if SOLARIS2 >= 8 + mblk_t *m = ire->ire_fp_mp; +#else + mblk_t *m = ire->ire_ll_hdr_mp; +#endif + if (m != NULL) + qif->qf_hl = m->b_wptr - m->b_rptr; + } +} + + static int ipf_attach(dip, cmd) dev_info_t *dip; ddi_attach_cmd_t cmd; @@ -336,6 +353,14 @@ ddi_attach_cmd_t cmd; drv_usectohz(500000)); if (fr_running == 1) return DDI_SUCCESS; +#if SOLARIS2 >= 8 + case DDI_RESUME : + case DDI_PM_RESUME : + if (ipfr_timer_id == 0) + ipfr_timer_id = timeout(ipfr_slowtimer, NULL, + drv_usectohz(500000)); + return DDI_SUCCESS; +#endif default: return DDI_FAILURE; } @@ -403,6 +428,19 @@ ddi_detach_cmd_t cmd; cmn_err(CE_CONT, "%s detached\n", ipfilter_version); return (DDI_SUCCESS); } +#if SOLARIS2 >= 8 + case DDI_SUSPEND : + case DDI_PM_SUSPEND : + if (ipfr_timer_id != 0) { + untimeout(ipfr_timer_id); + ipfr_timer_id = 0; + } + if (synctimeoutid) { + untimeout(synctimeoutid); + synctimeoutid = 0; + } + return DDI_SUCCESS; +#endif default: return (DDI_FAILURE); } @@ -479,7 +517,7 @@ size_t off; m = m->b_cont; cmn_err(CE_CONT, " !IP %s:%d %d %p %p %p %d %p/%d %p/%d %p %d %d %p\n", - qif ? qif->qf_name : "?", out, qif->qf_hl, q, + qif ? qif->qf_name : "?", out, qif ? qif->qf_hl : -1, q, q ? q->q_ptr : NULL, q ? q->q_qinfo : NULL, mt->b_wptr - mt->b_rptr, m, MTYPE(m), mt, MTYPE(mt), m->b_rptr, m->b_wptr - m->b_rptr, off, ip); @@ -529,8 +567,8 @@ int out; { register mblk_t *m, *mt = *mp; register ip_t *ip; - size_t hlen, len, off, mlen, iphlen, plen; - int err, synced = 0, sap, p; + size_t hlen, len, off, off2, mlen, iphlen, plen, woff; + int err, synced = 0, sap, p, realigned = 0, multi = 0; u_char *bp; #if SOLARIS2 >= 8 ip6_t *ip6; @@ -556,8 +594,21 @@ tryagain: bp = (u_char *)ALIGN32(mt->b_rptr); if (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO) { dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp; - if (dl->dl_primitive != DL_UNITDATA_IND && - dl->dl_primitive != DL_UNITDATA_REQ) { + if (dl->dl_primitive == DL_UNITDATA_IND) { + multi = dl->dl_group_address; + m = mt->b_cont; + /* + * This is a complete kludge to try and work around + * some bizarre packets which drop through into + * fr_donotip. + */ + if (m && multi && ((*((u_char *)m->b_rptr) == 0x0) && + ((*((u_char *)m->b_rptr + 2) == 0x45)))) { + ip = (ip_t *)(m->b_rptr + 2); + off = 2; + } else + off = 0; + } else if (dl->dl_primitive != DL_UNITDATA_REQ) { ip = (ip_t *)dl; if ((ip->ip_v == IPVERSION) && (ip->ip_hl == (sizeof(*ip) >> 2)) && @@ -584,19 +635,6 @@ tryagain: return 0; /* No data blocks */ } - /* - * This is a complete kludge to try and work around some bizarre - * packets which drop through into fr_donotip. - */ - if ((mt != m) && (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO)) { - dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp; - if ((dl->dl_primitive == DL_UNITDATA_IND) && - (dl->dl_group_address == 1)) - if (((*((u_char *)m->b_rptr) == 0x0) && - ((*((u_char *)m->b_rptr + 2) == 0x45)))) - off += 2; - } - ip = (ip_t *)(m->b_rptr + off); /* MMM */ /* @@ -648,10 +686,13 @@ tryagain: ((char *)&tlen)[0] = ((char *)&ip6->ip6_plen)[0]; ((char *)&tlen)[1] = ((char *)&ip6->ip6_plen)[1]; plen = ntohs(tlen); - sap = IP6_DL_SAP; + if (!plen) + return -1; /* Jumbo gram */ + plen += sizeof(*ip6); } #endif else { + plen = 0; hlen = 0; sap = -1; } @@ -659,34 +700,77 @@ tryagain: /* * Ok, the IP header isn't on a 32bit aligned address so junk it. */ - if (((u_int)ip & 0x3) || (len < hlen) || (sap == -1)) { - mblk_t *m2; - u_char *s; + if (((u_long)ip & 0x3) || (plen > mlen) || (len < hlen) || + (sap == -1)) { + mblk_t *m1, *m2; + u_char *s, c; + int v; /* * Junk using pullupmsg - it's next to useless. */ fixalign: + if (off) + m->b_rptr -= off; + c = *(u_char *)ip; + c >>= 4; + if (c != 4 +#if SOLARIS2 >= 8 + && c != 6 +#endif + ) { + frstats[out].fr_notip++; + return (fr_flags & FF_BLOCKNONIP) ? -1 : 0; + } + + if (realigned) + return -1; + realigned = 1; + off2 = (size_t)((u_long)ip & 0x3); + if (off2) + off2 = 4 - off2; len = msgdsize(m); - m2 = allocb(len, BPRI_HI); + m2 = allocb(len + off2, BPRI_HI); if (m2 == NULL) { frstats[out].fr_pull[1]++; return -1; } + MTYPE(m2) = M_DATA; + if (m->b_rptr != (u_char *)ip) + m2->b_rptr += off2; m2->b_wptr = m2->b_rptr + len; - s = (u_char *)ip; - for (bp = m2->b_rptr; m; bp += len) { - len = m->b_wptr - s; - bcopy(m->b_rptr, bp, len); - m = m->b_cont; - if (m) - s = m->b_rptr; + m1 = m; + s = (u_char *)m->b_rptr; + for (bp = m2->b_rptr; m1 && (bp < m2->b_wptr); bp += len) { + len = MIN(m1->b_wptr - s, m2->b_wptr - bp); + bcopy(s, bp, len); + m1 = m1->b_cont; + if (m1) + s = m1->b_rptr; + } + + if (mt != m && mt->b_cont == m && !off) { + /* + * check if the buffer we're changing is chained in- + * between other buffers and unlink/relink as required. + */ + (void) unlinkb(mt); /* should return 'm' */ + m1 = unlinkb(m); + if (m1) + linkb(m2, m1); + freemsg(m); + linkb(mt, m2); + } else { + if (m == mt) { + m1 = unlinkb(mt); + if (m1) + linkb(m2, m1); + } + freemsg(mt); + *mp = m2; + mt = m2; } - *mp = m2; - MTYPE(m2) = M_DATA; - freemsg(mt); - mt = m2; frstats[out].fr_pull[0]++; synced = 1; @@ -714,7 +798,7 @@ fixalign: #ifndef sparc # if SOLARIS2 >= 8 if (sap == IP6_DL_SAP) { - ip6->ip6_plen = plen; + ip6->ip6_plen = plen - sizeof(*ip6); } else { # endif __ipoff = (u_short)ip->ip_off; @@ -734,7 +818,7 @@ fixalign: if (( #if SOLARIS2 >= 8 - (sap == IP6_DL_SAP) && (mlen < iphlen + plen)) || + (sap == IP6_DL_SAP) && (mlen < plen)) || ((sap == 0) && #endif ((iphlen < hlen) || (iphlen > plen) || (mlen < plen)))) { @@ -744,7 +828,7 @@ fixalign: #ifndef sparc # if SOLARIS2 >= 8 if (sap == IP6_DL_SAP) { - ip6->ip6_plen = htons(plen); + ip6->ip6_plen = htons(plen - sizeof(*ip6)); } else { # endif __ipoff = (u_short)ip->ip_off; @@ -790,15 +874,13 @@ fixalign: break; } + woff = 0; if (hlen > mlen) { hlen = mlen; -#if SOLARIS2 >= 8 - } else if (sap == IP6_DL_SAP) { - if (m->b_wptr - m->b_rptr > plen + hlen) - m->b_wptr = m->b_rptr + plen + hlen; -#endif - } else if (m->b_wptr - m->b_rptr > plen) - m->b_wptr = m->b_rptr + plen; + } else if (m->b_wptr - m->b_rptr > plen) { + woff = m->b_wptr - m->b_rptr - plen; + m->b_wptr -= woff; + } /* * If we don't have enough data in the mblk or we haven't yet copied @@ -806,7 +888,7 @@ fixalign: */ if ((hlen > len)) { if (!pullupmsg(m, (int)hlen)) { - cmn_err(CE_NOTE, "pullupmsg failed\n"); + cmn_err(CE_NOTE, "pullupmsg failed"); frstats[out].fr_pull[1]++; return -1; } @@ -818,8 +900,9 @@ fixalign: qif->qf_off = off; qif->qf_len = len; err = fr_check(ip, iphlen, qif->qf_ill, out, qif, mp); - if (err == 2) + if (err == 2) { goto fixalign; + } /* * Copy back the ip header data if it was changed, we haven't yet * freed the message and we aren't going to drop the packet. @@ -828,11 +911,12 @@ fixalign: */ if (*mp != NULL) { if (*mp == mt) { + m->b_wptr += woff; m->b_rptr -= off; #ifndef sparc # if SOLARIS2 >= 8 if (sap == IP6_DL_SAP) { - ip6->ip6_plen = htons(plen); + ip6->ip6_plen = htons(plen - sizeof(*ip6)); } else { # endif __ipoff = (u_short)ip->ip_off; @@ -847,13 +931,37 @@ fixalign: #endif } else cmn_err(CE_NOTE, - "!IP Filter: *mp %p mt %p %s\n", *mp, mt, + "!IP Filter: *mp %p mt %p %s", *mp, mt, "mblk changed, cannot revert ip_len, ip_off"); } return err; } +/* + * Only called for M_IOCACK messages + */ +void fr_qif_update(qif, mp) +qif_t *qif; +mblk_t *mp; +{ + struct iocblk *iocp; + + if (!qif || !mp) + return; + iocp = (struct iocblk *)mp->b_rptr; + if (mp->b_cont && (iocp->ioc_cmd == DL_IOC_HDR_INFO)) { + mp = mp->b_cont; + if (MTYPE(mp) == M_PROTO && mp->b_cont) { + mp = mp->b_cont; + if (MTYPE(mp) == M_DATA) { + qif->qf_hl = mp->b_wptr - mp->b_rptr; + } + } + } +} + + int fr_qin(q, mb) queue_t *q; mblk_t *mb; @@ -863,6 +971,7 @@ mblk_t *mb; if (fr_running <= 0) { mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } @@ -871,6 +980,17 @@ mblk_t *mb; mblk_t *m1; m1 = copymsg(mb); + if (!m1) { + frstats[0].fr_drop++; + mb->b_next = NULL; + mb->b_prev = NULL; + freemsg(mb); + return 0; + } + m1->b_next = mb->b_next; + mb->b_next = NULL; + m1->b_prev = mb->b_prev; + mb->b_prev = NULL; freemsg(mb); mb = m1; frstats[0].fr_copy++; @@ -881,6 +1001,7 @@ again: if (fr_running <= 0) { RWLOCK_EXIT(&ipf_solaris); mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } @@ -925,17 +1046,21 @@ again: frstats[0].fr_drop++; RWLOCK_EXIT(&ipf_solaris); mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } - bcopy((char *)qif, (char *)&qf, sizeof(qf)); - qif = &qf; - type = MTYPE(mb); pnext = qif->qf_rqinfo->qi_putp; + type = MTYPE(mb); + if (type == M_IOCACK) + fr_qif_update(qif, mb); + else { + bcopy((char *)qif, (char *)&qf, sizeof(qf)); - if (datamsg(type) || (type == M_BREAK)) - err = fr_precheck(&mb, q, qif, 0); + if (datamsg(type) || (type == M_BREAK)) + err = fr_precheck(&mb, q, &qf, 0); + } RWLOCK_EXIT(&ipfs_mutex); RWLOCK_EXIT(&ipf_solaris); @@ -944,11 +1069,13 @@ again: if (pnext) return (*pnext)(q, mb); - cmn_err(CE_WARN, "!IP Filter: inp NULL: qif %x q %x info %x", - qif, q, q->q_qinfo); + cmn_err(CE_WARN, + "!IP Filter: inp NULL: qif %x %s q %x info %x", + &qf, qf.qf_name, q, q->q_qinfo); } if (mb) { mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); } return 0; @@ -964,14 +1091,32 @@ mblk_t *mb; if (fr_running <= 0) { mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } - if (mb->b_datap->db_ref > 1) { +#if SOLARIS2 >= 6 + if ((!dohwcksum || mb->b_ick_flag != ICK_VALID) && + (mb->b_datap->db_ref > 1)) +#else + if (mb->b_datap->db_ref > 1) +#endif + { mblk_t *m1; m1 = copymsg(mb); + if (!m1) { + frstats[1].fr_drop++; + mb->b_next = NULL; + mb->b_prev = NULL; + freemsg(mb); + return 0; + } + m1->b_next = mb->b_next; + mb->b_next = NULL; + m1->b_prev = mb->b_prev; + mb->b_prev = NULL; freemsg(mb); mb = m1; frstats[1].fr_copy++; @@ -982,6 +1127,7 @@ again: if (fr_running <= 0) { RWLOCK_EXIT(&ipf_solaris); mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } @@ -998,7 +1144,7 @@ again: synced = 1; goto again; } - /* fr_donotip(0, NULL, q, mb, mb, NULL, 0); */ + /* fr_donotip(1, NULL, q, mb, mb, NULL, 0); */ RWLOCK_EXIT(&ipf_solaris); return (*pnext)(q, mb); } @@ -1036,17 +1182,21 @@ again: frstats[1].fr_drop++; RWLOCK_EXIT(&ipf_solaris); mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } - bcopy((char *)qif, (char *)&qf, sizeof(qf)); - qif = &qf; - type = MTYPE(mb); pnext = qif->qf_wqinfo->qi_putp; + type = MTYPE(mb); + if (type == M_IOCACK) + fr_qif_update(qif, mb); + else { + bcopy((char *)qif, (char *)&qf, sizeof(qf)); - if (datamsg(type) || (type == M_BREAK)) - err = fr_precheck(&mb, q, qif, 1); + if (datamsg(type) || (type == M_BREAK)) + err = fr_precheck(&mb, q, &qf, 1); + } RWLOCK_EXIT(&ipfs_mutex); RWLOCK_EXIT(&ipf_solaris); @@ -1057,10 +1207,11 @@ again: cmn_err(CE_WARN, "!IP Filter: outp NULL: qif %x %s q %x info %x", - qif, qif->qf_name, q, q->q_qinfo); + &qf, qf.qf_name, q, q->q_qinfo); } if (mb) { mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); } return 0; @@ -1080,6 +1231,7 @@ void *arg; RWLOCK_EXIT(&ipf_solaris); } + static int ipf_ip_qin(q, mb) queue_t *q; mblk_t *mb; @@ -1089,6 +1241,7 @@ mblk_t *mb; if (fr_running <= 0) { mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } @@ -1100,18 +1253,24 @@ mblk_t *mb; if (fr_running <= 0) { RWLOCK_EXIT(&ipf_solaris); mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); return 0; } ioc = (struct iocblk *)mb->b_rptr; - switch (ioc->ioc_cmd) { + switch (ioc->ioc_cmd) + { + case DL_IOC_HDR_INFO: + fr_qif_update(qif_from_queue(q), mb); + break; case I_LINK: case I_UNLINK: case SIOCSIFADDR: case SIOCSIFFLAGS: #ifdef IPFDEBUG - cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x\n", ioc->ioc_cmd); + cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x", + ioc->ioc_cmd); #endif WRITE_ENTER(&ipfs_mutex); if (synctimeoutid == 0) { @@ -1135,7 +1294,7 @@ extern struct streamtab ipinfo; void solipdrvattach() { #ifdef IPFDEBUG - cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx\n", + cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx", ipdrvattcnt, &ipinfo); #endif @@ -1150,7 +1309,7 @@ void solipdrvattach() int solipdrvdetach() { #ifdef IPFDEBUG - cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx\n", + cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx", ipdrvattcnt, &ipinfo); #endif @@ -1212,7 +1371,7 @@ void solattach() KMALLOC(qif, qif_t *); if (!qif) { cmn_err(CE_WARN, - "IP Filter: malloc(%d) for qif_t failed\n", + "IP Filter: malloc(%d) for qif_t failed", sizeof(qif_t)); RWLOCK_EXIT(&ipfs_mutex); continue; @@ -1288,11 +1447,17 @@ void solattach() (hdrsizes[il->ill_type][0] == il->ill_type)) qif->qf_hl = hdrsizes[il->ill_type][1]; - if (qif->qf_hl == 0) + if (qif->qf_hl == 0 && il->ill_type != IFT_OTHER) cmn_err(CE_WARN, - "Unknown layer 2 header size for %s type %d\n", - qif->qf_name, il->ill_type); + "Unknown layer 2 header size for %s type %d", + il->ill_name, il->ill_type); } + + /* + * XXX Awful hack for PPP; fix when PPP/snoop fixed. + */ + if (il->ill_type == IFT_ETHER && !il->ill_bcast_addr_length) + qif->qf_hl = 0; #endif strncpy(qif->qf_name, il->ill_name, sizeof(qif->qf_name)); qif->qf_name[sizeof(qif->qf_name) - 1] = '\0'; @@ -1377,6 +1542,7 @@ void solattach() #endif out->q_qinfo = &qif->qf_wqinit; + ire_walk(ipf_ire_walk, (char *)qif); RWLOCK_EXIT(&ipfs_mutex); cmn_err(CE_CONT, "IP Filter: attach to [%s,%d] - %s\n", qif->qf_name, il->ill_ppa, @@ -1634,7 +1800,7 @@ frdest_t *fdp; * data, not the original, if and only if it is already pointing at * the current mblk data. */ - if (ip == (ip_t *)qf->qf_m->b_rptr && qf->qf_m != mb) + if ((ip == (ip_t *)qf->qf_m->b_rptr) && (qf->qf_m != mb)) ip = (ip_t *)mb->b_rptr; /* @@ -1646,6 +1812,7 @@ frdest_t *fdp; mp = (*mpp)->b_cont; (*mpp)->b_cont = NULL; (*mpp)->b_prev = NULL; + (*mpp)->b_next = NULL; freemsg(*mpp); *mpp = mp; } @@ -1666,7 +1833,7 @@ frdest_t *fdp; if (!ir) ir = (ire_t *)-1; - fd.fd_ifp = (struct ifnet *)ir; + fd.fd_ifp = (struct ifnet *)ir; fd.fd_ip = ip->ip_dst; fdp = &fd; } @@ -1715,6 +1882,7 @@ frdest_t *fdp; if (ifp == NULL) goto bad_fastroute; fr = fin->fin_fr; + /* * In case we're here due to "to <if>" being used with * "keep state", check that we're going in the correct @@ -1722,7 +1890,7 @@ frdest_t *fdp; */ if ((fr != NULL) && (fdp->fd_ifp != NULL) && (fin->fin_rev != 0) && (fdp == &fr->fr_tif)) - return -1; + return 1; fin->fin_ifp = ifp; if (fin->fin_out == 0) { @@ -1783,6 +1951,7 @@ frdest_t *fdp; q = WR(ir->ire_rfq); if (q) { mb->b_prev = NULL; + mb->b_next = NULL; mb->b_queue = q; RWLOCK_EXIT(&ipfs_mutex); RWLOCK_EXIT(&ipf_solaris); @@ -1804,13 +1973,16 @@ frdest_t *fdp; READ_ENTER(&ipf_solaris); READ_ENTER(&ipfs_mutex); ipl_frouteok[0]++; + *mpp = NULL; return 0; } } bad_fastroute: mb->b_prev = NULL; + mb->b_next = NULL; freemsg(mb); ipl_frouteok[1]++; + *mpp = NULL; return -1; } diff --git a/contrib/ipfilter/test/Makefile b/contrib/ipfilter/test/Makefile index 0726cdd..385c1de 100644 --- a/contrib/ipfilter/test/Makefile +++ b/contrib/ipfilter/test/Makefile @@ -15,7 +15,7 @@ first: -mkdir -p results # Filtering tests -ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 +ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 # Rule parsing tests ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 @@ -28,7 +28,7 @@ ntests: n1 n2 n3 n4 n5 n6 n7 f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f14: @/bin/sh ./dotest $@ -f12: +f12 f13: @/bin/sh ./hextest $@ i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11: @@ -38,6 +38,6 @@ n1 n2 n3 n4 n5 n6 n7: @/bin/sh ./nattest $@ clean: - /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 results/* + /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f13 f12 f14 results/* /bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 /bin/rm -f n1 n2 n3 n4 n5 n6 n7 diff --git a/contrib/ipfilter/test/expected/i7 b/contrib/ipfilter/test/expected/i7 index d1b7978..db9cd01 100644 --- a/contrib/ipfilter/test/expected/i7 +++ b/contrib/ipfilter/test/expected/i7 @@ -1,4 +1,4 @@ pass in on ed0(!) proto tcp from 127.0.0.1/32 to 127.0.0.1/32 port = 23 flags S/SA -block in on lo0(!) proto tcp from any to any flags A/0xbf +block in on lo0(!) proto tcp from any to any flags A/FSRPAUC pass in on lo0(!) proto tcp from any to any flags /SPA -block in on lo0(!) proto tcp from any to any flags 0x80/A +block in on lo0(!) proto tcp from any to any flags C/A diff --git a/contrib/ipfilter/test/input/f13 b/contrib/ipfilter/test/input/f13 index 56ec16d..b90d6ba 100644 --- a/contrib/ipfilter/test/input/f13 +++ b/contrib/ipfilter/test/input/f13 @@ -33,6 +33,10 @@ 45 00 001c 0008 2000 3f 11 0000 01010101 02010101 0035003500040000 +# 1.1.1.1,1 -> 2.1.1.1,1 TTL=63 UDP MF FO=0 (short) +45 00 0018 0008 2000 3f 11 0000 01010101 02010101 +00350036 + # 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP FO=1 45 00 001c 0008 0001 3f 11 0000 01010101 02010101 0000000000000000 |