diff options
Diffstat (limited to 'sbin/ipfw/ipfw.c')
| -rw-r--r-- | sbin/ipfw/ipfw.c | 80 |
1 files changed, 61 insertions, 19 deletions
diff --git a/sbin/ipfw/ipfw.c b/sbin/ipfw/ipfw.c index ba5d36c..c7fa1d5 100644 --- a/sbin/ipfw/ipfw.c +++ b/sbin/ipfw/ipfw.c @@ -168,6 +168,18 @@ print_reject_code(int code) printf("%u", code); } +/** + * _s_x holds a string-int pair for various lookups. + * s=NULL terminates the struct. + */ +struct _s_x { char *s; int x; }; +static struct _s_x limit_masks[] = { + {"src-addr", DYN_SRC_ADDR}, + {"src-port", DYN_SRC_PORT}, + {"dst-addr", DYN_DST_ADDR}, + {"dst-port", DYN_DST_PORT}, + {NULL, 0} }; + static void show_ipfw(struct ip_fw *chain) { @@ -204,7 +216,7 @@ show_ipfw(struct ip_fw *chain) } if (chain->fw_flg & IP_FW_F_RND_MATCH) { - double d = 1.0 * (int)(chain->pipe_ptr); + double d = 1.0 * chain->dont_match_prob; d = 1 - (d / 0x7fffffff); printf("prob %f ", d); } @@ -373,16 +385,22 @@ show_ipfw(struct ip_fw *chain) } if (chain->fw_flg & IP_FW_F_KEEP_S) { - u_long x = (u_long)chain->next_rule_ptr; - u_char type = (x) & 0xff ; + struct _s_x *p = limit_masks; - switch(type) { + switch(chain->dyn_type) { default: printf(" *** unknown type ***"); break ; case DYN_KEEP_STATE: printf(" keep-state"); break; + case DYN_LIMIT: + printf(" limit"); + for ( ; p->s != NULL ; p++) + if (chain->limit_mask & p->x) + printf(" %s", p->s); + printf(" %d", chain->conn_limit); + break ; } } /* Direction */ @@ -573,11 +591,17 @@ show_dyn_ipfw(struct ipfw_dyn_rule *d) return; printf("%05d %qu %qu (T %ds, slot %d)", - (int)(d->chain), + (int)(d->rule), d->pcnt, d->bcnt, d->expire, d->bucket); switch (d->dyn_type) { + case DYN_LIMIT_PARENT: + printf(" PARENT %d", d->count); + break; + case DYN_LIMIT: + printf(" LIMIT"); + break; case DYN_KEEP_STATE: /* bidir, no mask */ printf(" <->"); break; @@ -589,17 +613,10 @@ show_dyn_ipfw(struct ipfw_dyn_rule *d) printf(" %u,", d->id.proto); a.s_addr = htonl(d->id.src_ip); - printf(" %s", inet_ntoa(a)); - printf(" %d", d->id.src_port); + printf(" %si %d", inet_ntoa(a), d->id.src_port); - switch (d->dyn_type) { - default: /* bidir, no mask */ - printf(" <->"); - break; - } a.s_addr = htonl(d->id.dst_ip); - printf(" %s", inet_ntoa(a)); - printf(" %d", d->id.dst_port); + printf("<-> %s %d", inet_ntoa(a), d->id.dst_port); printf("\n"); } @@ -864,9 +881,9 @@ list(int ac, char *av[]) /* already warned */ continue; for (n = 0, d = dynrules; n < ndyn; n++, d++) { - if ((int)(d->chain) > rnum) + if ((int)(d->rule) > rnum) break; - if ((int)(d->chain) == rnum) + if ((int)(d->rule) == rnum) show_dyn_ipfw(d); } } @@ -1714,8 +1731,7 @@ add(int ac, char *av[]) errx(EX_DATAERR, "illegal match prob. %s", av[1]); if (d != 1) { /* 1 means always match */ rule.fw_flg |= IP_FW_F_RND_MATCH; - /* we really store dont_match probability */ - (long)rule.pipe_ptr = (long)((1 - d) * 0x7fffffff); + rule.dont_match_prob = (long)((1 - d) * 0x7fffffff); } av += 2; ac -= 2; } @@ -1976,13 +1992,39 @@ add(int ac, char *av[]) } else if (!strncmp(*av, "in", strlen(*av))) { rule.fw_flg |= IP_FW_F_IN; av++; ac--; + } else if (!strncmp(*av,"limit",strlen(*av))) { + /* keep-state rules used to limit number of connections. */ + rule.fw_flg |= IP_FW_F_KEEP_S; + rule.dyn_type = DYN_LIMIT ; + rule.limit_mask = 0 ; + av++; ac--; + for (; ac >1 ;) { + struct _s_x *p = limit_masks; + int found = 0; + for ( ; p->s != NULL ; p++) + if (!strncmp(*av, p->s, strlen(*av))) { + rule.limit_mask |= p->x ; + av++; ac-- ; + } + if (found == 0) { + if (rule.limit_mask == 0) + errx(EX_USAGE, "missing limit mask"); + break ; + } + } + if (ac < 1) + errx(EX_USAGE, "limit needs mask and # of connections"); + rule.conn_limit = atoi(*av); + if (rule.conn_limit == 0) + errx(EX_USAGE, "limit: limit must be >0"); + av++; ac--; } else if (!strncmp(*av, "keep-state", strlen(*av))) { u_long type; rule.fw_flg |= IP_FW_F_KEEP_S; av++; ac--; if (ac > 0 && (type = atoi(*av)) != 0) { - (int)rule.next_rule_ptr = type; + rule.dyn_type = type; av++; ac--; } } else if (!strncmp(*av, "bridged", strlen(*av))) { |
