1 files changed, 50 insertions, 38 deletions

diff --git a/sys/contrib/ipfilter/netinet/ip_fil.h b/sys/contrib/ipfilter/netinet/ip_fil.h
index 2934f7d..b63769a 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.h
+++ b/sys/contrib/ipfilter/netinet/ip_fil.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1993-2001 by Darren Reed.
+ * Copyright (C) 1993-2002 by Darren Reed.
  *
  * See the IPFILTER.LICENCE file for details on licencing.
  *
@@ -35,6 +35,10 @@
 # endif
 #endif
 
+#ifndef	offsetof
+# define	offsetof(t,m)	(int)((&((t *)0L)->m))
+#endif
+
 #if defined(__STDC__) || defined(__GNUC__)
 # define	SIOCADAFR	_IOW('r', 60, struct frentry *)
 # define	SIOCRMAFR	_IOW('r', 61, struct frentry *)
@@ -52,8 +56,8 @@
 # define	SIOCFRSYN	_IOW('r', 73, u_int)
 # define	SIOCFRZST	_IOWR('r', 74, struct friostat *)
 # define	SIOCZRLST	_IOWR('r', 75, struct frentry *)
-# define	SIOCAUTHW	_IOWR('r', 76, struct fr_info *)
-# define	SIOCAUTHR	_IOWR('r', 77, struct fr_info *)
+# define	SIOCAUTHW	_IOWR('r', 76, struct frauth_t *)
+# define	SIOCAUTHR	_IOWR('r', 77, struct frauth_t *)
 # define	SIOCATHST	_IOWR('r', 78, struct fr_authstat *)
 # define	SIOCSTLCK	_IOWR('r', 79, u_int)
 # define	SIOCSTPUT	_IOWR('r', 80, struct ipstate_save *)
@@ -77,8 +81,8 @@
 # define	SIOCFRSYN	_IOW(r, 73, u_int)
 # define	SIOCFRZST	_IOWR(r, 74, struct friostat *)
 # define	SIOCZRLST	_IOWR(r, 75, struct frentry *)
-# define	SIOCAUTHW	_IOWR(r, 76, struct fr_info *)
-# define	SIOCAUTHR	_IOWR(r, 77, struct fr_info *)
+# define	SIOCAUTHW	_IOWR(r, 76, struct frauth_t *)
+# define	SIOCAUTHR	_IOWR(r, 77, struct frauth_t *)
 # define	SIOCATHST	_IOWR(r, 78, struct fr_authstat *)
 # define	SIOCSTLCK	_IOWR(r, 79, u_int)
 # define	SIOCSTPUT	_IOWR(r, 80, struct ipstate_save *)
@@ -124,7 +128,9 @@ typedef	struct	fr_ip	{
 #define	FI_W_SADDR	0x00000400
 #define	FI_W_DADDR	0x00000800
 #define	FI_WILDA	(FI_W_SADDR|FI_W_DADDR)
-#define	FI_NEWFR	0x00001000
+#define	FI_NEWFR	0x00001000	/* Create a filter rule */
+#define	FI_IGNOREPKT	0x00002000	/* Do not treat as a real packet */
+#define	FI_NORULE	0x00004000	/* Not direct a result of a rule */
 
 typedef	struct	fr_info	{
 	void	*fin_ifp;		/* interface packet is `on' */
@@ -136,10 +142,12 @@ typedef	struct	fr_info	{
 	u_char	fin_tcpf;		/* TCP header flags (SYN, ACK, etc) */
 	/* From here on is packet specific */
 	u_char	fin_icode;		/* ICMP error to return */
-	u_short	fin_rule;		/* rule # last matched */
+	u_32_t	fin_rule;		/* rule # last matched */
 	u_32_t	fin_group;		/* group number, -1 for none */
 	struct	frentry *fin_fr;	/* last matching rule */
 	char	*fin_dp;		/* start of data past IP header */
+	u_short	fin_plen;
+	u_short	fin_off;
 	u_short	fin_dlen;		/* length of data portion of packet */
 	u_short	fin_id;			/* IP packet id field */
 	void	*fin_mp;		/* pointer to pointer to mbuf */
@@ -147,19 +155,21 @@ typedef	struct	fr_info	{
 	void	*fin_qfm;		/* pointer to mblk where pkt starts */
 	void	*fin_qif;
 #endif
-	u_short	fin_plen;
-	u_short	fin_off;
 } fr_info_t;
 
 #define	fin_v		fin_fi.fi_v
+#define	fin_p		fin_fi.fi_p
 #define	fin_saddr	fin_fi.fi_saddr
+#define	fin_src		fin_fi.fi_src.in4
 #define	fin_daddr	fin_fi.fi_daddr
+#define	fin_dst		fin_fi.fi_dst.in4
 #define	fin_fl		fin_fi.fi_fl
 
 /*
  * Size for compares on fr_info structures
  */
 #define	FI_CSIZE	offsetof(fr_info_t, fin_icode)
+#define	FI_LCSIZE	offsetof(fr_info_t, fin_dp)
 
 /*
  * Size for copying cache fr_info structure
@@ -168,13 +178,16 @@ typedef	struct	fr_info	{
 
 typedef	struct	frdest	{
 	void	*fd_ifp;
-	struct	in_addr	fd_ip;
-	char	fd_ifname[IFNAMSIZ];
+	union	i6addr	fd_ip6;
+	char	fd_ifname[LIFNAMSIZ];
 #if SOLARIS
 	mb_t	*fd_mp;			/* cache resolver for to/dup-to */
 #endif
 } frdest_t;
 
+#define	fd_ip	fd_ip6.in4
+
+
 typedef	struct	frpcmp	{
 	int	frp_cmp;	/* data for port comparisons */
 	u_short	frp_port;	/* top port for <> and >< */
@@ -199,10 +212,7 @@ typedef	struct	frentry {
 	struct	frentry	*fr_next;
 	struct	frentry	*fr_grp;
 	int	fr_ref;		/* reference count - for grouping */
-	void	*fr_ifa;
-#if BSD >= 199306
-	void	*fr_oifa;
-#endif
+	void	*fr_ifas[4];
 	/*
 	 * These are only incremented when a packet  matches this rule and
 	 * it is the last match
@@ -219,6 +229,7 @@ typedef	struct	frentry {
 	u_short	fr_icmpm;	/* data for ICMP packets (mask) */
 	u_short	fr_icmp;
 
+	u_int	fr_age[2];	/* aging for state */
 	frtuc_t	fr_tuc;
 	u_32_t	fr_group;	/* group to which this rule belongs */
 	u_32_t	fr_grhead;	/* group # which this rule starts */
@@ -228,10 +239,7 @@ typedef	struct	frentry {
 	int	(*fr_func) __P((int, ip_t *, fr_info_t *));	/* call this function */
 	int	fr_sap;		/* For solaris only */
 	u_char	fr_icode;	/* return ICMP code */
-	char	fr_ifname[IFNAMSIZ];
-#if BSD >= 199306
-	char	fr_oifname[IFNAMSIZ];
-#endif
+	char	fr_ifnames[4][LIFNAMSIZ];
 	struct	frdest	fr_tif;	/* "to" interface */
 	struct	frdest	fr_dif;	/* duplicate packet interfaces */
 	u_int	fr_cksum;	/* checksum on filter rules for performance */
@@ -253,10 +261,11 @@ typedef	struct	frentry {
 #define	fr_src		fr_ip.fi_src.in4
 #define	fr_dmsk		fr_mip.fi_dst.in4
 #define	fr_smsk		fr_mip.fi_src.in4
+#define	fr_ifname	fr_ifnames[0]
+#define	fr_oifname	fr_ifnames[2]
+#define	fr_ifa		fr_ifas[0]
+#define	fr_oifa		fr_ifas[2]
 
-#ifndef	offsetof
-#define	offsetof(t,m)	(int)((&((t *)0L)->m))
-#endif
 #define	FR_CMPSIZ	(sizeof(struct frentry) - offsetof(frentry_t, fr_ip))
 
 /*
@@ -269,8 +278,8 @@ typedef	struct	frentry {
 #define	FR_LOG		0x00010	/* Log */
 #define	FR_LOGB		0x00011	/* Log-fail */
 #define	FR_LOGP		0x00012	/* Log-pass */
-#define	FR_LOGBODY	0x00020	/* Log the body */
-#define	FR_LOGFIRST	0x00040	/* Log the first byte if state held */
+#define	FR_NOTSRCIP	0x00020	/* not the src IP# */
+#define	FR_NOTDSTIP	0x00040	/* not the dst IP# */
 #define	FR_RETRST	0x00080	/* Return TCP RST packet - reset connection */
 #define	FR_RETICMP	0x00100	/* Return ICMP unreachable packet */
 #define	FR_FAKEICMP	0x00180	/* Return ICMP unreachable with fake source */
@@ -284,8 +293,8 @@ typedef	struct	frentry {
 #define	FR_CALLNOW	0x10000	/* call another function (fr_func) if matches */
 #define	FR_DUP		0x20000	/* duplicate packet */
 #define	FR_LOGORBLOCK	0x40000	/* block the packet if it can't be logged */
-#define	FR_NOTSRCIP	0x80000	/* not the src IP# */
-#define	FR_NOTDSTIP	0x100000	/* not the dst IP# */
+#define	FR_LOGBODY	0x80000	/* Log the body */
+#define	FR_LOGFIRST	0x100000	/* Log the first byte if state held */
 #define	FR_AUTH		0x200000	/* use authentication */
 #define	FR_PREAUTH	0x400000	/* require preauthentication */
 #define	FR_DONTCACHE	0x800000	/* don't cache the result */
@@ -407,15 +416,16 @@ typedef	struct	iplog	{
 	struct	iplog	*ipl_next;
 } iplog_t;
 
-#define IPL_MAGIC 0x49504c4d /* 'IPLM' */
+#define IPL_MAGIC	0x49504c4d /* 'IPLM' */
+#define	IPLOG_SIZE	sizeof(iplog_t)
 
 typedef	struct	ipflog	{
 #if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
         (defined(OpenBSD) && (OpenBSD >= 199603))
-	u_char	fl_ifname[IFNAMSIZ];
+	u_char	fl_ifname[LIFNAMSIZ];
 #else
 	u_int	fl_unit;
-	u_char	fl_ifname[4];
+	u_char	fl_ifname[LIFNAMSIZ];
 #endif
 	u_char	fl_plen;	/* extra data after hlen */
 	u_char	fl_hlen;	/* length of IP headers saved */
@@ -423,7 +433,8 @@ typedef	struct	ipflog	{
 	u_32_t	fl_rule;
 	u_32_t	fl_group;
 	u_32_t	fl_flags;
-	u_32_t	fl_lflags;
+	u_char	fl_dir;
+	u_char	fl_pad[3];
 } ipflog_t;
 
 
@@ -487,11 +498,11 @@ typedef	struct	ipflog	{
 
 
 #ifndef	_KERNEL
-struct ifnet;
+extern	char	*get_ifname __P((struct ifnet *));
 extern	int	fr_check __P((ip_t *, int, void *, int, mb_t **));
 extern	int	(*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-extern	int	send_reset __P((ip_t *, struct ifnet *));
-extern	int	icmp_error __P((ip_t *, struct ifnet *));
+extern	int	send_reset __P((ip_t *, fr_info_t *));
+extern	int	send_icmp_err __P((ip_t *, int, fr_info_t *, int));
 extern	int	ipf_log __P((void));
 extern	struct	ifnet *get_unit __P((char *, int));
 # if defined(__NetBSD__) || defined(__OpenBSD__) || \
@@ -509,11 +520,6 @@ extern	void	ipfilterattach __P((int));
 extern	int	iplattach __P((void));
 extern	int	ipl_enable __P((void));
 extern	int	ipl_disable __P((void));
-extern	void	ipflog_init __P((void));
-extern	int	ipflog_clear __P((minor_t));
-extern	int	ipflog_read __P((minor_t, struct uio *));
-extern	int	ipflog __P((u_int, ip_t *, fr_info_t *, mb_t *));
-extern	int	ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
 extern	int	send_icmp_err __P((ip_t *, int, fr_info_t *, int));
 extern	int	send_reset __P((ip_t *, fr_info_t *));
 # if	SOLARIS
@@ -596,6 +602,12 @@ extern	u_short	ipf_cksum __P((u_short *, int));
 extern	int	ircopyptr __P((void *, void *, size_t));
 extern	int	iwcopyptr __P((void *, void *, size_t));
 
+extern	void	ipflog_init __P((void));
+extern	int	ipflog_clear __P((minor_t));
+extern	int	ipflog __P((u_int, ip_t *, fr_info_t *, mb_t *));
+extern	int	ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
+extern	int	ipflog_read __P((minor_t, struct uio *));
+
 extern	int	frflush __P((minor_t, int));
 extern	void	frsync __P((void));
 extern	frgroup_t *fr_addgroup __P((u_32_t, frentry_t *, minor_t, int));