summaryrefslogtreecommitdiffstats
path: root/sbin/ipfw
Commit message (Collapse)AuthorAgeFilesLines
* Forgot this one: properly initialize an address set when the setluigi2002-07-311-3/+1
| | | | | size is less than 32 bits (/28 mask or more). Also remove a debugging fprintf().
* Two bugfixes:luigi2002-07-311-15/+26
| | | | | | | | | + the header file contains two different opcodes (O_IPOPTS and O_IPOPT) for what is the same thing, and sure enough i used one in the kernel and the other one in userland. Be consistent! + "keep-state" and "limit" must be the last match pattern in a rule, so no matter how you enter them move them to the end of the rule.
* Add SEE ALSO references to papers handling RED.sheldonh2002-07-251-0/+26
|
* A bunch of minor fixes:luigi2002-07-131-8/+11
| | | | | | | | | | | | * accept "icmptype" as an alias for "icmptypes"; * remove an extra whitespace after "log" rules; * print correctly the "limit" masks; * correct a typo in parsing dummynet arguments (this caused a coredump); * do not allow specifying both "check-state" and "limit", they are (and have always been) mutually exclusive; * remove an extra print of the rule before installing it; * make stdout buffered -- otherwise, if you log its output with syslog, you will see one entry for each printf(). Rather unpleasant.
* Uncommented WARNS=0. ipfw2.c is full of printf format errors that arebde2002-07-111-1/+1
| | | | | | | | fatal on alphas. Fixed setting of WARNS. WARNS should never be set unconditionally, since this breaks testing of different WARNS values by setting it at a higher level (e.g., on the command line).
* Fixed some world breakage caused by not updating clients when <timeconv.h>bde2002-07-081-0/+1
| | | | | was split off from <time.h>. This became fatal here when -Werror was reenabled.
* The .Nm utilitycharnier2002-07-061-1/+2
|
* Implement the last 2-3 missing instructions for ipfw,luigi2002-07-051-124/+108
| | | | | | | | | | | | | | | | now it should support all the instructions of the old ipfw. Fix some bugs in the user interface, /sbin/ipfw. Please check this code against your rulesets, so i can fix the remaining bugs (if any, i think they will be mostly in /sbin/ipfw). Once we have done a bit of testing, this code is ready to be MFC'ed, together with a bunch of other changes (glue to ipfw, and also the removal of some global variables) which have been in -current for a couple of weeks now. MFC after: 7 days
* The new ipfw code.luigi2002-06-272-1/+3180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code makes use of variable-size kernel representation of rules (exactly the same concept of BPF instructions, as used in the BSDI's firewall), which makes firewall operation a lot faster, and the code more readable and easier to extend and debug. The interface with the rest of the system is unchanged, as witnessed by this commit. The only extra kernel files that I am touching are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In userland I only had to touch those programs which manipulate the internal representation of firewall rules). The code is almost entirely new (and I believe I have written the vast majority of those sections which were taken from the former ip_fw.c), so rather than modifying the old ip_fw.c I decided to create a new file, sys/netinet/ip_fw2.c . Same for the user interface, which is in sbin/ipfw/ipfw2.c (it still compiles to /sbin/ipfw). The old files are still there, and will be removed in due time. I have not renamed the header file because it would have required touching a one-line change to a number of kernel files. In terms of user interface, the new "ipfw" is supposed to accepts the old syntax for ipfw rules (and produce the same output with "ipfw show". Only a couple of the old options (out of some 30 of them) has not been implemented, but they will be soon. On the other hand, the new code has some very powerful extensions. First, you can put "or" connectives between match fields (and soon also between options), and write things like ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any This should make rulesets slightly more compact (and lines longer!), by condensing 2 or more of the old rules into single ones. Also, as an example of how easy the rules can be extended, I have implemented an 'address set' match pattern, where you can specify an IP address in a format like this: 10.20.30.0/26{18,44,33,22,9} which will match the set of hosts listed in braces belonging to the subnet 10.20.30.0/26 . The match is done using a bitmap, so it is essentially a constant time operation requiring a handful of CPU instructions (and a very small amount of memmory -- for a full /24 subnet, the instruction only consumes 40 bytes). Again, in this commit I have focused on functionality and tried to minimize changes to the other parts of the system. Some performance improvement can be achieved with minor changes to the interface of ip_fw_chk_t. This will be done later when this code is settled. The code is meant to compile unmodified on RELENG_4 (once the PACKET_TAG_* changes have been merged), for this reason you will see #ifdef __FreeBSD_version in a couple of places. This should minimize errors when (hopefully soon) it will be time to do the MFC.
* Handle symbolic names for common ethernet types (ip, arp etc.)luigi2002-05-131-19/+85
| | | | | Remove custom definitions (IP_FW_TCPF_SYN etc.) of TCP header flags which are the same as the original ones (TH_SYN etc.)
* Main functional change is the implementation of matching of MAC headerluigi2002-05-121-745/+706
| | | | | | | | | | | | | | | | | | | fields as discussed in the commit to ip_fw.c:1.186 On top of this, a ton of non functional changes to clean up the code, write functions to replace sections of code that were replicated multiple times (e.g. the printing or matching of flags and options), splitting long sections of inlined code into separate functions, and the like. I have tested the code quite a bit, but some typos (using one variable in place of another) might have escaped. The "embedded manpage" is a bit inconsistent, but i am leaving fixing it for later. The current format makes no sense, it is over 40 lines long and practically unreadable. We can either split it into sections ( ipfw -h options , ipfw -h pipe , ipfw -h queue ...) or remove it altogether and refer to the manpage.
* Fix a couple of problems which could cause panics at runtime:luigi2002-05-051-51/+56
| | | | | | | | | | | | | | | | + setting a bandwidth too large for a pipe (above 2Gbit/s) could cause the internal representation (which is int) to wrap to a negative number, causing an infinite loop in the kernel; + (see PR bin/35628): when configuring RED parameters for a queue, the values are not passed to the kernel resulting in panics at runtime (part of the problem here is also that the kernel does not check for valid parameters being passed, but this will be fixed in a separate commit). These are both critical fixes which need to be merged into 4.6-RELEASE. MFC after: 1 day
* Enlighten those who read the FINE POINTS of the documentation a bitcjc2002-05-011-3/+14
| | | | | | | | | more on how ipfw(8) deals with tiny fragments. While we're at it, add a quick log message to even let people know we dropped a packet. (Note that the second FINE POINT is somewhat redundant given the first, but since the code is there, leave the docs for it.) MFC after: 1 day
* I've been meaning to do this for a while. Add an underscore to thedillon2002-01-191-1/+1
| | | | | | | | time_to_xxx() and xxx_to_time() functions. e.g. _time_to_xxx() instead of time_to_xxx(), to make it more obvious that these are stopgap functions & placemarkers and not meant to create a defacto standard. They will eventually be replaced when a real standard comes out of committee.
* mdoc(7) police: tidy up the markup in revision 1.96.ru2002-01-101-5/+12
|
* o Note that packets diverted using a 'divert' socket, and thenrwatson2002-01-031-0/+9
| | | | | | | | reinserted by a userland process, will lose a number of packet attributes, including their source interface. This may affect the behavior of later rules, and while not strictly a BUG, may cause unexpected behavior if not clearly documented. A similar note for natd(8) might be desirable.
* Move the discussion of how many times a packet will pass throughyar2002-01-021-20/+18
| | | | | | | | ipfirewall(4) to the IMPLEMENTATION NOTES section because it considers kernel internals and may confuse newbies if placed at the very beginning of the manpage (where it used to be previously.) Not objected by: luigi
* Clarify the "show" ipfw(8) command.yar2002-01-021-2/+6
| | | | | PR: docs/31263 Permitted by: luigi
* Fix a typo: wierd -> weirdyar2002-01-021-1/+1
|
* Fix documentation to match realityjulian2001-12-281-7/+15
|
* Implement matching IP precedence in ipfw(4).yar2001-12-212-0/+24
| | | | Submitted by: Igor Timkin <ivt@gamma.ru>
* At least once mention the long names of WF2Q+ (Worst-case Fair Weightedrse2001-12-141-2/+2
| | | | | | Fair Queueing) and RED (Random Early Detection) to both give the reader a hint what they are and to make it easier to find out more information about them.
* Default to WARNS=2.obrien2001-12-041-1/+1
| | | | | | Binary builds that cannot handle this must explicitly set WARNS=0. Reviewed by: mike
* sync the code with the one in stable (mostly formatting changes).luigi2001-11-041-26/+27
|
* Fix a typo in a format string, and fix error checking for missingluigi2001-11-011-6/+5
| | | | masks in "limit" rules.
* More white space changes.joe2001-10-291-3/+3
|
* More stylistic tidying.joe2001-10-291-20/+21
|
* Remove training white spaces, and some other style violations.joe2001-10-291-90/+90
|
* Properly convert long to time_tdillon2001-10-281-1/+2
|
* Remove some extraneous spaces from the usage message.joe2001-10-281-1/+1
|
* Repair typo.dd2001-10-141-1/+1
| | | | | PR: 31262 Submitted by: <swear@blarg.net>
* mdoc(7) police: fix markup.ru2001-10-011-56/+27
|
* now that jlemon has added a hash table to lookup locally configured ipbillf2001-09-291-3/+2
| | | | | | | | addresses (and the macros that ipfw(4) use to lookup data for the 'me' keyword have been converted) remove a comment about using 'me' being a "computationally expensive" operation. while I'm here, change two instances of "IP number" to "IP address"
* Two main changes here:luigi2001-09-272-36/+102
| | | | | | | | | | | | | | | + implement "limit" rules, which permit to limit the number of sessions between certain host pairs (according to masks). These are a special type of stateful rules, which might be of interest in some cases. See the ipfw manpage for details. + merge the list pointers and ipfw rule descriptors in the kernel, so the code is smaller, faster and more readable. This patch basically consists in replacing "foo->rule->bar" with "rule->bar" all over the place. I have been willing to do this for ages! MFC after: 1 week
* A bunch of minor changes to the code (see below) for readability, code sizeluigi2001-09-201-8/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and speed. No new functionality added (yet) apart from a bugfix. MFC will occur in due time and probably in stages. BUGFIX: fix a problem in old code which prevented reallocation of the hash table for dynamic rules (there is a PR on this). OTHER CHANGES: minor changes to the internal struct for static and dynamic rules. Requires rebuild of ipfw binary. Add comments to show how data structures are linked together. (It probably makes no sense to keep the chain pointers separate from actual rule descriptors. They will be hopefully merged soon. keep a (sysctl-readable) counter for the number of static rules, to speed up IP_FW_GET operations initial support for a "grace time" for expired connections, so we can set timeouts for closing connections to much shorter times. merge zero_entry() and resetlog_entry(), they use basically the same code. clean up and reduce replication of code for removing rules, both for readability and code size. introduce a separate lifetime for dynamic UDP rules. fix a problem in old code which prevented reallocation of the hash table for dynamic rules (PR ...) restructure dynamic rule descriptors introduce some local variables to avoid multiple dereferencing of pointer chains (reduces code size and hopefully increases speed).
* Non-decimal ``skipto'' rule numbers are meaningless.ru2001-09-191-1/+1
| | | | | Noticed by: "Marc G. Fournier" <scrappy@hub.org> MFC after: 3 days
* mdoc(7) police:ru2001-08-071-22/+12
| | | | | | | Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text. Not only this slows down the mdoc(7) processing significantly, but it also has an undesired (in this case) effect of disabling hyphenation within the entire enclosed block.
* Fixed one more breakage introduced in 1.103 cleanup.ru2001-08-061-1/+2
| | | | | | | | | ICMP types were reported incorrectly: # ipfw add allow icmp from any to any icmptypes 0,8 PR: bin/29185 Submitted by: Mike Durian <durian@boogie.com>
* style(9)obrien2001-08-011-1/+1
|
* Error messaging in ipfw(8) was out of hand, almost 50 lines of usagecjc2001-07-221-109/+114
| | | | | | | | | | | | | | information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
* mdoc(7) police: removed HISTORY info from the .Os call.ru2001-07-101-1/+1
|
* Fix rule parsing breakage introduced in 1.103 cleanup. 'tcp' andcjc2001-07-101-5/+8
| | | | | | | 'icmp' rules could drop into infinite loops when given bad arguments. Reviewed by: ru, des Approved by: ru
* mdoc(7) police: remove extraneous .Pp before and/or after .Sh.dd2001-07-091-1/+0
|
* Silence format string warnings.kris2001-07-011-11/+11
| | | | MFC after: 2 weeks
* Mention Alexandre Peixoto's share/examples/ipfw/change_rules.sh in thechris2001-06-061-0/+3
| | | | | | checklist. MFC after: 1 week
* Invert the meaning of the -d option (i.e. default to *not* list dynamic rules,des2001-06-042-1119/+1160
| | | | | | | | | | | | | | | but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
* Add a flag to "ipfw show" which supresses the display of dynamicdwmalone2001-05-202-3/+10
| | | | | | | | | | rules. Also, don't show dynamic rules if you only asked to see a certain rule number. PR: 18550 Submitted by: Lyndon Nerenberg <lyndon@orthanc.ab.ca> Approved by: luigi MFC after: 2 weeks
* Update comment to match ipfw/ipfw.c,v 1.95.ru2001-04-131-3/+2
|
* Fixed some printf format errors (don't assume that ntohl() returns u_long).bde2001-04-051-2/+2
|
* - Backout botched attempt to introduce MANSECT feature.ru2001-03-261-0/+1
| | | | - MAN[1-9] -> MAN.
OpenPOWER on IntegriCloud