| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
error in the usage printf())
Reviewed by: rwatson
|
| |
|
|
|
|
|
|
|
| |
into add without problems.
The previous commit had the other half of this original patch which handled
tcpflags/tcpflgs confusion in output/input.
|
|
|
|
|
| |
ambiguous data to the userland program (kernel operation was
safe, anyways).
|
| |
|
|
|
|
|
|
|
|
|
|
| |
It also squashes 99% of packet kiddie synflood orgies. For example, to
rate syn packets without MSS,
ipfw pipe 10 config 56Kbit/s queue 10Packets
ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss
Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
|
| |
|
|
|
|
| |
Manpage coming later...
|
| |
|
|
|
|
| |
us to remove this include.
|
|
|
|
| |
rule that logs without a log limit, use "logamount 0" in addition to "log".
|
|
|
|
| |
Reviewed by: luigi, sheldonh
|
| |
|
|
|
|
| |
Approved-by: jordan
|
|
|
|
|
|
|
| |
Implement masks on UDP/TCP ports.
Large rewrite of the manpage.
Work supported by Akamba Corp.
|
|
|
|
|
|
|
|
| |
Packets that match a tee rule should not be immediately accepted,
but should continue going through the rule list. This may be fixed
in a later version.
I hope to fix this soon in a separate commit.
|
| |
|
|
|
|
|
|
| |
names/numbers.
Reviewed by: chris
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
using syslog(3) (log(9)) for its various purposes! This long-awaited
change also includes such nice things as:
* macros expanding into _two_ comma-delimited arguments!
* snprintf!
* more snprintf!
* linting and criticism by more people than you can shake a stick at!
* a slightly more uniform message style than before!
and last but not least
* no less than 5 rewrites!
Reviewed by: committers
|
| |
|
|
|
|
|
|
| |
Because the kernel change was done in a backward-compatible way,
you don't need to recompile ipfw if you don't want to use the new
feature.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
_or_ you may specify "log logamount number" to set logging specifically
the rule.
In addition, "ipfw resetlog" has been added, which will reset the
logging counters on any/all rule(s). ipfw resetlog does not affect
the packet/byte counters (as ipfw reset does), and is the only "set"
command that can be run at securelevel >= 3.
This should address complaints about not being able to set logging
amounts, not being able to restart logging at a high securelevel,
and not being able to just reset logging without resetting all of the
counters in a rule.
|
|
|
|
| |
All relevant changes have been made (including ipfw.8).
|
|
|
|
|
| |
PR: 7101
Reminded by: jhs
|
|
|
|
|
|
|
|
|
|
|
| |
can't have a dash character (it is treated as a ``range'' operator).
One could now use such a name by escaping the ``-'' characters.
For example:
# ipfw add 1 count tcp from any to any "ms\-sql\-s"
# ipfw add 2 count tcp from any ftp\\-data-ftp to any
PR: 7101
|
|
|
|
|
|
| |
PR: 5047
Reviewed by: des
Test case: ipfw add allow ip from 127.1 to any
|
|
|
|
| |
Reviewed by: des,luigi
|
|
|
|
|
|
| |
grammatical fixes.
Submitted by: Philippe Charnier
|
|
|
|
|
|
|
|
|
|
|
|
| |
+ add a missing call to dn_rule_delete() when flushing firewall
rules, thus preventing possible panics due to dangling pointers
(this was already done for single rule deletes).
+ improve "usage" output in ipfw(8)
+ add a few checks to ipfw pipe parameters and make it a bit more
tolerant of common mistakes (such as specifying kbit instead of Kbit)
PR: kern/10889
Submitted by: Ruslan Ermilov
|
| |
|
|
|
|
|
|
| |
of packets can be tested.
PR: docs/7437
|
|
|
|
| |
Submitted by: Nathan Ahlstrom <nrahlstr@winternet.com>
|
| |
|
|
|
|
| |
PR: docs/9603
|
|
|
|
| |
PR: 8937
|
|
|
|
| |
Prompted by: PR docs/7785
|
| |
|
|
|
|
| |
PR: bin/8471
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This allows for more flexible ipfw configuration files using
`variables' to describe frequently used items in the file, like the
local IP address(es), interface names etc. Both m4 and cpp are useful
and supported; with m4 being a little more unusual to the common C
programmer, things like automatic rule numbering can be achieved
fairly easy.
While i was at it, i've also untangled some of the ugly style inside
main(), and fixed a bug or two (like not being able to use blank lines
when running with -q).
A typical call with preprocessor invocation looks like
ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules
Someone should probably add support for this feature to /etc/rc.firewall.
|
|
|
|
|
|
|
|
|
| |
icmptypes.
PR: 8067
Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com>
While I'm here, staticize functions.
|
|
|
|
|
| |
Added support for -q (suppress output) when firewall rules are taken from a
file. Solves PR 7475
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Any packet that can be matched by a ipfw rule can be redirected
transparently to another port or machine. Redirection to another port
mostly makes sense with tcp, where a session can be set up
between a proxy and an unsuspecting client. Redirection to another machine
requires that the other machine also be expecting to receive the forwarded
packets, as their headers will not have been modified.
/sbin/ipfw must be recompiled!!!
Reviewed by: Peter Wemm <peter@freebsd.org>
Submitted by: Chrisy Luke <chrisy@flix.net>
|
|
|
|
| |
Bring man page up to date with -q flag behaviour.
|
| |
|
|
|
|
|
| |
Submitted by: Andre Albsmeier <andre.albsmeier@mchp.siemens.de>
Make -q work for zeroing a specific rule.
|
|
|
|
|
|
|
|
|
|
| |
not reinitialized to 1 after calling getopt. This results in parsing
errors on all but the first rule. An added patch also allows '#'
comments at the end of a line.
PR: 6379
Reviewed by: phk
Submitted by: Neal Fachan <kneel@ishiboo.com>
|
| |
|
| |
|
|
|
|
| |
Submitted by: bde
|