summaryrefslogtreecommitdiffstats
path: root/sbin/ipfw
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix one typo in help() string, remove whitespace at end of line andluigi2003-07-141-24/+23
| | | | | | other minor whitespace changes. Replace u_char with uint8_t in a few places.
* ccept of empty lines when reading from a file (this fixes a bugluigi2003-07-141-25/+52
| | | | | | | | | | | | | | introduced in the latest commits). Also: * update the 'ipfw -h' output; * allow rules of the form "100 add allow ..." i.e. with the index first. (requested by Paul Richards). This was an undocumented ipfw1 behaviour, and it is left undocumented. and minor code cleanups.
* Add a '-T' flag to print the timestamp as numeric value insteadluigi2003-07-122-5/+14
| | | | | | | of converting it with ctime(). This is a lot more convenient for postprocessing. Submitted by: "Jacob S. Barrett" <jbarrett@amduat.net>
* Document the existence of comments in ipfw rules,luigi2003-07-121-4/+11
| | | | | | | the new flags handled when reading from a file, and clarify that only numeric values are allowed for icmptypes. MFC after: 3 days
* In random order:luigi2003-07-121-218/+277
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * make the code compile with WARNS=5 (at least on i386), mostly by adding 'const' specifier and replacing "void *" with "char *" in places where pointer arithmetic was used. This also spotted a few places where invalid tests (e.g. uint < 0) were used. * support ranges in "list" and "show" commands. Now you can say ipfw show 100-1000 4000-8000 which is very convenient when you have large rulesets. * implement comments in ipfw commands. These are implemented in the kernel as O_NOP commands (which always match) whose body contains the comment string. In userland, a comment is a C++-style comment: ipfw add allow ip from me to any // i can talk to everybody The choice of '//' versus '#' is somewhat arbitrary, but because the preprocessor/readfile part of ipfw used to strip away '#', I did not want to change this behaviour. If a rule only contains a comment ipfw add 1000 // this rule is just a comment then it is stored as a 'count' rule (this is also to remind the user that scanning through a rule is expensive). * improve handling of flags (still to be completed). ipfw_main() was written thinking of 'one rule per ipfw invocation', and so flags are set and never cleared. With readfile/preprocessor support, this changes and certain flags should be reset on each line. For the time being, only fix handling of '-a' which differentiates the "list" and "show" commands. * rework the preprocessor support -- ipfw_main() already had most of the parsing code, so i have moved in there the only missing bit (stripping away '#' and comments) and removed the parsing from ipfw_readfile(). Also, add some more options (such as -c, -N, -S) to the readfile section. MFC after: 3 days
* Correct to match reality regarding interface names.dannyboy2003-07-081-3/+7
| | | | | | | PR: 51006 Submitted by: "Dmitry Pryanishnikov" <dmitry@atlantis.dp.ua> mdoc clue by: "Simon L. Nielsen" <simon@nitro.dk> MFC after: 10 days
* * introduce a section on SYNTAX to document the handlingluigi2003-07-081-44/+77
| | | | | | | | | | | | | | spaces and comma-separated lists of arguments; * reword the description of address specifications, to include previous and current changes for address sets and lists; * document the new '-n' flag. * update the section on differences between ipfw1 and ipfw2 (this is becoming boring!) MFC after: 3 days
* A bunch of changes (mostly syntactic sugar, all backward compatible):luigi2003-07-081-251/+383
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Make the addr-set size optional (defaults to /24) You can now write 1.2.3.0/24{56-80} or 1.2.3.0{56-80} Also make the parser more strict. * Support a new format for the list of addresses: 1.2.3.4,5.6.7.8/30,9.10.11.12/22,12.12.12.13, ... which exploits the new capabilities of O_IP_SRC_MASK/O_IP_DST_MASK * Allow spaces after commas to make lists of addresses more readable. 1.2.3.4, 5.6.7.8/30, 9.10.11.12/22, 12.12.12.13, ... * ipfw will now accept full commands as a single argument and strip extra leading/trailing whitespace as below: ipfw "-q add allow ip from 1.2.3.4 to 5.6.7.8, 9.10.11.23 " This should help in moving the body of ipfw into a library that user programs can invoke. * Cleanup some comments and data structures. * Do not print rule counters for dynamic rules with ipfw -d list (PR 51182) * Improve 'ipfw -h' output (PR 46785) * Add a '-n' flag to test the syntax of commands without actually calling [gs]etsockopt() (PR 44238) * Support the '-n' flag also with the preprocessors; Manpage commit to follow. MFC after: 3 days
* Implement the 'ipsec' option to match packets coming out of an ipsec tunnel.luigi2003-07-042-0/+22
| | | | | | | | | Should work with both regular and fast ipsec (mutually exclusive). See manpage for more details. Submitted by: Ari Suutari (ari.suutari@syncrontech.com) Revised by: sam MFC after: 1 week
* remove extra whitespace and blank linesluigi2003-06-271-5/+2
|
* remove unused file (RELENG_5 and above use ipfw2, the old ipfw1luigi2003-06-241-2667/+0
| | | | has been unused and unmaintained for a long time).
* Split some long lines to fit 80 columns (the code in RELENG_4luigi2003-06-231-5/+10
| | | | was already correct).
* syntactic sugar: support range notation such asluigi2003-06-231-5/+32
| | | | | | | | | | | | | | | 1.2.3.4/24{5,6,7,10-20,60-90} for set of ip addresses. Previously you needed to specify every address in the range, which was unconvenient and lead to very long lines. Internally the set is still stored in the same way, just the input and output routines are modified. Manpage update still missing. Perhaps a similar preprocessing step would be useful for port ranges. MFC after: 3 days
* o Fix sets of rules usage example.maxim2003-06-231-4/+4
| | | | | | PR: docs/53625 Submitted by: Kostyuk Oleg <cub@cub.org.ua> MFC after: 1 week
* Add support for multiple values and ranges for the "iplen", "ipttl",luigi2003-06-222-29/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | "ipid" options. This feature has been requested by several users. On passing, fix some minor bugs in the parser. This change is fully backward compatible so if you have an old /sbin/ipfw and a new kernel you are not in trouble (but you need to update /sbin/ipfw if you want to use the new features). Document the changes in the manpage. Now you can write things like ipfw add skipto 1000 iplen 0-500 which some people were asking to give preferential treatment to short packets. The 'MFC after' is just set as a reminder, because I still need to merge the Alpha/Sparc64 fixes for ipfw2 (which unfortunately change the size of certain kernel structures; not that it matters a lot since ipfw2 is entirely optional and not the default...) PR: bin/48015 MFC after: 1 week
* o Pass a correct argument to printf(3).maxim2003-06-161-3/+4
| | | | | | PR: bin/51750 Submitted by: Vasil Dimov <vd@datamax.bg> MFC after: 2 weeks
* Change handling to support strong alignment architectures such as alpha andticso2003-06-041-12/+34
| | | | | | | | sparc64. PR: alpha/50658 Submitted by: rizzo Tested on: alpha
* Add a 'verrevpath' option that verifies the interface that a packetcjc2003-03-152-0/+38
| | | | | | | | | comes in on is the same interface that we would route out of to get to the packet's source address. Essentially automates an anti-spoofing check using the information in the routing table. Experimental. The usage and rule format for the feature may still be subject to change.
* o Partially revert rev. 1.103, fix 'ipfw show': dynamically adjust amaxim2003-03-131-11/+39
| | | | | | | | | | | | | | width of fields for packets and bytes counters. PR: bin/47196 Reviewed by: -audit Not objected by: luigi, des o Use %llu instead of deprecated %qu convert specification for ipfw packets and bytes counters. Noted by: des MFC after: 1 month
* /modules is gone long ago, use the safe equivalents.ru2003-03-031-2/+2
|
* Correct examples for stateful inspectionbrueffer2003-02-041-2/+2
| | | | | | PR: 47817 Submitted by: Simon L.Nielsen <simon@nitro.dk> Reviewed by: ceri, luigi
* It turns out that we do not need to add a new ioctl to unbreak adillon2003-01-122-0/+43
| | | | | | | | | | | | | default-to-deny firewall. Simply turning off IPFW via a preexisting sysctl does the job. To make it more apparent (since nobody picked up on this in a week's worth of flames), the boolean sysctl's have been integrated into the /sbin/ipfw command set in an obvious and straightforward manner. For example, you can now do 'ipfw disable firewall' or 'ipfw enable firewall'. This is far easier to remember then the net.inet.ip.fw.enable sysctl. Reviewed by: imp MFC after: 3 days
* Fix a reference to the order of SYNOPSIS lines.keramida2003-01-051-1/+1
| | | | | | Submitted by: Olivier Cherrier <Olivier.Cherrier@cediti.be> on freebsd-net MFC after: 3 days
* Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,schweikh2003-01-011-1/+1
| | | | especially in troff files.
* Make preprocessor support more generic by passing all command-line optionskbyanc2002-12-233-50/+32
| | | | | | | | | | after -p except for the last (the ruleset file to process) to the preprocessor for interpretation. This allows command-line options besides -U and -D to be passed to cpp(1) and m4(1) as well as making it easier to use other preprocessors. Sponsored By: NTT Multimedia Communications Labs MFC after: 1 week
* Align timestamps when -t is used in ipfw and ipfw2.keramida2002-11-261-3/+11
| | | | | PR: kern/44843 Approved by: re (jhb)
* Fix a kernel panic with rules of the typeluigi2002-11-261-19/+31
| | | | | | | | | | prob 0.5 pipe NN .... due to the generation of an invalid ipfw instruction sequence. No ABI change, but you need to upgrade /sbin/ipfw to generate the correct code. Approved by: re
* Update documentation to match the behaviour of ipfw with respectluigi2002-11-261-4/+6
| | | | | | | | to net.inet.ip.fw.one_pass. Add to notes to explain the exact behaviour of "prob xxx" and "log" options. Virtually approved by: re (mentioned in rev.1.19 of ip_fw2.c)
* Kill EOL whitespaces, style(9) fix.maxim2002-11-061-13/+12
|
* Fix UID/GID options parsing.maxim2002-11-061-2/+2
| | | | | | | PR: bin/42579 Submitted by: Belousov Oleg <oleg@belousov.com> Approved by: luigi MFC after: 2 weeks
* Misc fixes from Chris Pepper, plus additional explainations onluigi2002-10-281-186/+183
| | | | | | dummynet operation. MFC after: 3 days
* Fix ipfw2 panics on 64-bit platforms.mux2002-10-241-5/+5
| | | | | | | | | | Quoting luigi: In order to make the userland code fully 64-bit clean it may be necessary to commit other changes that may or may not cause a minor change in the ABI. Reviewed by: luigi
* Increase the max dummynet hash size from 1024 to 65536. Default is stillseanc2002-10-121-1/+1
| | | | | | | | | 1024. Silence on: -net, -ipfw 4weeks+ Reviewed by: dd Approved by: knu (mentor) MFC after: 3 weeks
* Do not dump core on 'ipfw add unreach': handling null strings inmaxim2002-09-251-0/+2
| | | | | | | | fill_reject_code(). Please note ipfw/ipfw2.c is not affected. PR: bin/42304 Submitted by: Andy@wantpackets.com MFC after: 1 day
* o Fix a typo.maxim2002-09-221-3/+3
| | | | | | | | o Remove EOL spaces. Submitted by: Harold Gutch <logix@foobar.franken.de> (typo patch) Approved by: luigi MFC after: 3 days
* Store the port number in "fwd" rules in host format, same as ipfw1luigi2002-09-121-2/+2
| | | | | | | | | | | has always done. Technically, this is the wrong format, but it reduces the diffs in -stable. Someday, when we get rid of ipfw1, I will put the port number in the proper format both in kernel and userland. MFC after: 3 days (with re@ permission)
* Typo: s/o packet/on packet/blackend2002-09-081-1/+1
| | | | | PR: docs/42543 Submitted by: Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
* s/filesystem/file system/g as discussed on -developerstrhodes2002-08-211-1/+1
|
* Whoops, the manpage lied... ipfw2 has always accepted addr:maskluigi2002-08-211-11/+14
| | | | specifications.
* One more (hopefully the last one) step in cleaning up the syntax,luigi2002-08-192-61/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | following Julian's good suggestion: since you can specify any match pattern as an option, rules now have the following format: [<proto> from <src> to <dst>] [options] i.e. the first part is now entirely optional (and left there just for compatibility with ipfw1 rulesets). Add a "-c" flag to show/list rules in the compact form (i.e. without the "ip from any to any" part) when possible. The default is to include it so that scripts processing ipfw's canonical output will still work. Note that as part of this cleanup (and to remove ambiguity), MAC fields now can only be specified in the options part. Update the manpage to reflect the syntax. Clarify the behaviour when a match is attempted on fields which are not present in the packet, e.g. port numbers on non TCP/UDP packets, and the "not" operator is specified. E.g. ipfw add allow not src-port 80 will match also ICMP packets because they do not have port numbers, so "src-port 80" will fail and "not src-port 80" will succeed. For such cases it is advised to insert further options to prevent undesired results (e.g. in the case above, "ipfw add allow proto tcp not src-port 80"). We definitely need to rewrite the parser using lex and yacc!
* Major cleanup of the parser and printing routines in an attempt toluigi2002-08-192-209/+375
| | | | | | | | | | | | | | | | | | | render the syntax less ambiguous. Now rules can be in one of these two forms <action> <protocol> from <src> to <dst> [options] <action> MAC dst-mac src-mac mac-type [options] however you can now specify MAC and IP header fields as options e.g. ipfw add allow all from any to any mac-type arp ipfw add allow all from any to any { dst-ip me or src-ip me } which makes complex expressions a lot easier to write and parse. The "all from any to any" part is there just for backward compatibility. Manpage updated accordingly.
* Complete list of differences between ipfw1 and ipfw2.luigi2002-08-161-10/+93
|
* sys/netinet/ip_fw2.c:luigi2002-08-162-116/+526
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the M_SKIP_FIREWALL bit in m_flags to avoid loops for firewall-generated packets (the constant has to go in sys/mbuf.h). Better comments on keepalive generation, and enforce dyn_rst_lifetime and dyn_fin_lifetime to be less than dyn_keepalive_period. Enforce limits (up to 64k) on the number of dynamic buckets, and retry allocation with smaller sizes. Raise default number of dynamic rules to 4096. Improved handling of set of rules -- now you can atomically enable/disable multiple sets, move rules from one set to another, and swap sets. sbin/ipfw/ipfw2.c: userland support for "noerror" pipe attribute. userland support for sets of rules. minor improvements on rule parsing and printing. sbin/ipfw/ipfw.8: more documentation on ipfw2 extensions, differences from ipfw1 (so we can use the same manpage for both), stateful rules, and some additional examples. Feedback and more examples needed here.
* Fix one parsing bug introduced by last commit, and correct parsingluigi2002-08-101-18/+63
| | | | and printing of or-blocks in address, ports and options lists.
* Major revision of the ipfw manpage, trying to make it up-to-dateluigi2002-08-101-518/+682
| | | | | | | | | | | | | | | | | | | | with ipfw2 extensions and give examples of use of the new features. This is just a preliminary commit, where i simply added the basic syntax for the extensions, and clean up the page (e.g. by listing things in alphabetical rather than random order). I would appreciate feedback and possible corrections/extensions by interested parties. Still missing are a more detailed description of stateful rules (with keepalives), interaction with of stateful rules and natd (don't do that!), examples of use with the recently introduced rule sets. There is an issue related to the MFC: RELENG_4 still has ipfw as a default, and ipfw2 is optional. We have two options here: MFC this page as ipfw(8) adding a large number of "SORRY NOT IN IPFW" notes, or create a new ipfw2(8) manpage just for -stable users. I am all for the first approach, but of course am listening to your comments.
* One bugfix and one new feature.luigi2002-08-101-22/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bugfix (ipfw2.c) makes the handling of port numbers with a dash in the name, e.g. ftp-data, consistent with old ipfw: use \\ before the - to consider it as part of the name and not a range separator. The new feature (all this description will go in the manpage): each rule now belongs to one of 32 different sets, which can be optionally specified in the following form: ipfw add 100 set 23 allow ip from any to any If "set N" is not specified, the rule belongs to set 0. Individual sets can be disabled, enabled, and deleted with the commands: ipfw disable set N ipfw enable set N ipfw delete set N Enabling/disabling of a set is atomic. Rules belonging to a disabled set are skipped during packet matching, and they are not listed unless you use the '-S' flag in the show/list commands. Note that dynamic rules, once created, are always active until they expire or their parent rule is deleted. Set 31 is reserved for the default rule and cannot be disabled. All sets are enabled by default. The enable/disable status of the sets can be shown with the command ipfw show sets Hopefully, this feature will make life easier to those who want to have atomic ruleset addition/deletion/tests. Examples: To add a set of rules atomically: ipfw disable set 18 ipfw add ... set 18 ... # repeat as needed ipfw enable set 18 To delete a set of rules atomically ipfw disable set 18 ipfw delete set 18 ipfw enable set 18 To test a ruleset and disable it and regain control if something goes wrong: ipfw disable set 18 ipfw add ... set 18 ... # repeat as needed ipfw enable set 18 ; echo "done "; sleep 30 && ipfw disable set 18 here if everything goes well, you press control-C before the "sleep" terminates, and your ruleset will be left active. Otherwise, e.g. if you cannot access your box, the ruleset will be disabled after the sleep terminates. I think there is only one more thing that one might want, namely a command to assign all rules in set X to set Y, so one can test a ruleset using the above mechanisms, and once it is considered acceptable, make it part of an existing ruleset.
* Fix generation of check-state rules, which i broke in last commit.luigi2002-08-041-1/+1
|
* Forgot this one: properly initialize an address set when the setluigi2002-07-311-3/+1
| | | | | size is less than 32 bits (/28 mask or more). Also remove a debugging fprintf().
* Two bugfixes:luigi2002-07-311-15/+26
| | | | | | | | | + the header file contains two different opcodes (O_IPOPTS and O_IPOPT) for what is the same thing, and sure enough i used one in the kernel and the other one in userland. Be consistent! + "keep-state" and "limit" must be the last match pattern in a rule, so no matter how you enter them move them to the end of the rule.
* Add SEE ALSO references to papers handling RED.sheldonh2002-07-251-0/+26
|
OpenPOWER on IntegriCloud