summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_fw.h
Commit message (Collapse)AuthorAgeFilesLines
* Add new fields for more granularity:billf2000-10-021-1/+28
| | | | | | | IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
* Remove obsolete comment.archie2000-08-221-1/+0
|
* Add tcpoptions to ipfw. This works much in the same way as ipoptions do.dan2000-06-081-0/+10
| | | | | | | | | | It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
* Implement WF2Q+ in dummynet.luigi2000-06-081-2/+3
|
* Back out the previous change to the queue(3) interface.jake2000-05-261-1/+1
| | | | | | It was not discussed and should probably not happen. Requested by: msmith and others
* Change the way that the queue(3) structures are declared; don't assume thatjake2000-05-231-1/+1
| | | | | | | | the type argument to *_HEAD and *_ENTRY is a struct. Suggested by: phk Reviewed by: phk Approved by: mdodd
* Support for stateful (dynamic) ipfw rules. They are veryluigi2000-02-101-4/+35
| | | | | | | | similar to ipfilter's keep-state. Look at the updated ipfw(8) manpage for details. Approved-by: jordan
* Add ipfw hooks for the new dummynet features.luigi2000-01-081-1/+4
| | | | | | | Support masks on TCP/UDP ports. Minor cleanup of ip_fw_chk() to avoid repeated calls to PULLUP_TO at each rule.
* Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL"peter1999-12-291-2/+2
| | | | | | is an application space macro and the applications are supposed to be free to use it as they please (but cannot). This is consistant with the other BSD's who made this change quite some time ago. More commits to come.
* Miscellaneous fixes/cleanups relating to ipfw and divert(4):archie1999-12-061-0/+3
| | | | | | | | | | | | | - Implement 'ipfw tee' (finally) - Divert packets by calling new function divert_packet() directly instead of going through protosw[]. - Replace kludgey global variable 'ip_divert_port' with a function parameter to divert_packet() - Replace kludgey global variable 'frag_divert_port' with a function parameter to ip_reass() - style(9) fixes Reviewed by: julian, green
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Correction: uid -> gid (comment)green1999-08-271-2/+2
|
* Implement probabilistic rule match in ipfw. Each rule can be associatedluigi1999-08-111-2/+20
| | | | | | | | | | | | | | | | | | | | | with a match probability to achieve non-deterministic behaviour of the firewall. This can be extremely useful for testing purposes such as simulating random packet drop without having to use dummynet (which already does the same thing), and simulating multipath effects and the associated out-of-order delivery (this time in conjunction with dummynet). The overhead on normal rules is just one comparison with 0. Since it would have been trivial to implement this by just adding a field to the ip_fw structure, I decided to do it in a backward-compatible way (i.e. struct ip_fw is unchanged, and as a consequence you don't need to recompile ipfw if you don't want to use this feature), since this was also useful for -STABLE. When, at some point, someone decides to change struct ip_fw, please add a length field and a version number at the beginning, so userland apps can keep working even if they are out of sync with the kernel.
* Make ipfw's logging more dynamic. Now, log will use the default limitgreen1999-08-011-1/+3
| | | | | | | | | | | | | _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
* Correct a really gross comment format.green1999-07-281-5/+7
|
* This is the much-awaited cleaned up version of IPFW [ug]id support.green1999-06-191-2/+8
| | | | All relevant changes have been made (including ipfw.8).
* Tidy up some stray / unused stuff in the IPFW package and friends.peter1999-04-201-9/+1
| | | | | | | | - unifdef -DCOMPAT_IPFW (this was on by default already) - remove traces of in-kernel ip_nat package, it was never committed. - Make IPFW and DUMMYNET initialize themselves rather than depend on compiled-in hooks in ip_init(). This means they initialize the same way both in-kernel and as kld modules. (IPFW initializes now :-)
* Last bits (i think) of dummynet for -current.luigi1998-12-141-3/+8
|
* Widen and change the layout of the IPFW structures flag element.phk1998-09-021-29/+29
| | | | | | This will allow us to add dummynet to 3.0 Recompile /sbin/ipfw AND your kernel.
* Yow! Completely change the way socket options are handled, eliminatingwollman1998-08-231-1/+18
| | | | | | another specialized mbuf type in the process. Also clean up some of the cruft surrounding IPFW, multicast routing, RSVP, and other ill-explored corners.
* Support for IPFW based transparent forwarding.julian1998-07-061-1/+4
| | | | | | | | | | | | | | Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
* Added #include of <sys/queue.h> so that this file is more "self"-sufficent.bde1998-02-031-1/+3
|
* Bump up packet and byte counters to 64-bit unsigned ints. As aalex1998-01-081-5/+8
| | | | | | | | | | | | | consequence, ipfw's list command now adjusts its output at runtime based on the largest packet/byte counter values. NOTE: o The ipfw struct has changed requiring a recompile of both kernel and userland ipfw utility. o This probably should not be brought into 2.2. PR: 3738
* Removed unused #includes.bde1997-10-281-3/+1
|
* Fixed gratuitous ANSIisms.bde1997-09-161-2/+2
|
* Support interface names up to 15 characters in length. In order toalex1997-08-081-3/+5
| | | | | | | | | | | | accommodate the expanded name, the ICMP types bitmap has been reduced from 256 bits to 32. A recompile of kernel and user level ipfw is required. To be merged into 2.2 after a brief period in -current. PR: bin/4209 Reviewed by: Archie Cobbs <archie@whistle.com>
* Submitted by: Whistle Communications (archie Cobbs)julian1997-06-021-45/+96
| | | | | | | | | | | | | | | these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
* Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are notpeter1997-02-221-1/+1
| | | | ready for it yet.
* implement "not" keyword for inverting the address logicadam1997-01-161-0/+2
|
* Make the long-awaited change from $Id$ to $FreeBSD$jkh1997-01-141-1/+1
| | | | | | | | This will make a number of things easier in the future, as well as (finally!) avoiding the Id-smashing problem which has plagued developers for so long. Boy, I'm glad we're not using sup anymore. This update would have been insane otherwise.
* Add hooks for an IP NAT module, much like the firewall stuff...sos1996-08-211-12/+1
| | | | | Move the sockopt definitions for the firewall code from ip_fw.h to in.h where it belongs.
* Completely rewrite handling of protocol field for firewalls, things arepst1996-08-131-8/+2
| | | | | | | now completely consistent across all IP protocols and should be quite a bit faster. Discussed with: fenner & alex
* Adding changes to ipfw and the kernel to support ip packet diversion..julian1996-07-101-5/+10
| | | | | | This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
* Big sweep over ipfw, picking up where Poul left off:alex1996-06-091-17/+24
| | | | | | | | | | | | | | | | | | | - Log ICMP type during verbose output. - Added IPFIREWALL_VERBOSE_LIMIT option to prevent denial of service attacks via syslog flooding. - Filter based on ICMP type. - Timestamp chain entries when they are matched. - Interfaces can now be matched with a wildcard specification (i.e. will match any interface unit for a given name). - Prevent the firewall chain from being manipulated when securelevel is greater than 2. - Fixed bug that allowed the default policy to be deleted. - Ability to zero individual accounting entries. - Remove definitions of old_chk_ptr and old_ctl_ptr when compiling ipfw as a lkm. - Remove some redundant code shared between ip_fw_init and ipfw_load. Closes PRs: 1192, 1219, and 1267.
* Correct spelling error in commentgpalmer1996-06-021-2/+2
|
* Add feature for tcp "established".phk1996-04-031-7/+2
| | | | | Change interface between netinet and ip_fw to be more general, and thus hopefully also support other ip filtering implementations.
* Make getsockopt() capable of handling more than one mbuf worth of data.phk1996-02-241-11/+3
| | | | | Use this to read rules out of ipfw. Add the lkm code to ipfw.c
* The new firewall functionality:phk1996-02-241-9/+15
| | | | | Filter on the direction (in/out). Filter on fragment/not fragment.
* Big sweep over the IPFIREWALL and IPACCT code.phk1996-02-231-64/+36
| | | | | | | | | | | | | | Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
* Well..finally..this is the first part..it should take care ofugen1995-10-011-3/+23
| | | | | | | | matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come...
* Added $Id$.dg1995-07-231-0/+2
|
* Fixed panic that occurs on certain firewall rejected packets that wasdg1995-07-091-2/+2
| | | | | | | caused by dtom() being used on an mbuf cluster. The fix involves passing around the mbuf pointer. Submitted by: Bill Fenner
* Remove trailing whitespace.rgrimes1995-05-301-3/+3
|
* Allow "via" to be specified ever as IP adress orugen1995-02-241-2/+24
| | | | as interface name/unit...
* Actual firewall change.ugen1995-01-121-11/+28
| | | | | | | 1) Firewall is not subdivided on forwarding / blocking chains anymore.Actually only one chain left-it was the blocking one. 2) LKM support.ip_fwdef.c is function pointers definition and goes into kernel along with all INET stuff.
* Add clear one accounting entry control.ugen1994-12-131-10/+11
| | | | Structure fields changed to seem more standart.
* Add match by interface from which packet arrived (via)ugen1994-12-121-2/+1
| | | | | Handle right fragmented packets. Remove checking option from kernel..
* Added: ICMP reply,TCP SYN check,logging..ugen1994-11-281-12/+21
|
* Ugen J.S.Antsilevich's latest, happiest, IP firewall code.jkh1994-11-161-16/+29
| | | | | Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
* Ugen makes it in with 10 seconds to spare with a one-char diff. Somejkh1994-11-081-1/+1
| | | | | people are born lucky.. Submitted by: ugen
OpenPOWER on IntegriCloud