d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7b389f3335
freebsd-dev/sbin/ipfw/ipfw.c

2564 lines
62 KiB
C
Raw Normal View History

Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
/*
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
* Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
* Copyright (c) 1994 Ugen J.S.Antsilevich
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
*
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
* Idea and grammar partially left from:
* Copyright (c) 1993 Daniel Boulet
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
*
* Redistribution and use in source forms, with and without modification,
* are permitted provided that this entire comment appears intact.
*
* Redistribution in binary form may occur without any restrictions.
* Obviously, it would be nice if you gave credit where credit is due
* but requiring it would be too onerous.
*
* This software is provided ``AS IS'' without any warranties of any kind.
*
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
* NEW command line interface for IP firewall facility
Add $Id$
1995-08-22 00:38:02 +00:00
*
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
*/
Manpage cleanup, move $Id$ to #ifndef lint, remove unused includes, grammatical fixes. Submitted by: Philippe Charnier
1999-05-29 08:12:38 +00:00
#ifndef lint
static const char rcsid[] =
$Id$ -> $FreeBSD$
1999-08-28 00:22:10 +00:00
"$FreeBSD$";
Manpage cleanup, move $Id$ to #ifndef lint, remove unused includes, grammatical fixes. Submitted by: Philippe Charnier
1999-05-29 08:12:38 +00:00
#endif /* not lint */
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
Manpage cleanup, move $Id$ to #ifndef lint, remove unused includes, grammatical fixes. Submitted by: Philippe Charnier
1999-05-29 08:12:38 +00:00
Remove unused include, and place sys includes at top, which enabled us to remove this include.
2000-05-01 20:19:44 +00:00
#include <sys/param.h>
#include <sys/mbuf.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
#include <sys/socket.h>
#include <sys/sockio.h>
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
#include <sys/sysctl.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
#include <sys/time.h>
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
#include <sys/wait.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
#include <ctype.h>
#include <err.h>
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
#include <errno.h>
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
#include <grp.h>
Update to match kernel code.
1996-02-24 13:39:46 +00:00
#include <limits.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
#include <netdb.h>
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
#include <pwd.h>
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
#include <signal.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
#include <stdio.h>
#include <stdlib.h>
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
#include <stdarg.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
#include <string.h>
#include <unistd.h>
Manpage cleanup, move $Id$ to #ifndef lint, remove unused includes, grammatical fixes. Submitted by: Philippe Charnier
1999-05-29 08:12:38 +00:00
#include <sysexits.h>
Fix up programs which expect <net/if.h> to include <sys/time.h> to instead do it themselves. (Some of these programs actually depended on this beyond compiling the definition of struct ifinfo!) Also fix up some other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
Issue a warning if the user specifies an invalid interface in a rule. The rule is still added to the chain since the interface may get created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
#include <net/if.h>
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
#include <netinet/in.h>
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
Update to match kernel code.
1996-02-24 13:39:46 +00:00
#include <netinet/ip_fw.h>
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
#include <net/route.h> /* def. of struct route */
#include <netinet/ip_dummynet.h>
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
#include <netinet/tcp.h>
Change utility to accept interface name along with IP as "via" argument
1995-02-24 14:32:45 +00:00
#include <arpa/inet.h>
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int s, /* main RAW socket */
do_resolv, /* Would try to resolve all */
do_acct, /* Show packet/byte count */
do_time, /* Show time stamps */
do_quiet, /* Be quiet in add and flush */
do_force, /* Don't ask for confirmation */
do_pipe, /* this cmd refers to a pipe */
do_sort, /* field to sort results (0 = no) */
do_dynamic, /* display dynamic rules */
do_expired, /* display expired dynamic rules */
Reset globals for every new command read from preprocessed file.
2000-10-11 13:02:30 +00:00
verbose;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
struct icmpcode {
int code;
char *str;
};
static struct icmpcode icmpcodes[] = {
{ ICMP_UNREACH_NET, "net" },
{ ICMP_UNREACH_HOST, "host" },
{ ICMP_UNREACH_PROTOCOL, "protocol" },
{ ICMP_UNREACH_PORT, "port" },
{ ICMP_UNREACH_NEEDFRAG, "needfrag" },
{ ICMP_UNREACH_SRCFAIL, "srcfail" },
{ ICMP_UNREACH_NET_UNKNOWN, "net-unknown" },
{ ICMP_UNREACH_HOST_UNKNOWN, "host-unknown" },
{ ICMP_UNREACH_ISOLATED, "isolated" },
{ ICMP_UNREACH_NET_PROHIB, "net-prohib" },
{ ICMP_UNREACH_HOST_PROHIB, "host-prohib" },
{ ICMP_UNREACH_TOSNET, "tosnet" },
{ ICMP_UNREACH_TOSHOST, "toshost" },
{ ICMP_UNREACH_FILTER_PROHIB, "filter-prohib" },
{ ICMP_UNREACH_HOST_PRECEDENCE, "host-precedence" },
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
{ ICMP_UNREACH_PRECEDENCE_CUTOFF, "precedence-cutoff" },
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
{ 0, NULL }
};
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
static void show_usage(void);
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static int
mask_bits(struct in_addr m_ad)
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int h_fnd = 0, h_num = 0, i;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
u_long mask;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
mask = ntohl(m_ad.s_addr);
for (i = 0 ; i < sizeof(u_long)*CHAR_BIT; i++) {
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
if (mask & 1L) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
h_fnd = 1;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
h_num++;
} else {
if (h_fnd)
return -1;
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
mask = mask >> 1;
Remove trailing whitespace.
1995-05-30 06:12:45 +00:00
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
return h_num;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
print_port(u_char prot, u_short port, const char comma)
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
struct servent *se = NULL;
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
struct protoent *pe;
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (comma == ':') {
printf("%c0x%04x", comma, port);
return;
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
}
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
if (do_resolv) {
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
pe = getprotobynumber(prot);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
se = getservbyport(htons(port), pe ? pe->p_name : NULL);
}
if (se)
printf("%c%s", comma, se->s_name);
else
printf("%c%d", comma, port);
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
print_iface(char *key, union ip_fw_if *un, int byname)
{
char ifnb[FW_IFNLEN+1];
if (byname) {
strncpy(ifnb, un->fu_via_if.name, FW_IFNLEN);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
ifnb[FW_IFNLEN] = '\0';
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (un->fu_via_if.unit == -1)
printf(" %s %s*", key, ifnb);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
else
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
printf(" %s %s%d", key, ifnb, un->fu_via_if.unit);
} else if (un->fu_via_ip.s_addr != 0) {
printf(" %s %s", key, inet_ntoa(un->fu_via_ip));
} else
printf(" %s any", key);
}
static void
print_reject_code(int code)
{
struct icmpcode *ic;
for (ic = icmpcodes; ic->str; ic++)
if (ic->code == code) {
printf("%s", ic->str);
return;
}
printf("%u", code);
}
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
show_ipfw(struct ip_fw *chain)
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
char comma;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
u_long adrt;
struct hostent *he;
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
struct protoent *pe;
int i, mb;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
int nsp = IP_FW_GETNSRCP(chain);
int ndp = IP_FW_GETNDSTP(chain);
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
if (do_resolv)
Manpage cleanup, move $Id$ to #ifndef lint, remove unused includes, grammatical fixes. Submitted by: Philippe Charnier
1999-05-29 08:12:38 +00:00
setservent(1/*stay open*/);
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Update -current ipfw program as well. I hope it all compiles...
1996-02-23 15:52:28 +00:00
printf("%05u ", chain->fw_number);
Remove trailing whitespace.
1995-05-30 06:12:45 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_acct)
printf("%10qu %10qu ", chain->fw_pcnt, chain->fw_bcnt);
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_time) {
if (chain->timestamp) {
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
char timestr[30];
strcpy(timestr, ctime((time_t *)&chain->timestamp));
*strchr(timestr, '\n') = '\0';
printf("%s ", timestr);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else {
printf(" ");
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
}
}
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
if (chain->fw_flg == IP_FW_F_CHECK_S) {
printf("check-state\n");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
goto done;
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
}
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
Reorder the "prob" section in the output of list/show so it can be copy/pasted into add without problems. The previous commit had the other half of this original patch which handled tcpflags/tcpflgs confusion in output/input.
2000-06-18 02:48:19 +00:00
if (chain->fw_flg & IP_FW_F_RND_MATCH) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
double d = 1.0 * (int)(chain->pipe_ptr);
d = 1 - (d / 0x7fffffff);
Reorder the "prob" section in the output of list/show so it can be copy/pasted into add without problems. The previous commit had the other half of this original patch which handled tcpflags/tcpflgs confusion in output/input.
2000-06-18 02:48:19 +00:00
printf("prob %f ", d);
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
switch (chain->fw_flg & IP_FW_F_COMMAND) {
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
case IP_FW_F_ACCEPT:
printf("allow");
break;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
case IP_FW_F_DENY:
printf("deny");
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
break;
case IP_FW_F_COUNT:
printf("count");
break;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
case IP_FW_F_DIVERT:
printf("divert %u", chain->fw_divert_port);
break;
case IP_FW_F_TEE:
printf("tee %u", chain->fw_divert_port);
break;
case IP_FW_F_SKIPTO:
printf("skipto %u", chain->fw_skipto_rule);
break;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
case IP_FW_F_PIPE:
printf("pipe %u", chain->fw_skipto_rule);
break;
case IP_FW_F_QUEUE:
printf("queue %u", chain->fw_skipto_rule);
break;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
case IP_FW_F_REJECT:
if (chain->fw_reject_code == IP_FW_REJECT_RST)
printf("reset");
else {
printf("unreach ");
print_reject_code(chain->fw_reject_code);
}
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
break;
Support for IPFW based transparent forwarding. Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
case IP_FW_F_FWD:
printf("fwd %s", inet_ntoa(chain->fw_fwd_ip.sin_addr));
if(chain->fw_fwd_ip.sin_port)
printf(",%d", chain->fw_fwd_ip.sin_port);
break;
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
default:
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
errx(EX_OSERR, "impossible");
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
}
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
if (chain->fw_flg & IP_FW_F_PRN) {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
printf(" log");
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
if (chain->fw_logamount)
printf(" logamount %d", chain->fw_logamount);
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
pe = getprotobynumber(chain->fw_prot);
if (pe)
printf(" %s", pe->p_name);
else
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
printf(" %u", chain->fw_prot);
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
if (chain->fw_flg & IP_FW_F_SME) {
printf(" from me");
} else {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf(" from %s",
chain->fw_flg & IP_FW_F_INVSRC ? "not " : "");
adrt = ntohl(chain->fw_smsk.s_addr);
if (adrt == ULONG_MAX && do_resolv) {
adrt = (chain->fw_src.s_addr);
he = gethostbyaddr((char *)&adrt,
sizeof(u_long), AF_INET);
if (he == NULL)
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_src));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
else
printf("%s", he->h_name);
} else if (adrt != ULONG_MAX) {
mb = mask_bits(chain->fw_smsk);
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
if (mb == 0) {
printf("any");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (mb > 0) {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_src));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf("/%d", mb);
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
} else {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_src));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf(":");
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_smsk));
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_src));
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
comma = ' ';
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
for (i = 0; i < nsp; i++) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
print_port(chain->fw_prot,
chain->fw_uar.fw_pts[i], comma);
if (i == 0 && (chain->fw_flg & IP_FW_F_SRNG))
comma = '-';
else if (i == 0 && (chain->fw_flg & IP_FW_F_SMSK))
comma = ':';
Filter by IP protocol. Submitted by: fenner (with modifications by me) Bring in the interface unit wildcard flag fix from rev 1.15.4.8.
1996-08-05 02:38:51 +00:00
else
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
comma = ',';
Filter by IP protocol. Submitted by: fenner (with modifications by me) Bring in the interface unit wildcard flag fix from rev 1.15.4.8.
1996-08-05 02:38:51 +00:00
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
if (chain->fw_flg & IP_FW_F_DME) {
printf(" to me");
} else {
printf(" to %s", chain->fw_flg & IP_FW_F_INVDST ? "not " : "");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
adrt = ntohl(chain->fw_dmsk.s_addr);
if (adrt == ULONG_MAX && do_resolv) {
adrt = (chain->fw_dst.s_addr);
he = gethostbyaddr((char *)&adrt,
sizeof(u_long), AF_INET);
if (he == NULL)
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_dst));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
else
printf("%s", he->h_name);
} else if (adrt != ULONG_MAX) {
mb = mask_bits(chain->fw_dmsk);
if (mb == 0) {
printf("any");
} else if (mb > 0) {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_dst));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf("/%d", mb);
} else {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_dst));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf(":");
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_dmsk));
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
} else {
Silence format string warnings. MFC after: 2 weeks
2001-07-01 22:00:26 +00:00
printf("%s", inet_ntoa(chain->fw_dst));
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (chain->fw_prot == IPPROTO_TCP || chain->fw_prot == IPPROTO_UDP) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
comma = ' ';
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
for (i = 0; i < ndp; i++) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
print_port(chain->fw_prot,
chain->fw_uar.fw_pts[nsp+i], comma);
if (i == 0 && (chain->fw_flg & IP_FW_F_DRNG))
comma = '-';
else if (i == 0 && (chain->fw_flg & IP_FW_F_DMSK))
comma = ':';
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
else
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
comma = ',';
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
}
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
if (chain->fw_flg & IP_FW_F_UID) {
struct passwd *pwd = getpwuid(chain->fw_uid);
if (pwd)
printf(" uid %s", pwd->pw_name);
else
printf(" uid %u", chain->fw_uid);
}
if (chain->fw_flg & IP_FW_F_GID) {
struct group *grp = getgrgid(chain->fw_gid);
if (grp)
printf(" gid %s", grp->gr_name);
else
printf(" gid %u", chain->fw_gid);
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (chain->fw_flg & IP_FW_F_KEEP_S) {
if (chain->next_rule_ptr)
printf(" keep-state %d", (int)chain->next_rule_ptr);
else
printf(" keep-state");
}
/* Direction */
if (chain->fw_flg & IP_FW_BRIDGED)
printf(" bridged");
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if ((chain->fw_flg & IP_FW_F_IN) && !(chain->fw_flg & IP_FW_F_OUT))
Formatting fixes for 'in' and 'out' while listing. Prevent ALL protocol from being used with port specifications. Allow 'via' keyword at any point in the options list. Disallow multiple 'via' specifications.
1996-06-29 01:28:19 +00:00
printf(" in");
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!(chain->fw_flg & IP_FW_F_IN) && (chain->fw_flg & IP_FW_F_OUT))
Formatting fixes for 'in' and 'out' while listing. Prevent ALL protocol from being used with port specifications. Allow 'via' keyword at any point in the options list. Disallow multiple 'via' specifications.
1996-06-29 01:28:19 +00:00
printf(" out");
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
/* Handle hack for "via" backwards compatibility */
if ((chain->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) {
print_iface("via",
&chain->fw_in_if, chain->fw_flg & IP_FW_F_IIFNAME);
} else {
/* Receive interface specified */
if (chain->fw_flg & IP_FW_F_IIFACE)
print_iface("recv", &chain->fw_in_if,
chain->fw_flg & IP_FW_F_IIFNAME);
/* Transmit interface specified */
if (chain->fw_flg & IP_FW_F_OIFACE)
print_iface("xmit", &chain->fw_out_if,
chain->fw_flg & IP_FW_F_OIFNAME);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
}
if (chain->fw_flg & IP_FW_F_FRAG)
Formatting fixes for 'in' and 'out' while listing. Prevent ALL protocol from being used with port specifications. Allow 'via' keyword at any point in the options list. Disallow multiple 'via' specifications.
1996-06-29 01:28:19 +00:00
printf(" frag");
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_IPOPT) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int _opt_printed = 0;
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
#define PRINTOPT(x) {if (_opt_printed) printf(",");\
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
printf(x); _opt_printed = 1;}
printf(" ipopt ");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (chain->fw_ipopt & IP_FW_IPOPT_SSRR)
PRINTOPT("ssrr");
if (chain->fw_ipnopt & IP_FW_IPOPT_SSRR)
PRINTOPT("!ssrr");
if (chain->fw_ipopt & IP_FW_IPOPT_LSRR)
PRINTOPT("lsrr");
if (chain->fw_ipnopt & IP_FW_IPOPT_LSRR)
PRINTOPT("!lsrr");
if (chain->fw_ipopt & IP_FW_IPOPT_RR)
PRINTOPT("rr");
if (chain->fw_ipnopt & IP_FW_IPOPT_RR)
PRINTOPT("!rr");
if (chain->fw_ipopt & IP_FW_IPOPT_TS)
PRINTOPT("ts");
if (chain->fw_ipnopt & IP_FW_IPOPT_TS)
PRINTOPT("!ts");
}
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_IPLEN)
printf(" iplen %u", chain->fw_iplen);
if (chain->fw_ipflg & IP_FW_IF_IPID)
Do not force argument to ``ipid'' modifier be in hex, and accept value of zero as valid for IP Identification field.
2000-10-03 11:23:29 +00:00
printf(" ipid %#x", chain->fw_ipid);
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_IPTOS) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int _opt_printed = 0;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
printf(" iptos ");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (chain->fw_iptos & IPTOS_LOWDELAY)
PRINTOPT("lowdelay");
if (chain->fw_ipntos & IPTOS_LOWDELAY)
PRINTOPT("!lowdelay");
if (chain->fw_iptos & IPTOS_THROUGHPUT)
PRINTOPT("throughput");
if (chain->fw_ipntos & IPTOS_THROUGHPUT)
PRINTOPT("!throughput");
if (chain->fw_iptos & IPTOS_RELIABILITY)
PRINTOPT("reliability");
if (chain->fw_ipntos & IPTOS_RELIABILITY)
PRINTOPT("!reliability");
if (chain->fw_iptos & IPTOS_MINCOST)
PRINTOPT("mincost");
if (chain->fw_ipntos & IPTOS_MINCOST)
PRINTOPT("!mincost");
if (chain->fw_iptos & IPTOS_CE)
PRINTOPT("congestion");
if (chain->fw_ipntos & IPTOS_CE)
PRINTOPT("!congestion");
}
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_IPTTL)
printf(" ipttl %u", chain->fw_ipttl);
if (chain->fw_ipflg & IP_FW_IF_IPVER)
printf(" ipversion %u", chain->fw_ipver);
o IPFW incorrectly handled filtering in the presence of previously reserved and now allocated TCP flags in incoming packets. This patch stops overloading those bits in the IP firewall rules, and moves colliding flags to a seperate field, ipflg. The IPFW userland management tool, ipfw(8), is updated to reflect this change. New TCP flags related to ECN are now included in tcp.h for reference, although we don't currently implement TCP+ECN. o To use this fix without completely rebuilding, it is sufficient to copy ip_fw.h and tcp.h into your appropriate include directory, then rebuild the ipfw kernel module, and ipfw tool, and install both. Note that a mismatch between module and userland tool will result in incorrect installation of firewall rules that may have unexpected effects. This is an MFC candidate, following shakedown. This bug does not appear to affect ipfilter. Reviewed by: security-officer, billf Reported by: Aragon Gouveia <aragon@phat.za.net>
2001-01-09 03:10:30 +00:00
if (chain->fw_ipflg & IP_FW_IF_TCPEST)
recognize "allow", "accept" and "pass" add new feature for "established"
1996-04-03 13:49:10 +00:00
printf(" established");
else if (chain->fw_tcpf == IP_FW_TCPF_SYN &&
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
chain->fw_tcpnf == IP_FW_TCPF_ACK)
Update to match kernel code.
1996-02-24 13:39:46 +00:00
printf(" setup");
Fixed the printing of TCP flags.
2000-10-03 10:37:03 +00:00
else if (chain->fw_ipflg & IP_FW_IF_TCPFLG) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int _flg_printed = 0;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
#define PRINTFLG(x) {if (_flg_printed) printf(",");\
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
printf(x); _flg_printed = 1;}
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
printf(" tcpflags ");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (chain->fw_tcpf & IP_FW_TCPF_FIN)
PRINTFLG("fin");
if (chain->fw_tcpnf & IP_FW_TCPF_FIN)
PRINTFLG("!fin");
if (chain->fw_tcpf & IP_FW_TCPF_SYN)
PRINTFLG("syn");
if (chain->fw_tcpnf & IP_FW_TCPF_SYN)
PRINTFLG("!syn");
if (chain->fw_tcpf & IP_FW_TCPF_RST)
PRINTFLG("rst");
if (chain->fw_tcpnf & IP_FW_TCPF_RST)
PRINTFLG("!rst");
if (chain->fw_tcpf & IP_FW_TCPF_PSH)
PRINTFLG("psh");
if (chain->fw_tcpnf & IP_FW_TCPF_PSH)
PRINTFLG("!psh");
if (chain->fw_tcpf & IP_FW_TCPF_ACK)
PRINTFLG("ack");
if (chain->fw_tcpnf & IP_FW_TCPF_ACK)
PRINTFLG("!ack");
if (chain->fw_tcpf & IP_FW_TCPF_URG)
PRINTFLG("urg");
if (chain->fw_tcpnf & IP_FW_TCPF_URG)
PRINTFLG("!urg");
}
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_TCPOPT) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int _opt_printed = 0;
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
#define PRINTTOPT(x) {if (_opt_printed) printf(",");\
printf(x); _opt_printed = 1;}
printf(" tcpoptions ");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (chain->fw_tcpopt & IP_FW_TCPOPT_MSS)
PRINTTOPT("mss");
if (chain->fw_tcpnopt & IP_FW_TCPOPT_MSS)
PRINTTOPT("!mss");
if (chain->fw_tcpopt & IP_FW_TCPOPT_WINDOW)
PRINTTOPT("window");
if (chain->fw_tcpnopt & IP_FW_TCPOPT_WINDOW)
PRINTTOPT("!window");
if (chain->fw_tcpopt & IP_FW_TCPOPT_SACK)
PRINTTOPT("sack");
if (chain->fw_tcpnopt & IP_FW_TCPOPT_SACK)
PRINTTOPT("!sack");
if (chain->fw_tcpopt & IP_FW_TCPOPT_TS)
PRINTTOPT("ts");
if (chain->fw_tcpnopt & IP_FW_TCPOPT_TS)
PRINTTOPT("!ts");
if (chain->fw_tcpopt & IP_FW_TCPOPT_CC)
PRINTTOPT("cc");
if (chain->fw_tcpnopt & IP_FW_TCPOPT_CC)
PRINTTOPT("!cc");
}
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_TCPSEQ)
Fixed some printf format errors (don't assume that ntohl() returns u_long).
2001-04-05 07:37:55 +00:00
printf(" tcpseq %lu", (u_long)ntohl(chain->fw_tcpseq));
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_TCPACK)
Fixed some printf format errors (don't assume that ntohl() returns u_long).
2001-04-05 07:37:55 +00:00
printf(" tcpack %lu", (u_long)ntohl(chain->fw_tcpack));
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (chain->fw_ipflg & IP_FW_IF_TCPWIN)
printf(" tcpwin %hu", ntohs(chain->fw_tcpwin));
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
if (chain->fw_flg & IP_FW_F_ICMPBIT) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int i, first = 1;
unsigned j;
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
printf(" icmptype");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
for (i = 0; i < IP_FW_ICMPTYPES_DIM; ++i)
for (j = 0; j < sizeof(unsigned) * 8; ++j)
if (chain->fw_uar.fw_icmptypes[i] & (1 << j)) {
printf("%c%d", first ? ' ' : ',', i);
first = 0;
}
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
}
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
printf("\n");
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
done:
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
if (do_resolv)
endservent();
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
static void
show_dyn_ipfw(struct ipfw_dyn_rule *d)
{
struct protoent *pe;
struct in_addr a;
if (!d->expire && !do_expired)
return;
printf("%05d %qu %qu (T %d, # %d) ty %d",
(int)(d->chain),
d->pcnt, d->bcnt,
d->expire,
d->bucket,
d->type);
if (do_resolv && (pe = getprotobynumber(d->id.proto)) != NULL)
printf(" %s,", pe->p_name);
else
printf(" %u,", d->id.proto);
a.s_addr = htonl(d->id.src_ip);
printf(" %s", inet_ntoa(a));
printf(" %d", d->id.src_port);
switch (d->type) {
default: /* bidir, no mask */
printf(" <->");
break;
}
a.s_addr = htonl(d->id.dst_ip);
printf(" %s", inet_ntoa(a));
printf(" %d", d->id.dst_port);
printf("\n");
}
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
int
sort_q(const void *pa, const void *pb)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int rev = (do_sort < 0);
int field = rev ? -do_sort : do_sort;
long long res = 0;
const struct dn_flow_queue *a = pa;
const struct dn_flow_queue *b = pb;
switch (field) {
case 1: /* pkts */
res = a->len - b->len;
break;
case 2: /* bytes */
res = a->len_bytes - b->len_bytes;
break;
case 3: /* tot pkts */
res = a->tot_pkts - b->tot_pkts;
break;
case 4: /* tot bytes */
res = a->tot_bytes - b->tot_bytes;
break;
}
if (res < 0)
res = -1;
if (res > 0)
res = 1;
return (int)(rev ? res : -res);
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
}
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
static void
list_queues(struct dn_flow_set *fs, struct dn_flow_queue *q)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int l;
printf(" mask: 0x%02x 0x%08x/0x%04x -> 0x%08x/0x%04x\n",
fs->flow_mask.proto,
fs->flow_mask.src_ip, fs->flow_mask.src_port,
fs->flow_mask.dst_ip, fs->flow_mask.dst_port);
if (fs->rq_elements == 0)
return;
printf("BKT Prot ___Source IP/port____ "
"____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp\n");
if (do_sort != 0)
heapsort(q, fs->rq_elements, sizeof *q, sort_q);
for (l = 0; l < fs->rq_elements; l++) {
struct in_addr ina;
struct protoent *pe;
ina.s_addr = htonl(q[l].id.src_ip);
printf("%3d ", q[l].hash_slot);
pe = getprotobynumber(q[l].id.proto);
if (pe)
printf("%-4s ", pe->p_name);
else
printf("%4u ", q[l].id.proto);
printf("%15s/%-5d ",
inet_ntoa(ina), q[l].id.src_port);
ina.s_addr = htonl(q[l].id.dst_ip);
printf("%15s/%-5d ",
inet_ntoa(ina), q[l].id.dst_port);
printf("%4qu %8qu %2u %4u %3u\n",
q[l].tot_pkts, q[l].tot_bytes,
q[l].len, q[l].len_bytes, q[l].drops);
if (verbose)
printf(" S %20qd F %20qd\n",
q[l].S, q[l].F);
}
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
}
static void
print_flowset_parms(struct dn_flow_set *fs, char *prefix)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int l;
char qs[30];
char plr[30];
char red[90]; /* Display RED parameters */
l = fs->qsize;
if (fs->flags_fs & DN_QSIZE_IS_BYTES) {
if (l >= 8192)
sprintf(qs, "%d KB", l / 1024);
else
sprintf(qs, "%d B", l);
} else
sprintf(qs, "%3d sl.", l);
if (fs->plr)
sprintf(plr, "plr %f", 1.0 * fs->plr / (double)(0x7fffffff));
else
plr[0] = '\0';
if (fs->flags_fs & DN_IS_RED) /* RED parameters */
sprintf(red,
"\n %cRED w_q %f min_th %d max_th %d max_p %f",
(fs->flags_fs & DN_IS_GENTLE_RED) ? 'G' : ' ',
1.0*fs->w_q / (double)(1 << SCALE_RED),
SCALE_VAL(fs->min_th),
SCALE_VAL(fs->max_th),
1.0*fs->max_p / (double)(1 << SCALE_RED));
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
else
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
sprintf(red, "droptail");
printf("%s %s%s %d queues (%d buckets) %s\n",
prefix, qs, plr, fs->rq_elements, fs->rq_size, red);
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
}
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
list(int ac, char *av[])
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
struct ip_fw *rules, *r;
struct ipfw_dyn_rule *dynrules, *d;
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
struct dn_pipe *pipes;
void *data = NULL;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int n, nbytes, nstat, ndyn;
int exitval = EX_OK;
int lac;
char **lav;
u_long rnum;
char *endptr;
int seen = 0;
Update to match kernel code.
1996-02-24 13:39:46 +00:00
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
/* get rules or pipes from kernel, resizing array as necessary */
{
const int unit = do_pipe ? sizeof(*pipes) : sizeof(*rules);
const int ocmd = do_pipe ? IP_DUMMYNET_GET : IP_FW_GET;
Fix behaviour of "ipfw pipe show" -- previous code gave ambiguous data to the userland program (kernel operation was safe, anyways).
2000-06-14 10:07:22 +00:00
int nalloc = unit;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
nbytes = nalloc;
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
Fix behaviour of "ipfw pipe show" -- previous code gave ambiguous data to the userland program (kernel operation was safe, anyways).
2000-06-14 10:07:22 +00:00
while (nbytes >= nalloc) {
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
nalloc = nalloc * 2 + 200;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
nbytes = nalloc;
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
if ((data = realloc(data, nbytes)) == NULL)
err(EX_OSERR, "realloc");
if (getsockopt(s, IPPROTO_IP, ocmd, data, &nbytes) < 0)
err(EX_OSERR, "getsockopt(IP_%s_GET)",
do_pipe ? "DUMMYNET" : "FW");
}
}
/* display requested pipes */
if (do_pipe) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
u_long rulenum;
void *next = data;
struct dn_pipe *p = (struct dn_pipe *) data;
struct dn_flow_set *fs;
struct dn_flow_queue *q;
int l;
if (ac > 0)
rulenum = strtoul(*av++, NULL, 10);
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
else
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rulenum = 0;
for (; nbytes >= sizeof *p; p = (struct dn_pipe *)next) {
double b = p->bandwidth;
char buf[30];
char prefix[80];
if (p->next != (struct dn_pipe *)DN_IS_PIPE)
break;
l = sizeof(*p) + p->fs.rq_elements * sizeof(*q);
next = (void *)p + l;
nbytes -= l;
q = (struct dn_flow_queue *)(p+1);
if (rulenum != 0 && rulenum != p->pipe_nr)
continue;
if (p->if_name[0] != '\0')
sprintf(buf, "%s", p->if_name);
else if (b == 0)
sprintf(buf, "unlimited");
else if (b >= 1000000)
sprintf(buf, "%7.3f Mbit/s", b/1000000);
else if (b >= 1000)
sprintf(buf, "%7.3f Kbit/s", b/1000);
else
sprintf(buf, "%7.3f bit/s ", b);
sprintf(prefix, "%05d: %s %4d ms ",
p->pipe_nr, buf, p->delay);
print_flowset_parms(&(p->fs), prefix);
if (verbose)
printf(" V %20qd\n", p->V >> MY_M);
list_queues(&(p->fs), q);
}
fs = (struct dn_flow_set *) next;
for (; nbytes >= sizeof *fs; fs = (struct dn_flow_set *)next) {
char prefix[80];
if (fs->next != (struct dn_flow_set *)DN_IS_QUEUE)
break;
l = sizeof(*fs) + fs->rq_elements * sizeof(*q);
next = (void *)fs + l;
nbytes -= l;
q = (struct dn_flow_queue *)(fs+1);
sprintf(prefix, "q%05d: weight %d pipe %d ",
fs->fs_nr, fs->weight, fs->parent_nr);
print_flowset_parms(fs, prefix);
list_queues(fs, q);
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
}
free(data);
return;
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rules = (struct ip_fw *)data;
for (nstat = 0; rules[nstat].fw_number < 65535; ++nstat)
/* nothing */ ;
nstat++; /* counting starts from 0 ... */
dynrules = (struct ipfw_dyn_rule *)&rules[nstat];
ndyn = (nbytes - (nstat * sizeof *rules)) / sizeof *dynrules;
/* if no rule numbers were specified, list all rules */
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
if (ac == 0) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
for (n = 0; n < nstat; n++)
show_ipfw(&rules[n]);
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_dynamic && ndyn) {
printf("## Dynamic rules:\n");
for (n = 0, d = dynrules; n < ndyn; n++, d++)
show_dyn_ipfw(d);
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
free(data);
return;
}
/* display specific rules requested on command line */
for (lac = ac, lav = av; lac != 0; lac--) {
/* convert command line rule # */
rnum = strtoul(*lav++, &endptr, 10);
if (*endptr) {
exitval = EX_USAGE;
warnx("invalid rule number: %s", *(lav - 1));
continue;
}
for (n = seen = 0, r = rules; n < nstat; n++, r++) {
if (r->fw_number > rnum)
break;
if (r->fw_number == rnum) {
show_ipfw(r);
seen = 1;
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
if (!seen) {
/* give precedence to other error(s) */
if (exitval == EX_OK)
exitval = EX_UNAVAILABLE;
warnx("rule %lu does not exist", rnum);
}
}
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf("## Dynamic rules:\n");
if (do_dynamic && ndyn) {
for (lac = ac, lav = av; lac != 0; lac--) {
rnum = strtoul(*lav++, &endptr, 10);
if (*endptr)
/* already warned */
continue;
for (n = 0, d = dynrules; n < ndyn; n++, d++) {
if ((int)(d->chain) > rnum)
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
break;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if ((int)(d->chain) == rnum)
show_dyn_ipfw(d);
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
}
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
ac = 0;
Fix bug where 'ipfw list' would choke if there were a large number of rules.
1999-01-22 01:46:32 +00:00
free(data);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (exitval != EX_OK)
exit(exitval);
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
show_usage(void)
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
{
Remove __progname. Cosmetic in usage string.
1997-06-13 06:27:12 +00:00
fprintf(stderr, "usage: ipfw [options]\n"
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
" [pipe] flush\n"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" add [number] rule\n"
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
" [pipe] delete number ...\n"
" [pipe] list [number ...]\n"
" [pipe] show [number ...]\n"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" zero [number ...]\n"
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
" resetlog [number ...]\n"
Spelling corrections for dummynet. Reviewed by: des,luigi
1999-06-02 05:59:48 +00:00
" pipe number config [pipeconfig]\n"
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
" rule: [prob <match_probability>] action proto src dst extras...\n"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" action:\n"
" {allow|permit|accept|pass|deny|drop|reject|unreach code|\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" reset|count|skipto num|divert port|tee port|fwd ip|\n"
" pipe num} [log [logamount count]]\n"
" proto: {ip|tcp|udp|icmp| < number>}\n"
" src: from [not] {me|any|ip[{/bits|:mask}]} [{port[-port]}, [port], ...]\n"
" dst: to [not] {me|any|ip[{/bits|:mask}]} [{port[-port]}, [port], ...]\n"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" extras:\n"
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
" uid {user id}\n"
" gid {group id}\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" fragment (may not be used with ports or tcpflags)\n"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" in\n"
" out\n"
" {xmit|recv|via} {iface|ip|any}\n"
" {established|setup}\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" tcpflags [!]{syn|fin|rst|ack|psh|urg}, ...\n"
" ipoptions [!]{ssrr|lsrr|rr|ts}, ...\n"
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
" iplen {length}\n"
Do not force argument to ``ipid'' modifier be in hex, and accept value of zero as valid for IP Identification field.
2000-10-03 11:23:29 +00:00
" ipid {identification number}\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" iptos [!]{lowdelay|throughput|reliability|mincost|congestion}, ...\n"
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
" ipttl {time to live}\n"
" ipversion {version number}\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" tcpoptions [!]{mss|window|sack|ts|cc}, ...\n"
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
" tcpseq {sequence number}\n"
" tcpack {acknowledgement number}\n"
" tcpwin {window size}\n"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" icmptypes {type[, type]}...\n"
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
" keep-state [method]\n"
Spelling corrections for dummynet. Reviewed by: des,luigi
1999-06-02 05:59:48 +00:00
" pipeconfig:\n"
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
" {bw|bandwidth} <number>{bit/s|Kbit/s|Mbit/s|Bytes/s|KBytes/s|MBytes/s}\n"
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
" {bw|bandwidth} interface_name\n"
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
" delay <milliseconds>\n"
" queue <size>{packets|Bytes|KBytes}\n"
" plr <fraction>\n"
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
" mask {all| [dst-ip|src-ip|dst-port|src-port|proto] <number>}\n"
" buckets <number>}\n"
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
" {red|gred} <fraction>/<number>/<number>/<fraction>\n"
" droptail\n"
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
exit(EX_USAGE);
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static int
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
lookup_host (char *host, struct in_addr *ipaddr)
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
{
Fix the parsing of ip addresses on a command line. PR: 5047 Reviewed by: des Test case: ipfw add allow ip from 127.1 to any
1999-06-04 11:20:59 +00:00
struct hostent *he;
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
Fix the parsing of ip addresses on a command line. PR: 5047 Reviewed by: des Test case: ipfw add allow ip from 127.1 to any
1999-06-04 11:20:59 +00:00
if (!inet_aton(host, ipaddr)) {
if ((he = gethostbyname(host)) == NULL)
return(-1);
*ipaddr = *(struct in_addr *)he->h_addr_list[0];
}
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
return(0);
}
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
fill_ip(struct in_addr *ipno, struct in_addr *mask, int *acp, char ***avp)
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
{
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
int ac = *acp;
char **av = *avp;
char *p = 0, md = 0;
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "any", strlen(*av))) {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
ipno->s_addr = mask->s_addr = 0; av++; ac--;
} else {
p = strchr(*av, '/');
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!p)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
p = strchr(*av, ':');
if (p) {
md = *p;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
*p++ = '\0';
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (lookup_host(*av, ipno) != 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_NOHOST, "hostname ``%s'' unknown", *av);
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
switch (md) {
case ':':
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!inet_aton(p, mask))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "bad netmask ``%s''", p);
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
break;
case '/':
if (atoi(p) == 0) {
mask->s_addr = 0;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
} else if (atoi(p) > 32) {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "bad width ``%s''", p);
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
} else {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
mask->s_addr =
htonl(~0 << (32 - atoi(p)));
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
}
break;
default:
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
mask->s_addr = htonl(~0);
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
break;
}
ipno->s_addr &= mask->s_addr;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
av++;
ac--;
}
*acp = ac;
*avp = av;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
fill_reject_code(u_short *codep, char *str)
{
struct icmpcode *ic;
u_long val;
char *s;
val = strtoul(str, &s, 0);
if (s != str && *s == '\0' && val < 0x100) {
*codep = val;
return;
}
for (ic = icmpcodes; ic->str; ic++)
if (!strcasecmp(str, ic->str)) {
*codep = ic->code;
return;
}
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
}
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add_port(u_short *cnt, u_short *ptr, u_short off, u_short port)
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
{
if (off + *cnt >= IP_FW_MAX_PORTS)
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
errx(EX_USAGE, "too many ports (max is %d)", IP_FW_MAX_PORTS);
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
ptr[off+*cnt] = port;
(*cnt)++;
}
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
static int
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
lookup_port(const char *arg, int proto, int test, int nodash)
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
{
int val;
char *earg, buf[32];
struct servent *s;
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
char *p, *q;
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
snprintf(buf, sizeof(buf), "%s", arg);
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
for (p = q = buf; *p; *q++ = *p++) {
if (*p == '\\') {
if (*(p+1))
p++;
} else {
if (*p == ',' || (nodash && *p == '-'))
break;
}
}
*q = '\0';
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
val = (int) strtoul(buf, &earg, 0);
if (!*buf || *earg) {
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
char *protocol = NULL;
if (proto != 0) {
struct protoent *pe = getprotobynumber(proto);
if (pe)
protocol = pe->p_name;
}
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
setservent(1);
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
if ((s = getservbyname(buf, protocol))) {
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
val = htons(s->s_port);
} else {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!test)
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
errx(EX_DATAERR, "unknown port ``%s''", buf);
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
val = -1;
}
} else {
if (val < 0 || val > 0xffff) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!test)
errx(EX_DATAERR,
"port ``%s'' out of range", buf);
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
val = -1;
}
}
return(val);
}
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
/*
* return: 0 normally, 1 if first pair is a range,
* 2 if first pair is a port+mask
*/
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static int
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
fill_port(u_short *cnt, u_short *ptr, u_short off, char *arg, int proto)
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
{
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
char *s;
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
int initial_range = 0;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
for (s = arg; *s && *s != ',' && *s != '-' && *s != ':'; s++) {
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
if (*s == '\\' && *(s+1))
s++;
}
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
if (*s == ':') {
*s++ = '\0';
if (strchr(arg, ','))
errx(EX_USAGE, "port/mask must be first in list");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add_port(cnt, ptr, off,
*arg ? lookup_port(arg, proto, 0, 0) : 0x0000);
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
arg = s;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
s = strchr(arg, ',');
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
if (s)
*s++ = '\0';
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add_port(cnt, ptr, off,
*arg ? lookup_port(arg, proto, 0, 0) : 0xffff);
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
arg = s;
initial_range = 2;
} else
Allow ipfw to look up service names from /etc/services (or NIS if turned on) note.. this would be dangerous if your ipfw was blocking NIS access :) Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
if (*s == '-') {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
*s++ = '\0';
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
if (strchr(arg, ','))
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
errx(EX_USAGE, "port range must be first in list");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add_port(cnt, ptr, off,
*arg ? lookup_port(arg, proto, 0, 0) : 0x0000);
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
arg = s;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
s = strchr(arg, ',');
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
if (s)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
*s++ = '\0';
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add_port(cnt, ptr, off,
*arg ? lookup_port(arg, proto, 0, 0) : 0xffff);
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
arg = s;
initial_range = 1;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
}
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
while (arg != NULL) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
s = strchr(arg, ',');
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
if (s)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
*s++ = '\0';
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
add_port(cnt, ptr, off, lookup_port(arg, proto, 0, 0));
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
arg = s;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Some cosmetics and some better error-checking. Reviewed by: phk Submitted by: "Daniel O'Callaghan" <danny@panda.hilink.com.au> Submitted by: Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
return initial_range;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
fill_tcpflag(u_char *set, u_char *reset, char **vp)
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
char *p = *vp, *q;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
u_char *d;
Remove trailing whitespace.
1995-05-30 06:12:45 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
while (p && *p) {
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
struct tpcflags {
char * name;
u_char value;
} flags[] = {
{ "syn", IP_FW_TCPF_SYN },
{ "fin", IP_FW_TCPF_FIN },
{ "ack", IP_FW_TCPF_ACK },
{ "psh", IP_FW_TCPF_PSH },
{ "rst", IP_FW_TCPF_RST },
{ "urg", IP_FW_TCPF_URG }
};
int i;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
if (*p == '!') {
p++;
d = reset;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
} else {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
d = set;
}
q = strchr(p, ',');
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (q)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
*q++ = '\0';
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
for (i = 0; i < sizeof(flags) / sizeof(flags[0]); ++i)
if (!strncmp(p, flags[i].name, strlen(p))) {
*d |= flags[i].value;
break;
}
if (i == sizeof(flags) / sizeof(flags[0]))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid tcp flag ``%s''", p);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
p = q;
Ok..so everybody picking on me that ipfw syntacs is a pain in ...wel.. trying to fix this * from/to/via position indepenndant syntax * "any" for 0/0 host address * addf/addb default keyword in case you skip it.. * pass = accept new action, seems to be somewhat better in particular cases * on = via (as on ed0 instead of via ed0,loook at reject tcp on ed0 from hacker )
1995-03-03 12:28:34 +00:00
}
Change utility to accept interface name along with IP as "via" argument
1995-02-24 14:32:45 +00:00
}
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
static void
fill_tcpopts(u_char *set, u_char *reset, char **vp)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
char *p = *vp, *q;
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
u_char *d;
while (p && *p) {
struct tpcopts {
char * name;
u_char value;
} opts[] = {
{ "mss", IP_FW_TCPOPT_MSS },
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
{ "window", IP_FW_TCPOPT_WINDOW },
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
{ "sack", IP_FW_TCPOPT_SACK },
{ "ts", IP_FW_TCPOPT_TS },
{ "cc", IP_FW_TCPOPT_CC },
};
int i;
if (*p == '!') {
p++;
d = reset;
} else {
d = set;
}
q = strchr(p, ',');
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (q)
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
*q++ = '\0';
for (i = 0; i < sizeof(opts) / sizeof(opts[0]); ++i)
if (!strncmp(p, opts[i].name, strlen(p))) {
*d |= opts[i].value;
break;
}
if (i == sizeof(opts) / sizeof(opts[0]))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid tcp option ``%s''", p);
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
p = q;
}
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
fill_ipopt(u_char *set, u_char *reset, char **vp)
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
char *p = *vp, *q;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
u_char *d;
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
while (p && *p) {
if (*p == '!') {
p++;
d = reset;
} else {
d = set;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
q = strchr(p, ',');
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (q)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
*q++ = '\0';
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "ssrr", strlen(p))) *d |= IP_FW_IPOPT_SSRR;
if (!strncmp(p, "lsrr", strlen(p))) *d |= IP_FW_IPOPT_LSRR;
if (!strncmp(p, "rr", strlen(p))) *d |= IP_FW_IPOPT_RR;
if (!strncmp(p, "ts", strlen(p))) *d |= IP_FW_IPOPT_TS;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
p = q;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
}
}
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
static void
fill_iptos(u_char *set, u_char *reset, char **vp)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
char *p = *vp, *q;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
u_char *d;
while (p && *p) {
if (*p == '!') {
p++;
d = reset;
} else {
d = set;
}
q = strchr(p, ',');
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (q)
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*q++ = '\0';
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "lowdelay", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_LOWDELAY;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "throughput", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_THROUGHPUT;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "reliability", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_RELIABILITY;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "mincost", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_MINCOST;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "congestion", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_CE;
#if 0 /* conflicting! */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(p, "ecntransport", strlen(p)))
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
*d |= IPTOS_ECT;
#endif
p = q;
}
}
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
fill_icmptypes(unsigned *types, char **vp, u_int *fw_flg)
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
unsigned long icmptype;
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
char *c = *vp;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
while (*c) {
if (*c == ',')
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
++c;
icmptype = strtoul(c, &c, 0);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (*c != ',' && *c != '\0')
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid ICMP type");
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
Support interface names up to 15 characters in length. In order to accommodate the expanded name, the ICMP types bitmap has been reduced from 256 bits to 32. A recompile of kernel and user level ipfw is required. To be merged into 2.2 after a brief period in -current. PR: bin/4209 Reviewed by: Archie Cobbs <archie@whistle.com>
1997-08-08 14:36:29 +00:00
if (icmptype >= IP_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "ICMP type out of range");
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
types[icmptype / (sizeof(unsigned) * 8)] |=
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
1 << (icmptype % (sizeof(unsigned) * 8));
*fw_flg |= IP_FW_F_ICMPBIT;
}
}
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
delete(int ac, char *av[])
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
{
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
struct ip_fw rule;
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
struct dn_pipe pipe;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
int i;
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
int exitval = EX_OK;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
memset(&rule, 0, sizeof rule);
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
memset(&pipe, 0, sizeof pipe);
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
av++; ac--;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
/* Rule number */
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
while (ac && isdigit(**av)) {
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
i = atoi(*av); av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_pipe) {
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
if (do_pipe == 1)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
pipe.pipe_nr = i;
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
else
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
pipe.fs.fs_nr = i;
i = setsockopt(s, IPPROTO_IP, IP_DUMMYNET_DEL,
&pipe, sizeof pipe);
if (i) {
exitval = 1;
warn("rule %u: setsockopt(%s)",
do_pipe == 1 ? pipe.pipe_nr: pipe.fs.fs_nr,
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
"IP_DUMMYNET_DEL");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
} else {
rule.fw_number = i;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
i = setsockopt(s, IPPROTO_IP, IP_FW_DEL, &rule, sizeof rule);
Display a better error message and use a non-zero exit code when zero/delete operations fail. PR: 4231 Reviewed by: Archie Cobbs <archie@whistle.com>
1998-01-06 00:11:57 +00:00
if (i) {
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
exitval = EX_UNAVAILABLE;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
warn("rule %u: setsockopt(IP_FW_DEL)",
rule.fw_number);
Display a better error message and use a non-zero exit code when zero/delete operations fail. PR: 4231 Reviewed by: Archie Cobbs <archie@whistle.com>
1998-01-06 00:11:57 +00:00
}
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
}
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
}
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
if (exitval != EX_OK)
exit(exitval);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
}
Change utility to accept interface name along with IP as "via" argument
1995-02-24 14:32:45 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
verify_interface(union ip_fw_if *ifu)
Issue a warning if the user specifies an invalid interface in a rule. The rule is still added to the chain since the interface may get created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
{
struct ifreq ifr;
/*
* If a unit was specified, check for that exact interface.
* If a wildcard was specified, check for unit 0.
*/
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d",
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
ifu->fu_via_if.name,
ifu->fu_via_if.unit == -1 ? 0 : ifu->fu_via_if.unit);
Issue a warning if the user specifies an invalid interface in a rule. The rule is still added to the chain since the interface may get created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
if (ioctl(s, SIOCGIFFLAGS, &ifr) < 0)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
warnx("warning: interface ``%s'' does not exist",
ifr.ifr_name);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
}
Issue a warning if the user specifies an invalid interface in a rule. The rule is still added to the chain since the interface may get created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
fill_iface(char *which, union ip_fw_if *ifu, int *byname, int ac, char *arg)
{
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument for ``%s''", which);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
/* Parse the interface or address */
if (!strcmp(arg, "any")) {
ifu->fu_via_ip.s_addr = 0;
*byname = 0;
} else if (!isdigit(*arg)) {
char *q;
*byname = 1;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
strncpy(ifu->fu_via_if.name, arg,
sizeof(ifu->fu_via_if.name));
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
ifu->fu_via_if.name[sizeof(ifu->fu_via_if.name) - 1] = '\0';
for (q = ifu->fu_via_if.name;
*q && !isdigit(*q) && *q != '*'; q++)
continue;
ifu->fu_via_if.unit = (*q == '*') ? -1 : atoi(q);
*q = '\0';
verify_interface(ifu);
} else if (!inet_aton(arg, &ifu->fu_via_ip)) {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "bad ip address ``%s''", arg);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
} else
*byname = 0;
Issue a warning if the user specifies an invalid interface in a rule. The rule is still added to the chain since the interface may get created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
}
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
static void
config_pipe(int ac, char **av)
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
struct dn_pipe pipe;
int i;
char *end;
memset(&pipe, 0, sizeof pipe);
av++; ac--;
/* Pipe number */
if (ac && isdigit(**av)) {
i = atoi(*av); av++; ac--;
if (do_pipe == 1)
pipe.pipe_nr = i;
else
pipe.fs.fs_nr = i;
}
while (ac > 1) {
if (!strncmp(*av, "plr", strlen(*av))) {
double d = strtod(av[1], NULL);
if (d > 1)
d = 1;
else if (d < 0)
d = 0;
pipe.fs.plr = (int)(d*0x7fffffff);
av += 2;
ac -= 2;
} else if (!strncmp(*av, "queue", strlen(*av))) {
end = NULL;
pipe.fs.qsize = strtoul(av[1], &end, 0);
if (*end == 'K' || *end == 'k') {
pipe.fs.flags_fs |= DN_QSIZE_IS_BYTES;
pipe.fs.qsize *= 1024;
} else if (*end == 'B' || !strncmp(end, "by", 2)) {
pipe.fs.flags_fs |= DN_QSIZE_IS_BYTES;
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
}
av += 2;
ac -= 2;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "buckets", strlen(*av))) {
pipe.fs.rq_size = strtoul(av[1], NULL, 0);
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
av += 2;
ac -= 2;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "mask", strlen(*av))) {
/* per-flow queue, mask is dst_ip, dst_port,
* src_ip, src_port, proto measured in bits
*/
u_int32_t a;
void *par = NULL;
pipe.fs.flow_mask.dst_ip = 0;
pipe.fs.flow_mask.src_ip = 0;
pipe.fs.flow_mask.dst_port = 0;
pipe.fs.flow_mask.src_port = 0;
pipe.fs.flow_mask.proto = 0;
end = NULL;
av++; ac--;
if (ac >= 1 && !strncmp(*av, "all", strlen(*av))) {
/* special case -- all bits are significant */
pipe.fs.flow_mask.dst_ip = ~0;
pipe.fs.flow_mask.src_ip = ~0;
pipe.fs.flow_mask.dst_port = ~0;
pipe.fs.flow_mask.src_port = ~0;
pipe.fs.flow_mask.proto = ~0;
pipe.fs.flags_fs |= DN_HAVE_FLOW_MASK;
av++;
ac--;
continue;
}
while (ac >= 1) {
int len = strlen(*av);
if (!strncmp(*av, "dst-ip", len))
par = &pipe.fs.flow_mask.dst_ip;
else if (!strncmp(*av, "src-ip", len))
par = &pipe.fs.flow_mask.src_ip;
else if (!strncmp(*av, "dst-port", len))
par = &pipe.fs.flow_mask.dst_port;
else if (!strncmp(*av, "src-port", len))
par = &pipe.fs.flow_mask.src_port;
else if (!strncmp(*av, "proto", len))
par = &pipe.fs.flow_mask.proto;
else
break;
if (ac < 2)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "mask: %s value"
" missing", *av);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (*av[1] == '/') {
a = strtoul(av[1]+1, &end, 0);
if (a == 32) /* special case... */
a = ~0;
else
a = (1 << a) - 1;
} else {
a = strtoul(av[1], &end, 0);
}
if (par == &pipe.fs.flow_mask.src_port
|| par == &pipe.fs.flow_mask.dst_port) {
if (a >= (1 << 16))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "mask: %s"
" must be 16 bit, not"
" 0x%08x", *av, a);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
*((u_int16_t *)par) = (u_int16_t)a;
} else if (par == &pipe.fs.flow_mask.proto) {
if (a >= (1 << 8))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "mask: %s"
" must be"
" 8 bit, not 0x%08x",
*av, a);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
*((u_int8_t *)par) = (u_int8_t)a;
} else
*((u_int32_t *)par) = a;
if (a != 0)
pipe.fs.flags_fs |= DN_HAVE_FLOW_MASK;
av += 2;
ac -= 2;
} /* end for */
} else if (!strncmp(*av, "red", strlen(*av))
|| !strncmp(*av, "gred", strlen(*av))) {
/* RED enabled */
pipe.fs.flags_fs |= DN_IS_RED;
if (*av[0] == 'g')
pipe.fs.flags_fs |= DN_IS_GENTLE_RED;
if ((end = strsep(&av[1], "/"))) {
double w_q = strtod(end, NULL);
if (w_q > 1 || w_q <= 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "w_q %f must be "
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
"0 < x <= 1", w_q);
pipe.fs.w_q = (int) (w_q * (1 << SCALE_RED));
}
if ((end = strsep(&av[1], "/"))) {
pipe.fs.min_th = strtoul(end, &end, 0);
if (*end == 'K' || *end == 'k')
pipe.fs.min_th *= 1024;
}
if ((end = strsep(&av[1], "/"))) {
pipe.fs.max_th = strtoul(end, &end, 0);
if (*end == 'K' || *end == 'k')
pipe.fs.max_th *= 1024;
}
if ((end = strsep(&av[1], "/"))) {
double max_p = strtod(end, NULL);
if (max_p > 1 || max_p <= 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "max_p %f must be "
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
"0 < x <= 1", max_p);
pipe.fs.max_p =
(int)(max_p * (1 << SCALE_RED));
}
av += 2;
ac -= 2;
} else if (!strncmp(*av, "droptail", strlen(*av))) {
/* DROPTAIL */
pipe.fs.flags_fs &= ~(DN_IS_RED|DN_IS_GENTLE_RED);
av += 1;
ac -= 1;
} else {
int len = strlen(*av);
if (do_pipe == 1) {
/* some commands are only good for pipes. */
if (!strncmp(*av, "bw", len)
|| !strncmp(*av, "bandwidth", len)) {
if (av[1][0] >= 'a'
&& av[1][0] <= 'z') {
int l = sizeof(pipe.if_name)-1;
/* interface name */
strncpy(pipe.if_name, av[1], l);
pipe.if_name[l] = '\0';
pipe.bandwidth = 0;
} else {
pipe.if_name[0] = '\0';
pipe.bandwidth =
strtoul(av[1], &end, 0);
if (*end == 'K'
|| *end == 'k') {
end++;
pipe.bandwidth *=
1000;
} else if (*end == 'M') {
end++;
pipe.bandwidth *=
1000000;
}
if (*end == 'B'
|| !strncmp(end, "by", 2))
pipe.bandwidth *= 8;
}
av += 2; ac -= 2;
} else if (!strncmp(*av, "delay", len)) {
pipe.delay = strtoul(av[1], NULL, 0);
av += 2; ac -= 2;
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "unrecognised pipe"
" option ``%s''", *av);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
} else { /* this refers to a queue */
if (!strncmp(*av, "weight", len)) {
pipe.fs.weight =
strtoul(av[1], &end, 0);
av += 2;
ac -= 2;
} else if (!strncmp(*av, "pipe", len)) {
pipe.fs.parent_nr =
strtoul(av[1], &end, 0);
av += 2;
ac -= 2;
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "unrecognised option "
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
"``%s''", *av);
}
}
}
}
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
if (do_pipe == 1) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.pipe_nr == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "pipe_nr %d must be > 0",
pipe.pipe_nr);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.delay > 10000)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "delay %d must be < 10000",
pipe.delay);
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
} else { /* do_pipe == 2, queue */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.fs.parent_nr == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "pipe %d must be > 0",
pipe.fs.parent_nr);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.fs.weight >100)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "weight %d must be <= 100",
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
pipe.fs.weight);
}
if (pipe.fs.flags_fs & DN_QSIZE_IS_BYTES) {
if (pipe.fs.qsize > 1024*1024)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "queue size %d, must be < 1MB",
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
pipe.fs.qsize);
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
} else {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.fs.qsize > 100)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "queue size %d, must be"
" 2 <= x <= 100", pipe.fs.qsize);
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
}
if (pipe.fs.flags_fs & DN_IS_RED) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.fs.min_th >= pipe.fs.max_th)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "min_th %d must be < than max_th %d",
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
pipe.fs.min_th, pipe.fs.max_th);
if (pipe.fs.max_th == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "max_th must be > 0");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (pipe.bandwidth) {
size_t len;
int lookup_depth, avg_pkt_size;
double s, idle, weight, w_q;
struct clockinfo clock;
int t;
len = sizeof(int);
if (sysctlbyname("net.inet.ip.dummynet.red_lookup_depth",
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
&lookup_depth, &len, NULL, 0) == -1)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
errx(1, "sysctlbyname(\"%s\")",
"net.inet.ip.dummynet.red_lookup_depth");
if (lookup_depth == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "net.inet.ip.dummynet.red_lookup_depth"
" must greater than zero");
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
len = sizeof(int);
if (sysctlbyname("net.inet.ip.dummynet.red_avg_pkt_size",
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
&avg_pkt_size, &len, NULL, 0) == -1)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
errx(1, "sysctlbyname(\"%s\")",
"net.inet.ip.dummynet.red_avg_pkt_size");
if (avg_pkt_size == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "net.inet.ip.dummynet.red_avg_pkt_size must"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
"greater than zero");
len = sizeof(struct clockinfo);
if (sysctlbyname("kern.clockrate",
&clock, &len, NULL, 0) == -1)
errx(1, "sysctlbyname(\"%s\")",
"kern.clockrate");
/* ticks needed for sending a medium-sized packet */
s = clock.hz * avg_pkt_size * 8 / pipe.bandwidth;
/*
* max idle time (in ticks) before avg queue size
* becomes 0.
* NOTA: (3/w_q) is approx the value x so that
* (1-w_q)^x < 10^-3.
*/
w_q = ((double)pipe.fs.w_q) / (1 << SCALE_RED);
idle = s * 3. / w_q;
pipe.fs.lookup_step = (int)idle / lookup_depth;
if (!pipe.fs.lookup_step)
pipe.fs.lookup_step = 1;
weight = 1 - w_q;
for (t = pipe.fs.lookup_step; t > 0; --t)
weight *= weight;
pipe.fs.lookup_weight =
(int)(weight * (1 << SCALE_RED));
}
userland side of WF2Q+ support in dummynet. Manpage coming later...
2000-06-08 10:08:39 +00:00
}
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
#if 0
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
printf("configuring pipe %d bw %d delay %d size %d\n",
pipe.pipe_nr, pipe.bandwidth, pipe.delay, pipe.queue_size);
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
#endif
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
i = setsockopt(s, IPPROTO_IP, IP_DUMMYNET_CONFIGURE, &pipe,
sizeof pipe);
if (i)
err(1, "setsockopt(%s)", "IP_DUMMYNET_CONFIGURE");
ipfw changes for dummynet. manpages still missing
1998-12-14 18:43:03 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add(int ac, char *av[])
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
{
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
struct ip_fw rule;
int i;
Completely rewrite handling of protocol field for firewalls, things are now completely consistent across all IP protocols and should be quite a bit faster. Use getprotoname() extensively, performed minor cleanups of admin utility. The admin utility could use a good kick in the pants. Basicly, these were the minimal changes I could make to the code to get it up to tollerable shape. There will be some future commits to clean up the basic architecture of the firewall code, and if I'm feeling ambitious, I may pull in changes like NAT from Linux and make the firewall hooks comletely generic so that a user can either load the ipfw module or the ipfilter module (cf Darren Reed). Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
u_char proto;
struct protoent *pe;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
int saw_xmrc = 0, saw_via = 0;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
memset(&rule, 0, sizeof rule);
av++; ac--;
/* Rule number */
if (ac && isdigit(**av)) {
rule.fw_number = atoi(*av); av++; ac--;
}
/* Action */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac > 1 && !strncmp(*av, "prob", strlen(*av))) {
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
double d = strtod(av[1], NULL);
if (d <= 0 || d > 1)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "illegal match prob. %s", av[1]);
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
if (d != 1) { /* 1 means always match */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_flg |= IP_FW_F_RND_MATCH;
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
/* we really store dont_match probability */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
(long)rule.pipe_ptr = (long)((1 - d) * 0x7fffffff);
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av += 2; ac -= 2;
Userland and manual page changes for probabilistic rule match. Because the kernel change was done in a backward-compatible way, you don't need to recompile ipfw if you don't want to use the new feature.
1999-08-11 15:36:13 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (ac == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing action");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(*av, "accept", strlen(*av))
|| !strncmp(*av, "pass", strlen(*av))
|| !strncmp(*av, "allow", strlen(*av))
|| !strncmp(*av, "permit", strlen(*av))) {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
rule.fw_flg |= IP_FW_F_ACCEPT; av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "count", strlen(*av))) {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
rule.fw_flg |= IP_FW_F_COUNT; av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "pipe", strlen(*av))) {
rule.fw_flg |= IP_FW_F_PIPE; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing pipe number");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
} else if (!strncmp(*av, "queue", strlen(*av))) {
rule.fw_flg |= IP_FW_F_QUEUE; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing queue number");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
} else if (!strncmp(*av, "divert", strlen(*av))) {
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
rule.fw_flg |= IP_FW_F_DIVERT; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing %s port", "divert");
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
Allow service names as the divert/tee arg.
1997-07-25 03:13:46 +00:00
if (rule.fw_divert_port == 0) {
struct servent *s;
setservent(1);
s = getservbyname(av[-1], "divert");
if (s != NULL)
rule.fw_divert_port = ntohs(s->s_port);
else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "illegal %s port", "divert");
Allow service names as the divert/tee arg.
1997-07-25 03:13:46 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "tee", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_TEE; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing %s port", "tee divert");
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_divert_port = strtoul(*av, NULL, 0); av++; ac--;
Allow service names as the divert/tee arg.
1997-07-25 03:13:46 +00:00
if (rule.fw_divert_port == 0) {
struct servent *s;
setservent(1);
s = getservbyname(av[-1], "divert");
if (s != NULL)
rule.fw_divert_port = ntohs(s->s_port);
else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "illegal %s port",
"tee divert");
Allow service names as the divert/tee arg.
1997-07-25 03:13:46 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "fwd", strlen(*av))
|| !strncmp(*av, "forward", strlen(*av))) {
Support for IPFW based transparent forwarding. Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
struct in_addr dummyip;
char *pp;
rule.fw_flg |= IP_FW_F_FWD; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing forwarding IP address");
Support for IPFW based transparent forwarding. Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
rule.fw_fwd_ip.sin_len = sizeof(struct sockaddr_in);
rule.fw_fwd_ip.sin_family = AF_INET;
rule.fw_fwd_ip.sin_port = 0;
pp = strchr(*av, ':');
if(pp == NULL)
pp = strchr(*av, ',');
if(pp != NULL)
{
*(pp++) = '\0';
Respect the protocol when looking the port up by service name. PR: 21742
2000-10-04 07:59:19 +00:00
i = lookup_port(pp, 0, 1, 0);
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
if (i == -1)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "illegal forwarding"
" port ``%s''", pp);
Workaround the problem that the first (and only first) port name can't have a dash character (it is treated as a ``range'' operator). One could now use such a name by escaping the ``-'' characters. For example: # ipfw add 1 count tcp from any to any "ms\-sql\-s" # ipfw add 2 count tcp from any ftp\\-data-ftp to any PR: 7101
1999-06-11 09:43:53 +00:00
else
rule.fw_fwd_ip.sin_port = (u_short)i;
Support for IPFW based transparent forwarding. Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
}
fill_ip(&(rule.fw_fwd_ip.sin_addr), &dummyip, &ac, &av);
if (rule.fw_fwd_ip.sin_addr.s_addr == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "illegal forwarding IP address");
Support for IPFW based transparent forwarding. Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "skipto", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_SKIPTO; av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing skipto rule number");
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_skipto_rule = strtoul(*av, NULL, 0); av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if ((!strncmp(*av, "deny", strlen(*av))
|| !strncmp(*av, "drop", strlen(*av)))) {
Adding changes to ipfw and the kernel to support ip packet diversion.. This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
rule.fw_flg |= IP_FW_F_DENY; av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "reject", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
rule.fw_reject_code = ICMP_UNREACH_HOST;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "reset", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
rule.fw_reject_code = IP_FW_REJECT_RST; /* check TCP later */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "unreach", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_REJECT; av++; ac--;
fill_reject_code(&rule.fw_reject_code, *av); av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "check-state", strlen(*av))) {
rule.fw_flg |= IP_FW_F_CHECK_S; av++; ac--;
goto done;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid action ``%s''", *av);
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
/* [log] */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "log", strlen(*av))) {
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
rule.fw_flg |= IP_FW_F_PRN; av++; ac--;
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "logamount", strlen(*av))) {
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
if (!(rule.fw_flg & IP_FW_F_PRN))
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "``logamount'' not valid without"
" ``log''");
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
ac--; av++;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "``logamount'' requires argument");
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
rule.fw_logamount = atoi(*av);
Allow overriding of net.inet.ip.fw.verbose_limit; if you want to make a rule that logs without a log limit, use "logamount 0" in addition to "log".
2000-04-30 06:44:11 +00:00
if (rule.fw_logamount < 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "``logamount'' argument must be"
" positive");
Allow overriding of net.inet.ip.fw.verbose_limit; if you want to make a rule that logs without a log limit, use "logamount 0" in addition to "log".
2000-04-30 06:44:11 +00:00
if (rule.fw_logamount == 0)
rule.fw_logamount = -1;
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
ac--; av++;
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
/* protocol */
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (ac == 0)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing protocol");
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if ((proto = atoi(*av)) > 0) {
rule.fw_prot = proto; av++; ac--;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "all", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_prot = IPPROTO_IP; av++; ac--;
} else if ((pe = getprotobyname(*av)) != NULL) {
rule.fw_prot = pe->p_proto; av++; ac--;
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid protocol ``%s''", *av);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
}
if (rule.fw_prot != IPPROTO_TCP
&& (rule.fw_flg & IP_FW_F_COMMAND) == IP_FW_F_REJECT
&& rule.fw_reject_code == IP_FW_REJECT_RST)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "``reset'' is only valid for tcp packets");
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
/* from */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "from", strlen(*av))) { av++; ac--; }
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing ``from''");
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "not", strlen(*av))) {
Adjust spelling of `fw_flg' so this thing compiles again.
1997-01-17 07:01:21 +00:00
rule.fw_flg |= IP_FW_F_INVSRC;
implement "not" keyword for inverting the address logic
1997-01-16 21:04:29 +00:00
av++; ac--;
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing arguments");
implement "not" keyword for inverting the address logic
1997-01-16 21:04:29 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "me", strlen(*av))) {
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
rule.fw_flg |= IP_FW_F_SME;
av++; ac--;
} else {
fill_ip(&rule.fw_src, &rule.fw_smsk, &ac, &av);
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && (isdigit(**av)
|| lookup_port(*av, rule.fw_prot, 1, 1) >= 0)) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
u_short nports = 0;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int retval;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
retval = fill_port(&nports, rule.fw_uar.fw_pts,
0, *av, rule.fw_prot);
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
if (retval == 1)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
rule.fw_flg |= IP_FW_F_SRNG;
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
else if (retval == 2)
rule.fw_flg |= IP_FW_F_SMSK;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
IP_FW_SETNSRCP(&rule, nports);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
av++; ac--;
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
/* to */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "to", strlen(*av))) { av++; ac--; }
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing ``to''");
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "not", strlen(*av))) {
Adjust spelling of `fw_flg' so this thing compiles again.
1997-01-17 07:01:21 +00:00
rule.fw_flg |= IP_FW_F_INVDST;
implement "not" keyword for inverting the address logic
1997-01-16 21:04:29 +00:00
av++; ac--;
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing arguments");
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && !strncmp(*av, "me", strlen(*av))) {
Introduce a new feature in IPFW: Check of the source or destination address is configured on a interface. This is useful for routers with dynamic interfaces. It is now possible to say: 0100 allow tcp from any to any established 0200 skipto 1000 tcp from any to any 0300 allow ip from any to any 1000 allow tcp from 1.2.3.4 to me 22 1010 deny tcp from any to me 22 1020 allow tcp from any to any and not have to worry about the behaviour if dynamic interfaces configure new IP numbers later on. The check is semi expensive (traverses the interface address list) so it should be protected as in the above example if high performance is a requirement.
2001-02-13 14:12:37 +00:00
rule.fw_flg |= IP_FW_F_DME;
av++; ac--;
} else {
fill_ip(&rule.fw_dst, &rule.fw_dmsk, &ac, &av);
}
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac && (isdigit(**av)
|| lookup_port(*av, rule.fw_prot, 1, 1) >= 0)) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
u_short nports = 0;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int retval;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
retval = fill_port(&nports, rule.fw_uar.fw_pts,
IP_FW_GETNSRCP(&rule), *av, rule.fw_prot);
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
if (retval == 1)
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
rule.fw_flg |= IP_FW_F_DRNG;
Support per-flow queueing in dummynet. Implement masks on UDP/TCP ports. Large rewrite of the manpage. Work supported by Akamba Corp.
2000-01-08 11:19:19 +00:00
else if (retval == 2)
rule.fw_flg |= IP_FW_F_DMSK;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
IP_FW_SETNDSTP(&rule, nports);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
av++; ac--;
Support IP Option smatching in grammar and listing. TcpSyn option removed and will be shortly repoaced by support of all TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if ((rule.fw_prot != IPPROTO_TCP) && (rule.fw_prot != IPPROTO_UDP)
&& (IP_FW_GETNSRCP(&rule) || IP_FW_GETNDSTP(&rule))) {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "only TCP and UDP protocols are valid"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" with port specifications");
Update to match kernel code.
1996-02-24 13:39:46 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
while (ac) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(*av, "uid", strlen(*av))) {
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
struct passwd *pwd;
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
char *end;
uid_t uid;
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
rule.fw_flg |= IP_FW_F_UID;
ac--; av++;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "``uid'' requires argument");
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
uid = strtoul(*av, &end, 0);
if (*end == '\0')
pwd = getpwuid(uid);
else
pwd = getpwnam(*av);
if (pwd == NULL)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "uid \"%s\" is"
" nonexistent", *av);
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
rule.fw_uid = pwd->pw_uid;
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
ac--; av++;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "gid", strlen(*av))) {
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
struct group *grp;
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
char *end;
gid_t gid;
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
rule.fw_flg |= IP_FW_F_GID;
ac--; av++;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "``gid'' requires argument");
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
gid = strtoul(*av, &end, 0);
if (*end == '\0')
grp = getgrgid(gid);
else
grp = getgrnam(*av);
if (grp == NULL)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "gid \"%s\" is"
" nonexistent", *av);
Make the "uid" and "gid" code better. Now it can detect invalid user names/numbers. Reviewed by: chris
1999-09-03 18:18:46 +00:00
rule.fw_gid = grp->gr_gid;
This is the much-awaited cleaned up version of IPFW [ug]id support. All relevant changes have been made (including ipfw.8).
1999-06-19 18:43:33 +00:00
ac--; av++;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (!strncmp(*av, "in", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_IN;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "keep-state", strlen(*av))) {
u_long type;
rule.fw_flg |= IP_FW_F_KEEP_S;
av++; ac--;
if (ac > 0 && (type = atoi(*av)) != 0) {
(int)rule.next_rule_ptr = type;
av++; ac--;
}
} else if (!strncmp(*av, "bridged", strlen(*av))) {
rule.fw_flg |= IP_FW_BRIDGED;
av++; ac--;
} else if (!strncmp(*av, "out", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_OUT;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (ac && !strncmp(*av, "xmit", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
union ip_fw_if ifu;
int byname;
if (saw_via) {
badviacombo:
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "``via'' is incompatible"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" with ``xmit'' and ``recv''");
Formatting fixes for 'in' and 'out' while listing. Prevent ALL protocol from being used with port specifications. Allow 'via' keyword at any point in the options list. Disallow multiple 'via' specifications.
1996-06-29 01:28:19 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
saw_xmrc = 1;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
fill_iface("xmit", &ifu, &byname, ac, *av);
rule.fw_out_if = ifu;
rule.fw_flg |= IP_FW_F_OIFACE;
if (byname)
rule.fw_flg |= IP_FW_F_OIFNAME;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (ac && !strncmp(*av, "recv", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
union ip_fw_if ifu;
int byname;
if (saw_via)
goto badviacombo;
saw_xmrc = 1;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
fill_iface("recv", &ifu, &byname, ac, *av);
rule.fw_in_if = ifu;
rule.fw_flg |= IP_FW_F_IIFACE;
if (byname)
rule.fw_flg |= IP_FW_F_IIFNAME;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (ac && !strncmp(*av, "via", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
union ip_fw_if ifu;
int byname = 0;
if (saw_xmrc)
goto badviacombo;
saw_via = 1;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
fill_iface("via", &ifu, &byname, ac, *av);
rule.fw_out_if = rule.fw_in_if = ifu;
if (byname)
rule.fw_flg |=
(IP_FW_F_IIFNAME | IP_FW_F_OIFNAME);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "fragment", strlen(*av))) {
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
rule.fw_flg |= IP_FW_F_FRAG;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "ipoptions", strlen(*av))
|| !strncmp(*av, "ipopts", strlen(*av))) {
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" for ``ipoptions''");
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
rule.fw_ipflg |= IP_FW_IF_IPOPT;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
fill_ipopt(&rule.fw_ipopt, &rule.fw_ipnopt, av);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "iplen", strlen(*av))) {
av++; ac--;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``iplen''");
rule.fw_ipflg |= IP_FW_IF_IPLEN;
rule.fw_iplen = (u_short)strtoul(*av, NULL, 0);
av++; ac--;
} else if (!strncmp(*av, "ipid", strlen(*av))) {
Do not force argument to ``ipid'' modifier be in hex, and accept value of zero as valid for IP Identification field.
2000-10-03 11:23:29 +00:00
unsigned long ipid;
char *c;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``ipid''");
Do not force argument to ``ipid'' modifier be in hex, and accept value of zero as valid for IP Identification field.
2000-10-03 11:23:29 +00:00
ipid = strtoul(*av, &c, 0);
if (*c != '\0')
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "argument to ipid must"
" be numeric");
Do not force argument to ``ipid'' modifier be in hex, and accept value of zero as valid for IP Identification field.
2000-10-03 11:23:29 +00:00
if (ipid > 65535)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "argument to ipid out"
" of range");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_ipflg |= IP_FW_IF_IPID;
rule.fw_ipid = (u_short)ipid;
av++; ac--;
} else if (!strncmp(*av, "iptos", strlen(*av))) {
av++; ac--;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``iptos''");
rule.fw_ipflg |= IP_FW_IF_IPTOS;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
fill_iptos(&rule.fw_iptos, &rule.fw_ipntos, av);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "ipttl", strlen(*av))) {
av++; ac--;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``ipttl''");
rule.fw_ipflg |= IP_FW_IF_IPTTL;
rule.fw_ipttl = (u_short)strtoul(*av, NULL, 0);
av++; ac--;
} else if (!strncmp(*av, "ipversion", strlen(*av))
|| !strncmp(*av, "ipver", strlen(*av))) {
av++; ac--;
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``ipversion''");
rule.fw_ipflg |= IP_FW_IF_IPVER;
rule.fw_ipver = (u_short)strtoul(*av, NULL, 0);
av++; ac--;
} else if (rule.fw_prot == IPPROTO_TCP) {
if (!strncmp(*av, "established", strlen(*av))) {
o IPFW incorrectly handled filtering in the presence of previously reserved and now allocated TCP flags in incoming packets. This patch stops overloading those bits in the IP firewall rules, and moves colliding flags to a seperate field, ipflg. The IPFW userland management tool, ipfw(8), is updated to reflect this change. New TCP flags related to ECN are now included in tcp.h for reference, although we don't currently implement TCP+ECN. o To use this fix without completely rebuilding, it is sufficient to copy ip_fw.h and tcp.h into your appropriate include directory, then rebuild the ipfw kernel module, and ipfw tool, and install both. Note that a mismatch between module and userland tool will result in incorrect installation of firewall rules that may have unexpected effects. This is an MFC candidate, following shakedown. This bug does not appear to affect ipfilter. Reviewed by: security-officer, billf Reported by: Aragon Gouveia <aragon@phat.za.net>
2001-01-09 03:10:30 +00:00
rule.fw_ipflg |= IP_FW_IF_TCPEST;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
} else if (!strncmp(*av, "setup", strlen(*av))) {
Update to match kernel code.
1996-02-24 13:39:46 +00:00
rule.fw_tcpf |= IP_FW_TCPF_SYN;
rule.fw_tcpnf |= IP_FW_TCPF_ACK;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_ipflg |= IP_FW_IF_TCPFLG;
av++; ac--;
} else if (!strncmp(*av, "tcpflags", strlen(*av))
|| !strncmp(*av, "tcpflgs", strlen(*av))) {
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" for ``tcpflags''");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_ipflg |= IP_FW_IF_TCPFLG;
fill_tcpflag(&rule.fw_tcpf,
&rule.fw_tcpnf, av);
av++; ac--;
} else if (!strncmp(*av, "tcpoptions", strlen(*av))
|| !strncmp(*av, "tcpopts", strlen(*av))) {
av++; ac--;
Add tcpoptions to ipfw. This works much in the same way as ipoptions do. It also squashes 99% of packet kiddie synflood orgies. For example, to rate syn packets without MSS, ipfw pipe 10 config 56Kbit/s queue 10Packets ipfw add pipe 10 tcp from any to any in setup tcpoptions !mss Submitted by: Richard A. Steenbergen <ras@e-gerbil.net>
2000-06-08 15:34:51 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Fix a paste-o in the tcpoptions check (not a security problem, just a error in the usage printf()) Reviewed by: rwatson
2000-07-17 03:02:15 +00:00
" for ``tcpoptions''");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
rule.fw_ipflg |= IP_FW_IF_TCPOPT;
fill_tcpopts(&rule.fw_tcpopt,
&rule.fw_tcpnopt, av);
av++; ac--;
} else if (!strncmp(*av, "tcpseq", strlen(*av))) {
Add new fields for more granularity: IP: version, tos, ttl, len, id TCP: seq#, ack#, window size Reviewed by: silence on freebsd-{net,ipfw}
2000-10-02 03:03:31 +00:00
av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``tcpseq''");
rule.fw_ipflg |= IP_FW_IF_TCPSEQ;
rule.fw_tcpseq =
htonl(strtoul(*av, NULL, 0));
av++; ac--;
} else if (!strncmp(*av, "tcpack", strlen(*av))) {
av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``tcpack''");
rule.fw_ipflg |= IP_FW_IF_TCPACK;
rule.fw_tcpack =
htonl(strtoul(*av, NULL, 0));
av++; ac--;
} else if (!strncmp(*av, "tcpwin", strlen(*av))) {
av++; ac--;
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
" for ``tcpwin''");
rule.fw_ipflg |= IP_FW_IF_TCPWIN;
rule.fw_tcpwin =
htons((u_short)strtoul(*av, NULL, 0));
av++; ac--;
Fix rule parsing breakage introduced in 1.103 cleanup. 'tcp' and 'icmp' rules could drop into infinite loops when given bad arguments. Reviewed by: ru, des Approved by: ru
2001-07-10 05:44:51 +00:00
} else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "unknown or out of order"
" argument ``%s''", *av);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if (rule.fw_prot == IPPROTO_ICMP) {
if (!strncmp(*av, "icmptypes", strlen(*av))) {
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
av++; ac--;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "missing argument"
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
" for ``icmptypes''");
Bump up packet and byte counters to 64-bit unsigned ints. As a consequence, ipfw's list command now adjusts its output at runtime based on the largest packet/byte counter values. NOTE: o The ipfw struct has changed requiring a recompile of both kernel and userland ipfw utility. o This probably should not be brought into 2.2. PR: 3738
1998-01-08 03:03:54 +00:00
fill_icmptypes(rule.fw_uar.fw_icmptypes,
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
av, &rule.fw_flg);
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
av++; ac--;
Fix rule parsing breakage introduced in 1.103 cleanup. 'tcp' and 'icmp' rules could drop into infinite loops when given bad arguments. Reviewed by: ru, des Approved by: ru
2001-07-10 05:44:51 +00:00
} else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "unknown or out of"
" order argument ``%s''", *av);
Fix rule parsing breakage introduced in 1.103 cleanup. 'tcp' and 'icmp' rules could drop into infinite loops when given bad arguments. Reviewed by: ru, des Approved by: ru
2001-07-10 05:44:51 +00:00
} else
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "unknown argument ``%s''", *av);
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
/* No direction specified -> do both directions */
if (!(rule.fw_flg & (IP_FW_F_OUT|IP_FW_F_IN)))
rule.fw_flg |= (IP_FW_F_OUT|IP_FW_F_IN);
/* Sanity check interface check, but handle "via" case separately */
if (saw_via) {
if (rule.fw_flg & IP_FW_F_IN)
rule.fw_flg |= IP_FW_F_IIFACE;
if (rule.fw_flg & IP_FW_F_OUT)
rule.fw_flg |= IP_FW_F_OIFACE;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else if ((rule.fw_flg & IP_FW_F_OIFACE)
&& (rule.fw_flg & IP_FW_F_IN)) {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "can't check xmit interface of incoming"
" packets");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
Alter ipfw's behavior with respect to fragmented packets when the packet offset is non-zero: - Do not match fragmented packets if the rule specifies a port or TCP flags - Match fragmented packets if the rule does not specify a port and TCP flags Since ipfw cannot examine port numbers or TCP flags for such packets, it is now illegal to specify the 'frag' option with either ports or tcpflags. Both kernel and ipfw userland utility will reject rules containing a combination of these options. BEWARE: packets that were previously passed may now be rejected, and vice versa. Reviewed by: Archie Cobbs <archie@whistle.com>
1998-02-12 00:57:06 +00:00
/* frag may not be used in conjunction with ports or TCP flags */
if (rule.fw_flg & IP_FW_F_FRAG) {
if (rule.fw_tcpf || rule.fw_tcpnf)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "can't mix 'frag' and tcpflags");
Alter ipfw's behavior with respect to fragmented packets when the packet offset is non-zero: - Do not match fragmented packets if the rule specifies a port or TCP flags - Match fragmented packets if the rule does not specify a port and TCP flags Since ipfw cannot examine port numbers or TCP flags for such packets, it is now illegal to specify the 'frag' option with either ports or tcpflags. Both kernel and ipfw userland utility will reject rules containing a combination of these options. BEWARE: packets that were previously passed may now be rejected, and vice versa. Reviewed by: Archie Cobbs <archie@whistle.com>
1998-02-12 00:57:06 +00:00
if (rule.fw_nports)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "can't mix 'frag' and port"
" specifications");
Alter ipfw's behavior with respect to fragmented packets when the packet offset is non-zero: - Do not match fragmented packets if the rule specifies a port or TCP flags - Match fragmented packets if the rule does not specify a port and TCP flags Since ipfw cannot examine port numbers or TCP flags for such packets, it is now illegal to specify the 'frag' option with either ports or tcpflags. Both kernel and ipfw userland utility will reject rules containing a combination of these options. BEWARE: packets that were previously passed may now be rejected, and vice versa. Reviewed by: Archie Cobbs <archie@whistle.com>
1998-02-12 00:57:06 +00:00
}
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
if (rule.fw_flg & IP_FW_F_PRN) {
if (!rule.fw_logamount) {
size_t len = sizeof(int);
if (sysctlbyname("net.inet.ip.fw.verbose_limit",
&rule.fw_logamount, &len, NULL, 0) == -1)
errx(1, "sysctlbyname(\"%s\")",
"net.inet.ip.fw.verbose_limit");
Allow overriding of net.inet.ip.fw.verbose_limit; if you want to make a rule that logs without a log limit, use "logamount 0" in addition to "log".
2000-04-30 06:44:11 +00:00
} else if (rule.fw_logamount == -1)
rule.fw_logamount = 0;
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
rule.fw_loghighest = rule.fw_logamount;
}
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
done:
Allow for IP_FW_ADD to be used in getsockopt(2) incarnation as well, in which case return the rule number back into userland. PR: bin/18351 Reviewed by: archie, luigi
2000-10-12 07:59:14 +00:00
i = sizeof(rule);
if (getsockopt(s, IPPROTO_IP, IP_FW_ADD, &rule, &i) == -1)
err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD");
Add '-q' quiet flag for flush/add/zero commands; add 'show' command as synonym for '-a list'; stop SEGV when specifying 'via' with no interface; change 2 instances of strcpy() to strncpy(). This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
if (!do_quiet)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
show_ipfw(&rule);
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
}
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
zero (int ac, char *av[])
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
struct ip_fw rule;
int failed = EX_OK;
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
av++; ac--;
if (!ac) {
/* clear all entries */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (setsockopt(s, IPPROTO_IP, IP_FW_ZERO, NULL, 0) < 0)
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
err(EX_UNAVAILABLE, "setsockopt(%s)", "IP_FW_ZERO");
Add '-q' quiet flag for flush/add/zero commands; add 'show' command as synonym for '-a list'; stop SEGV when specifying 'via' with no interface; change 2 instances of strcpy() to strncpy(). This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
if (!do_quiet)
printf("Accounting cleared.\n");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
return;
}
memset(&rule, 0, sizeof rule);
while (ac) {
/* Rule number */
if (isdigit(**av)) {
rule.fw_number = atoi(*av); av++; ac--;
if (setsockopt(s, IPPROTO_IP,
IP_FW_ZERO, &rule, sizeof rule)) {
warn("rule %u: setsockopt(IP_FW_ZERO)",
rule.fw_number);
failed = EX_UNAVAILABLE;
}
else if (!do_quiet)
printf("Entry %d cleared\n",
rule.fw_number);
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "invalid rule number ``%s''", *av);
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
}
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (failed != EX_OK)
exit(failed);
Big sweep over ipfw, picking up where Poul left off: - Filter based on ICMP types. - Accept interface wildcards (e.g. ppp*). - Resolve service names with the -N option. - Accept host names in 'from' and 'to' specifications - Display chain entry time stamps with the -t option. - Added URG to tcpflags. - Print usage if an unknown tcpflag is used. - Ability to zero individual accounting entries. - Clarify usage of port ranges. - Misc code cleanup. Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
}
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
static void
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
resetlog (int ac, char *av[])
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
{
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
struct ip_fw rule;
int failed = EX_OK;
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
av++; ac--;
if (!ac) {
/* clear all entries */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (setsockopt(s, IPPROTO_IP, IP_FW_RESETLOG, NULL, 0) < 0)
err(EX_UNAVAILABLE, "setsockopt(IP_FW_RESETLOG)");
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
if (!do_quiet)
printf("Logging counts reset.\n");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
return;
}
memset(&rule, 0, sizeof rule);
while (ac) {
/* Rule number */
if (isdigit(**av)) {
rule.fw_number = atoi(*av); av++; ac--;
if (setsockopt(s, IPPROTO_IP,
IP_FW_RESETLOG, &rule, sizeof rule)) {
warn("rule %u: setsockopt(IP_FW_RESETLOG)",
rule.fw_number);
failed = EX_UNAVAILABLE;
} else if (!do_quiet)
printf("Entry %d logging count reset\n",
rule.fw_number);
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_DATAERR, "invalid rule number ``%s''", *av);
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
}
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (failed != EX_OK)
exit(failed);
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
}
The flags type was recently changed from u_short to u_int, breaking icmptypes. PR: 8067 Submitted by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.wave.home.com> While I'm here, staticize functions.
1998-09-28 22:56:37 +00:00
static int
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
ipfw_main(int ac, char **av)
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
{
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int ch;
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (ac == 1)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
show_usage();
Reset globals for every new command read from preprocessed file.
2000-10-11 13:02:30 +00:00
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
/* Set the force flag for non-interactive processes */
do_force = !isatty(STDIN_FILENO);
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
optind = optreset = 1;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
while ((ch = getopt(ac, av, "s:adefNqtv")) != -1)
switch (ch) {
case 's': /* sort */
do_sort = atoi(optarg);
break;
case 'a':
do_acct = 1;
break;
case 'd':
do_dynamic = 1;
break;
case 'e':
do_expired = 1;
break;
case 'f':
do_force = 1;
break;
case 'N':
do_resolv = 1;
break;
case 'q':
do_quiet = 1;
break;
case 't':
do_time = 1;
break;
case 'v': /* verbose */
verbose++;
break;
default:
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
show_usage();
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
ac -= optind;
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
if (*(av += optind) == NULL)
errx(EX_USAGE, "bad arguments, for usage summary ``ipfw''");
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (!strncmp(*av, "pipe", strlen(*av))) {
do_pipe = 1;
ac--;
av++;
} else if (!strncmp(*av, "queue", strlen(*av))) {
do_pipe = 2;
ac--;
av++;
}
if (!ac)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "pipe requires arguments");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
/* allow argument swapping */
if (ac > 1 && *av[0] >= '0' && *av[0] <= '9') {
char *p = av[0];
av[0] = av[1];
av[1] = p;
Remove coredump when running "ipfw pipe" without more arguments. PR: 8937
1998-12-27 11:23:05 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
if (!strncmp(*av, "add", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
add(ac, av);
} else if (do_pipe && !strncmp(*av, "config", strlen(*av))) {
config_pipe(ac, av);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else if (!strncmp(*av, "delete", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
delete(ac, av);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else if (!strncmp(*av, "flush", strlen(*av))) {
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
int do_flush = 0;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_force || do_quiet)
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
do_flush = 1;
else {
int c;
/* Ask the user */
printf("Are you sure? [yn] ");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
fflush(stdout);
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
do {
c = toupper(getc(stdin));
while (c != '\n' && getc(stdin) != '\n')
if (feof(stdin))
return (0);
} while (c != 'Y' && c != 'N');
printf("\n");
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (c == 'Y')
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
do_flush = 1;
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (do_flush) {
close pr 10889: + add a missing call to dn_rule_delete() when flushing firewall rules, thus preventing possible panics due to dangling pointers (this was already done for single rule deletes). + improve "usage" output in ipfw(8) + add a few checks to ipfw pipe parameters and make it a bit more tolerant of common mistakes (such as specifying kbit instead of Kbit) PR: kern/10889 Submitted by: Ruslan Ermilov
1999-05-24 10:01:22 +00:00
if (setsockopt(s, IPPROTO_IP,
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
do_pipe ? IP_DUMMYNET_FLUSH : IP_FW_FLUSH,
NULL, 0) < 0)
err(EX_UNAVAILABLE, "setsockopt(IP_%s_FLUSH)",
do_pipe ? "DUMMYNET" : "FW");
Add '-q' quiet flag for flush/add/zero commands; add 'show' command as synonym for '-a list'; stop SEGV when specifying 'via' with no interface; change 2 instances of strcpy() to strncpy(). This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
if (!do_quiet)
Spelling corrections for dummynet. Reviewed by: des,luigi
1999-06-02 05:59:48 +00:00
printf("Flushed all %s.\n",
do_pipe ? "pipes" : "rules");
Because 'ipfw flush' is such a dangerous command (given that most firewalls are remote, and this command will kill the network connection to them), prompt the user for confirmation of this command. Also, add the '-f' flag which ignores the need for confirmation the command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0) assume '-f'. If anyone is using ipfw flush in scripts it shouldn't affect them, but you may want to change the script to use a 'ipfw -f flush'. Reviewed by: alex
1996-08-31 17:58:23 +00:00
}
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else if (!strncmp(*av, "zero", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
zero(ac, av);
Make ipfw's logging more dynamic. Now, log will use the default limit _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule.
1999-08-01 16:57:24 +00:00
} else if (!strncmp(*av, "resetlog", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
resetlog(ac, av);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else if (!strncmp(*av, "print", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
list(--ac, ++av);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else if (!strncmp(*av, "list", strlen(*av))) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
list(--ac, ++av);
Add '-q' quiet flag for flush/add/zero commands; add 'show' command as synonym for '-a list'; stop SEGV when specifying 'via' with no interface; change 2 instances of strcpy() to strncpy(). This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
} else if (!strncmp(*av, "show", strlen(*av))) {
do_acct++;
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
list(--ac, ++av);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
} else {
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "bad arguments, for usage summary ``ipfw''");
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Fix address mask calculation when using ':' syntax. Allow a mask of /0 to have the desired effect. Normalize IP addresses that won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24). Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za> Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
return 0;
Latest from Ugen J.S.Antsilevich" <ugen@NetVision.net.il>. Poul, please take this into BETA. Submitted by: ugen
1994-11-16 10:18:18 +00:00
}
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int
main(int ac, char *av[])
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
{
#define MAX_ARGS 32
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
#define WHITESP " \t\f\v\n\r"
Update to match kernel code.
1996-02-24 13:39:46 +00:00
char buf[BUFSIZ];
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
char *a, *p, *args[MAX_ARGS], *cmd = NULL;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
char linename[10];
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
int i, c, lineno, qflag, pflag, status;
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
FILE *f = NULL;
pid_t preproc = 0;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (s < 0)
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
err(EX_UNAVAILABLE, "socket");
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
setbuf(stdout, 0);
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
/*
Update comment to match ipfw/ipfw.c,v 1.95.
2001-04-13 06:49:47 +00:00
* Only interpret the last command line argument as a file to
* be preprocessed if it is specified as an absolute pathname.
Support and document new stateful ipfw features. Approved-by: jordan
2000-02-10 14:25:26 +00:00
*/
Only interpret the last command line argument as a file to be preprocessed if it is specified as an absolute pathname. PR: bin/16179
2000-10-11 12:17:06 +00:00
if (ac > 1 && av[ac - 1][0] == '/' && access(av[ac - 1], R_OK) == 0) {
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
qflag = pflag = i = 0;
A new ipfw program that can set and control the new features. An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
lineno = 0;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
while ((c = getopt(ac, av, "D:U:p:q")) != -1)
switch(c) {
case 'D':
if (!pflag)
errx(EX_USAGE, "-D requires -p");
if (i > MAX_ARGS - 2)
errx(EX_USAGE,
"too many -D or -U options");
args[i++] = "-D";
args[i++] = optarg;
break;
case 'U':
if (!pflag)
errx(EX_USAGE, "-U requires -p");
if (i > MAX_ARGS - 2)
errx(EX_USAGE,
"too many -D or -U options");
args[i++] = "-U";
args[i++] = optarg;
break;
case 'p':
pflag = 1;
cmd = optarg;
args[0] = cmd;
i = 1;
break;
case 'q':
qflag = 1;
break;
default:
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "bad arguments, for usage"
" summary ``ipfw''");
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
}
av += optind;
ac -= optind;
if (ac != 1)
Error messaging in ipfw(8) was out of hand, almost 50 lines of usage information for any command line error, the actual error message almost always (and sometimes irretrievably) lost scrolling off the top of the screen. Now just print the error. Give ipfw(8) no arguments for the old usage summary. Thanks to Lyndon Nerenberg <lyndon@orthanc.ab.ca> for the patch and PR, but I had already done this when ru pointed out the PR. PR: bin/28729 Approved by: ru MFC after: 1 week
2001-07-22 06:40:11 +00:00
errx(EX_USAGE, "extraneous filename arguments");
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
if ((f = fopen(av[0], "r")) == NULL)
err(EX_UNAVAILABLE, "fopen: %s", av[0]);
if (pflag) {
/* pipe through preprocessor (cpp or m4) */
int pipedes[2];
args[i] = 0;
if (pipe(pipedes) == -1)
err(EX_OSERR, "cannot create pipe");
switch((preproc = fork())) {
case -1:
err(EX_OSERR, "cannot fork");
case 0:
/* child */
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (dup2(fileno(f), 0) == -1
|| dup2(pipedes[1], 1) == -1)
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
err(EX_OSERR, "dup2()");
fclose(f);
close(pipedes[1]);
close(pipedes[0]);
execvp(cmd, args);
err(EX_OSERR, "execvp(%s) failed", cmd);
default:
/* parent */
fclose(f);
close(pipedes[1]);
if ((f = fdopen(pipedes[0], "r")) == NULL) {
int savederrno = errno;
(void)kill(preproc, SIGTERM);
errno = savederrno;
err(EX_OSERR, "fdopen()");
}
}
}
while (fgets(buf, BUFSIZ, f)) {
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
lineno++;
sprintf(linename, "Line %d", lineno);
args[0] = linename;
Allow ipfw to accept comments and blank lines. This makes ipfw config files a LOT more readable.
1997-12-05 02:43:26 +00:00
if (*buf == '#')
continue;
When ipfw reads its rules from an input file, the optind variable is not reinitialized to 1 after calling getopt. This results in parsing errors on all but the first rule. An added patch also allows '#' comments at the end of a line. PR: 6379 Reviewed by: phk Submitted by: Neal Fachan <kneel@ishiboo.com>
1998-04-22 06:20:20 +00:00
if ((p = strchr(buf, '#')) != NULL)
*p = '\0';
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
i = 1;
if (qflag)
args[i++] = "-q";
PR: 7475 Added support for -q (suppress output) when firewall rules are taken from a file. Solves PR 7475
1998-08-04 14:41:37 +00:00
for (a = strtok(buf, WHITESP);
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
a && i < MAX_ARGS; a = strtok(NULL, WHITESP), i++)
args[i] = a;
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
if (i == (qflag? 2: 1))
Allow ipfw to accept comments and blank lines. This makes ipfw config files a LOT more readable.
1997-12-05 02:43:26 +00:00
continue;
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description.
1997-06-02 05:02:37 +00:00
if (i == MAX_ARGS)
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
errx(EX_USAGE, "%s: too many arguments",
linename);
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
args[i] = NULL;
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen
1994-10-28 15:06:53 +00:00
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
ipfw_main(i, args);
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
}
fclose(f);
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
if (pflag) {
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
if (waitpid(preproc, &status, 0) == -1)
errx(EX_OSERR, "waitpid()");
if (WIFEXITED(status) && WEXITSTATUS(status) != EX_OK)
errx(EX_UNAVAILABLE,
"preprocessor exited with status %d",
WEXITSTATUS(status));
else if (WIFSIGNALED(status))
errx(EX_UNAVAILABLE,
"preprocessor exited with signal %d",
WTERMSIG(status));
Preprocessor support for `ipfw [-q] ... file'. This allows for more flexible ipfw configuration files using `variables' to describe frequently used items in the file, like the local IP address(es), interface names etc. Both m4 and cpp are useful and supported; with m4 being a little more unusual to the common C programmer, things like automatic rule numbering can be achieved fairly easy. While i was at it, i've also untangled some of the ugly style inside main(), and fixed a bug or two (like not being able to use blank lines when running with -q). A typical call with preprocessor invocation looks like ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
}
Invert the meaning of the -d option (i.e. default to *not* list dynamic rules, but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
2001-06-04 23:56:26 +00:00
} else {
ipfw_main(ac, av);
}
Support listing/showing specific rules supplied on the command line. Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
return EX_OK;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
}
Reference in New Issue Copy Permalink