d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

This commit was generated by cvs2svn to compensate for changes in r23279,

Browse Source 
which included commits to RCS files with non-trunk default branches.
This commit is contained in:
peter 1997-03-02 15:40:21 +00:00
commit 00c85c37dc
13 changed files with 1145 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
contrib/ipfilter/FWTK/Index Normal file
View File

@ -0,0 +1,3 @@
README - Readme for ftp-gw.diff and fwtkp
README.ipfilter - README for fwtk_transparent.diff
fwtk_transparent.diff - patches for 2.0beta

20
contrib/ipfilter/FWTK/README.ipfilter Normal file
View File

@ -0,0 +1,20 @@
there was a patch for fwtk with ip_filter 3.1.5 from James B. Croall
(thanx for his work) which I put onto fwtk 2.0beta.
Now, if you decide to do transparent proxying with ip-filter you
have to put -DUSE_IP_FILTER to COPTS in Makefile.config.
With Solaris 2.x you have to correctly replace the path to your
ip_filter sources. (lib/hnam.c needs ip_nat.h)
I also patched plug-gw to be configured to accept not only one
destination with the parameter "-all-destinations" in netperm-table.
Perhaps this is a security hole...
The patched fwtk worked fine for me with linux (kernel 2.0.28 and ipfadm 2.1)
and Solaris 2.5 (ip_filter 3.1.5).
If you try to enhance the transparent proxy features for other
architectures, see lib/hnam.c (getdsthost).
Michael Kutzner, Michael.Kutzner@paderlinx.de

1025
contrib/ipfilter/FWTK/fwtk_transparent.diff Normal file
View File

File diff suppressed because it is too large Load Diff

9
contrib/ipfilter/HISTORY
View File

@ -5,6 +5,15 @@
# Thanks to Craig Bishop of connect.com.au and Sun Microsystems for the
# loan of a machine to work on a Solaris 2.x port of this software.
#
prevent use of return-rst and return-icmp with rules blocking packets going
out, preventing panics in certain situations.
loop forms in frag cache table - Yury Pshenychny <yura@rd.zgik.zaporizhzhe.ua>
should use SPLNET/SPLX around expire routines in NAT/frag/state code.
redeclared malloc in 44arp.c -
3.1.7 8/2/97 - Released
Macros used for ntohs/htons supplied with gcc don't always work very well

4
contrib/ipfilter/Makefile
View File

@ -5,7 +5,7 @@
# and is not changed in any way. The author accepts no responsibility
# for the use of this software. I hate legaleese, don't you ?
#
# $Id: Makefile,v 2.0.1.4 1997/02/08 06:39:28 darrenr Exp $
# $Id: Makefile,v 2.0.1.5 1997/02/16 06:17:04 darrenr Exp $
#
# where to put things.
#
@ -35,7 +35,7 @@ LOGFAC=-DLOGFAC=LOG_LOCAL0
# results: pass, block and nomatch. This is the sort of "block unless
# explicitly allowed" type #define switch.
#
POLICY=-DNOMATCH=FR_PASS
POLICY=-DIPF_DEFAULT_PASS=FR_PASS
#
MFLAGS="BINDEST=$(BINDEST)" "SBINDEST=$(SBINDEST)" "MANDIR=$(MANDIR)" \
"CC=$(CC)" 'CFLAGS=$(CFLAGS) $(SOLARIS2)' "IPFLKM=$(IPFLKM)" \

70
contrib/ipfilter/fil.c
View File

@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed";
static char rcsid[] = "$Id: fil.c,v 2.0.1.4 1997/02/04 13:59:41 darrenr Exp $";
static char rcsid[] = "$Id: fil.c,v 2.0.1.7 1997/02/18 10:53:47 darrenr Exp $";
#endif
#include <sys/errno.h>
@ -97,10 +97,19 @@ extern int ipl_unreach, ipllog();
# endif
#endif
#ifndef IPF_LOGGING
#define IPF_LOGGING 0
#endif
#ifdef IPF_DEFAULT_PASS
#define IPF_NOMATCH (IPF_DEFAULT_PASS|FR_NOMATCH)
#else
#define IPF_NOMATCH (FR_NOMATCH)
#endif
struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
*ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } };
int fr_flags = 0, fr_active = 0;
int fr_flags = IPF_LOGGING, fr_active = 0;
fr_info_t frcache[2];
@ -573,16 +582,12 @@ int out;
frstats[out].fr_chit++;
pass = fin->fin_fr->fr_flags;
} else {
pass = FR_NOMATCH;
pass = IPF_NOMATCH;
if ((fin->fin_fr = ipfilter[out][fr_active]))
pass = FR_SCANLIST(FR_NOMATCH, ip, fin, m);
pass = FR_SCANLIST(IPF_NOMATCH, ip, fin, m);
bcopy((char *)fin, (char *)fc, FI_CSIZE);
if (pass & FR_NOMATCH) {
if (pass & FR_NOMATCH)
frstats[out].fr_nom++;
#ifdef NOMATCH
pass |= NOMATCH;
#endif
}
}
fr = fin->fin_fr;
@ -651,34 +656,40 @@ int out;
/*
* Should we return an ICMP packet to indicate error
* status passing through the packet filter ?
* WARNING: ICMP error packets AND TCP RST packets should
* ONLY be sent in repsonse to incoming packets. Sending them
* in response to outbound packets can result in a panic on
* some operating systems.
*/
if (!out) {
#ifdef _KERNEL
if (pass & FR_RETICMP) {
if (pass & FR_RETICMP) {
# if SOLARIS
ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
qif, ip->ip_src);
ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
qif, ip->ip_src);
# else
ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
ifp, ip->ip_src);
m = NULL; /* freed by icmp_error() */
ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
ifp, ip->ip_src);
m = *mp = NULL; /* freed by icmp_error() */
# endif
frstats[0].fr_ret++;
} else if ((pass & FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
if (SEND_RESET(ip, qif, q) == 0)
frstats[1].fr_ret++;
}
frstats[0].fr_ret++;
} else if ((pass & FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
if (SEND_RESET(ip, qif, q) == 0)
frstats[1].fr_ret++;
}
#else
if (pass & FR_RETICMP) {
verbose("- ICMP unreachable sent\n");
frstats[0].fr_ret++;
} else if ((pass & FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
verbose("- TCP RST sent\n");
frstats[1].fr_ret++;
}
if (pass & FR_RETICMP) {
verbose("- ICMP unreachable sent\n");
frstats[0].fr_ret++;
} else if ((pass & FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
verbose("- TCP RST sent\n");
frstats[1].fr_ret++;
}
#endif
}
}
#ifdef _KERNEL
# if !SOLARIS
@ -691,7 +702,6 @@ int out;
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
ipfr_fastroute(m, fin, fdp);
m = *mp = NULL;
pass = 0;
}
if (mc)
ipfr_fastroute(mc, fin, &fr->fr_dif);

8
contrib/ipfilter/ip_fil.c
View File

@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed";
static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.5 1997/01/29 13:41:45 darrenr Exp $";
static char rcsid[] = "$Id: ip_fil.c,v 2.0.1.7 1997/02/19 12:45:02 darrenr Exp $";
#endif
#include <sys/errno.h>
@ -70,7 +70,7 @@ static int iplused = 0;
#endif /* IPFILTER_LOG */
static void frflush();
static int frrequest();
static int (*fr_savep)();
static int (*fr_savep)() = NULL;
#if _BSDI_VERSION >= 199501
# include <sys/device.h>
@ -732,6 +732,9 @@ frdest_t *fdp;
dst = (struct sockaddr_in *)&ro->ro_dst;
dst->sin_family = AF_INET;
dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
#ifdef __bsdi__
dst->sin_len = sizeof(*dst);
#endif
#if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__)
# ifdef RTF_CLONING
rtalloc_ign(ro, RTF_CLONING);
@ -780,7 +783,6 @@ frdest_t *fdp;
#if BSD >= 199306
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
ro->ro_rt);
#else
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
#endif

3
contrib/ipfilter/ip_frag.c
View File

@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-1995 Darren Reed";
static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.1 1997/01/09 15:14:43 darrenr Exp $";
static char rcsid[] = "$Id: ip_frag.c,v 2.0.1.2 1997/02/16 06:17:35 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@ -127,7 +127,6 @@ int pass;
fr->ipfr_ttl = fr_ipfrttl;
fr->ipfr_pass = pass & ~(FR_LOGFIRST|FR_LOG);
fr->ipfr_off = (ip->ip_off & 0x1fff) + (fin->fin_dlen >> 3);
*fp = fr;
ipfr_stats.ifs_new++;
ipfr_inuse++;
MUTEX_EXIT(&ipf_frag);

21
contrib/ipfilter/ip_nat.c
View File

@ -9,7 +9,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.10 1997/02/08 06:38:49 darrenr Exp $";
static char rcsid[] = "$Id: ip_nat.c,v 2.0.1.11 1997/02/16 06:26:47 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@ -155,12 +155,13 @@ int cmd, mode;
{
register ipnat_t *nat, *n = NULL, **np = NULL;
ipnat_t natd;
int error = 0, ret;
int error = 0, ret, s;
/*
* For add/delete, look to see if the NAT entry is already present
*/
MUTEX_ENTER(&ipf_nat);
SPLNET(s);
if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
IRCOPY(data, (char *)&natd, sizeof(natd));
nat = &natd;
@ -260,6 +261,7 @@ int cmd, mode;
IWCOPY((caddr_t)&ret, data, sizeof(ret));
break;
}
SPLX(s);
MUTEX_EXIT(&ipf_nat);
return error;
}
@ -857,11 +859,13 @@ fr_info_t *fin;
*/
void ip_natunload()
{
MUTEX_ENTER(&ipf_nat);
int s;
MUTEX_ENTER(&ipf_nat);
SPLNET(s);
(void) clear_natlist();
(void) flush_nattable();
SPLX(s)
MUTEX_EXIT(&ipf_nat);
}
@ -873,14 +877,19 @@ void ip_natunload()
void ip_natexpire()
{
register struct nat *nat, **natp;
int s;
MUTEX_ENTER(&ipf_nat);
for (natp = &nat_instances; (nat = *natp); natp = &nat->nat_next) {
if (--nat->nat_age)
SPLNET(s);
for (natp = &nat_instances; (nat = *natp); ) {
if (--nat->nat_age) {
natp = &nat->nat_next;
continue;
}
*natp = nat->nat_next;
nat_delete(nat);
nat_stats.ns_expire++;
}
SPLX(s);
MUTEX_EXIT(&ipf_nat);
}

8
contrib/ipfilter/ip_state.c
View File

@ -7,7 +7,7 @@
*/
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed";
static char rcsid[] = "$Id: ip_state.c,v 2.0.1.2 1997/01/09 15:22:45 darrenr Exp $";
static char rcsid[] = "$Id: ip_state.c,v 2.0.1.3 1997/02/16 06:18:36 darrenr Exp $";
#endif
#if !defined(_KERNEL) && !defined(KERNEL)
@ -411,13 +411,16 @@ void fr_stateunload()
{
register int i;
register ipstate_t *is, **isp;
int s;
MUTEX_ENTER(&ipf_state);
SPLNET(s);
for (i = 0; i < IPSTATE_SIZE; i++)
for (isp = &ips_table[i]; (is = *isp); ) {
*isp = is->is_next;
KFREE(is);
}
SPLX(s);
MUTEX_EXIT(&ipf_state);
}
@ -430,8 +433,10 @@ void fr_timeoutstate()
{
register int i;
register ipstate_t *is, **isp;
int s;
MUTEX_ENTER(&ipf_state);
SPLNET(s);
for (i = 0; i < IPSTATE_SIZE; i++)
for (isp = &ips_table[i]; (is = *isp); )
if (is->is_age && !--is->is_age) {
@ -444,6 +449,7 @@ void fr_timeoutstate()
ips_num--;
} else
isp = &is->is_next;
SPLX(s);
MUTEX_EXIT(&ipf_state);
}

10
contrib/ipfilter/ipnat.c
View File

@ -51,7 +51,7 @@
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
static char rcsid[] = "$Id: ipnat.c,v 2.0.1.7 1997/01/30 12:02:32 darrenr Exp $";
static char rcsid[] = "$Id: ipnat.c,v 2.0.1.8 1997/02/16 21:23:40 darrenr Exp $";
#endif
#if SOLARIS
@ -190,7 +190,7 @@ void *ptr;
printf(" udp");
printf("\n");
if (verbose)
printf("\t%x %u %x %u %x %d\n", (u_int)np->in_ifp,
printf("\t%p %u %x %u %x %d\n", (u_int)np->in_ifp,
np->in_space, np->in_flags, np->in_pnext, np,
np->in_use);
} else {
@ -220,7 +220,7 @@ void *ptr;
}
printf("\n");
if (verbose)
printf("\t%x %u %s %d %x\n", (u_int)np->in_ifp,
printf("\t%p %u %s %d %x\n", (u_int)np->in_ifp,
np->in_space, inet_ntoa(np->in_nextip),
np->in_pnext, np->in_flags);
}
@ -264,7 +264,7 @@ int fd, opts;
ns.ns_added, ns.ns_expire);
printf("inuse\t%lu\n", ns.ns_inuse);
if (opts & OPT_VERBOSE)
printf("table %#x list %#x\n",
printf("table %p list %p\n",
(u_int)ns.ns_table, (u_int)ns.ns_list);
}
if (opts & OPT_LIST) {
@ -384,7 +384,7 @@ int *resolved;
struct netent *np;
*resolved = 0;
if (!strcasecmp("any",host))
if (!strcasecmp("any", host))
return 0L;
if (isdigit(*host))
return inet_addr(host);

2
contrib/ipfilter/ipsend/44arp.c
View File

@ -52,7 +52,7 @@ char *addr, *eaddr;
{
int mib[6];
size_t needed;
char *malloc(), *lim, *buf, *next;
char *lim, *buf, *next;
struct rt_msghdr *rtm;
struct sockaddr_inarp *sin;
struct sockaddr_dl *sdl;

15
contrib/ipfilter/parse.c
View File

@ -33,7 +33,7 @@
#if !defined(lint) && defined(LIBC_SCCS)
static char sccsid[] ="@(#)parse.c 1.44 6/5/96 (C) 1993-1996 Darren Reed";
static char rcsid[] = "$Id: parse.c,v 2.0.1.1 1997/01/09 15:14:44 darrenr Exp $";
static char rcsid[] = "$Id: parse.c,v 2.0.1.2 1997/02/17 13:59:44 darrenr Exp $";
#endif
extern struct ipopt_names ionames[], secclass[];
@ -143,9 +143,18 @@ char *line;
}
cpp++;
if (!strcasecmp("in", *cpp))
if (!strcasecmp("in", *cpp)) {
fil.fr_flags |= FR_INQUE;
else if (!strcasecmp("out", *cpp))
if (fil.fr_flags & FR_RETICMP) {
(void)fprintf(stderr,
"Can only use return-icmp with 'in'\n");
return NULL;
} else if (fil.fr_flags & FR_RETRST) {
(void)fprintf(stderr,
"Can only use return-rst with 'in'\n");
return NULL;
}
} else if (!strcasecmp("out", *cpp))
fil.fr_flags |= FR_OUTQUE;
else {
(void)fprintf(stderr,