Added new option (-punch_fw) which allows to `punch holes'
in the ipfirewall(4) for incoming FTP/IRC DCC connections. Submitted by: Rene de Vries <rene@canyon.demon.nl> Rewritten by: ru
This commit is contained in:
parent
36e6576b44
commit
bc4ebb98dc
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=62160
@ -29,6 +29,7 @@
|
|||||||
.Op Fl config | f Ar configfile
|
.Op Fl config | f Ar configfile
|
||||||
.Op Fl log_denied
|
.Op Fl log_denied
|
||||||
.Op Fl log_facility Ar facility_name
|
.Op Fl log_facility Ar facility_name
|
||||||
|
.Op Fl punch_fw Ar firewall_range
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
This program provides a Network Address Translation facility for use
|
This program provides a Network Address Translation facility for use
|
||||||
with
|
with
|
||||||
@ -412,6 +413,25 @@ Use
|
|||||||
to put this information into the IP option field or
|
to put this information into the IP option field or
|
||||||
.Ar encode_tcp_stream
|
.Ar encode_tcp_stream
|
||||||
to inject the data into the beginning of the TCP stream.
|
to inject the data into the beginning of the TCP stream.
|
||||||
|
.It Fl punch_fw Xo
|
||||||
|
.Ar basenumber Ns : Ns Ar count
|
||||||
|
.Xc
|
||||||
|
This option makes
|
||||||
|
.Nm
|
||||||
|
.Ql punch holes
|
||||||
|
in an
|
||||||
|
.Xr ipfirewall 4
|
||||||
|
based firewall for FTP/IRC DCC connections.
|
||||||
|
The holes punched are bound by from/to IP address and port; it
|
||||||
|
will not be possible to use a hole for another connection.
|
||||||
|
A hole is removed when the connection that uses it dies.
|
||||||
|
.Pp
|
||||||
|
Arguments
|
||||||
|
.Ar basenumber
|
||||||
|
and
|
||||||
|
.Ar count
|
||||||
|
set the firewall range allocated for punching firewall holes.
|
||||||
|
The range will be cleared for all rules on startup.
|
||||||
.El
|
.El
|
||||||
.Sh RUNNING NATD
|
.Sh RUNNING NATD
|
||||||
The following steps are necessary before attempting to run
|
The following steps are necessary before attempting to run
|
||||||
|
@ -98,6 +98,7 @@ static int StrToProto (const char* str);
|
|||||||
static int StrToAddrAndPortRange (const char* str, struct in_addr* addr, char* proto, port_range *portRange);
|
static int StrToAddrAndPortRange (const char* str, struct in_addr* addr, char* proto, port_range *portRange);
|
||||||
static void ParseArgs (int argc, char** argv);
|
static void ParseArgs (int argc, char** argv);
|
||||||
static void FlushPacketBuffer (int fd);
|
static void FlushPacketBuffer (int fd);
|
||||||
|
static void SetupPunchFW(const char *strValue);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Globals.
|
* Globals.
|
||||||
@ -868,7 +869,8 @@ enum Option {
|
|||||||
DynamicMode,
|
DynamicMode,
|
||||||
ProxyRule,
|
ProxyRule,
|
||||||
LogDenied,
|
LogDenied,
|
||||||
LogFacility
|
LogFacility,
|
||||||
|
PunchFW
|
||||||
};
|
};
|
||||||
|
|
||||||
enum Param {
|
enum Param {
|
||||||
@ -1078,8 +1080,15 @@ static struct OptionInfo optionTable[] = {
|
|||||||
"facility",
|
"facility",
|
||||||
"name of syslog facility to use for logging",
|
"name of syslog facility to use for logging",
|
||||||
"log_facility",
|
"log_facility",
|
||||||
NULL }
|
NULL },
|
||||||
|
|
||||||
|
{ PunchFW,
|
||||||
|
0,
|
||||||
|
String,
|
||||||
|
"basenumber:count",
|
||||||
|
"punch holes in the firewall for incoming FTP/IRC DCC connections",
|
||||||
|
"punch_fw",
|
||||||
|
NULL }
|
||||||
};
|
};
|
||||||
|
|
||||||
static void ParseOption (const char* option, const char* parms)
|
static void ParseOption (const char* option, const char* parms)
|
||||||
@ -1259,6 +1268,10 @@ static void ParseOption (const char* option, const char* parms)
|
|||||||
errx(1, "Unknown log facility name: %s", strValue);
|
errx(1, "Unknown log facility name: %s", strValue);
|
||||||
|
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case PunchFW:
|
||||||
|
SetupPunchFW(strValue);
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1687,3 +1700,15 @@ int StrToAddrAndPortRange (const char* str, struct in_addr* addr, char* proto, p
|
|||||||
StrToAddr (str, addr);
|
StrToAddr (str, addr);
|
||||||
return StrToPortRange (ptr, proto, portRange);
|
return StrToPortRange (ptr, proto, portRange);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
SetupPunchFW(const char *strValue)
|
||||||
|
{
|
||||||
|
unsigned int base, num;
|
||||||
|
|
||||||
|
if (sscanf(strValue, "%u:%u", &base, &num) != 2)
|
||||||
|
errx(1, "punch_fw: basenumber:count parameter required");
|
||||||
|
|
||||||
|
PacketAliasSetFWBase(base, num);
|
||||||
|
(void)PacketAliasSetMode(PKT_ALIAS_PUNCH_FW, PKT_ALIAS_PUNCH_FW);
|
||||||
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user