Import IPFilter version 3.4.20
This commit is contained in:
parent
dd298e2f03
commit
dba82da1c8
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/vendor/ipfilter/dist/; revision=80486
@ -17,7 +17,7 @@ log = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
|
||||
call = "call" [ "now" ] function-name .
|
||||
skip = "skip" decnumber .
|
||||
dup = "dup-to" interface-name[":"ipaddr] .
|
||||
froute = "fastroute" | "to" interface-name .
|
||||
froute = "fastroute" | "to" interface-name [ ":" ipaddr ] .
|
||||
protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
|
||||
srcdst = "all" | fromto .
|
||||
fromto = "from" object "to" object .
|
||||
|
@ -22,6 +22,121 @@
|
||||
# and especially those who have found the time to port IP Filter to new
|
||||
# platforms.
|
||||
#
|
||||
3.4.20 24/07/2001 - Released
|
||||
|
||||
adjust NAT hashing to give a better spread across the table
|
||||
|
||||
show icmp code/type names in output, where known
|
||||
|
||||
fix bug in altering cached interface names in state when resync'ing
|
||||
|
||||
fix bug in real audio proxy that caused crashs
|
||||
|
||||
fix compiling using sunos4 cc
|
||||
|
||||
patch from casper to address weird exit problem for ipstat in top mode
|
||||
|
||||
patch from Greg Woods to produce names for icmp types/unreach codes,
|
||||
where they are known
|
||||
|
||||
fix bug where ipfr_fastroute() would use a mblk and it would also get
|
||||
freed later.
|
||||
|
||||
don't match fragments which would cause 64k length to be exceeded
|
||||
|
||||
ftp proxy fix for port numbers being setup for pasv ftp with state/nat
|
||||
|
||||
change hashing for NAT to include both IP#'s and ports.
|
||||
|
||||
Solaris fixes for IPv6
|
||||
|
||||
fix compiling iplang bits, under Solaris, for ipsend
|
||||
|
||||
3.4.19 29/06/2001 - Released
|
||||
|
||||
fix to support suspend/resume on solaris8 as well as ipv6
|
||||
|
||||
include group/group-head in match of filter rules
|
||||
|
||||
fix endian problem reading snoop files
|
||||
|
||||
make all licence comments point to the one place
|
||||
|
||||
fix ftp proxy to only advance state if a reply is received in response to
|
||||
a recognised command
|
||||
|
||||
3.4.18 05/06/2001 - Released
|
||||
|
||||
fix up parsing of "from ! host" where '!' is separate
|
||||
|
||||
disable hardware checksums for NetBSD
|
||||
|
||||
put ipftest temporary files in . rather than /tmp
|
||||
|
||||
modify ftp proxy to be more intelligent about moving between states
|
||||
and recognise new authentication commands
|
||||
|
||||
allow state/nat table sizes to be externally influenced
|
||||
|
||||
print out host mapping table for NAT with ipnat -l
|
||||
|
||||
fix handling of hardware checksum'ing on Solaris
|
||||
|
||||
fixup makefiles for Solaris
|
||||
|
||||
update regression tests
|
||||
|
||||
fix surrender of SPL's for failure cases
|
||||
|
||||
include patches for OpenBSD's new timeout mechanism
|
||||
|
||||
default ipl_unreach to ICMP_UNREACH_FILTER_PROHIB if defined, else make it
|
||||
ICMP_UNREACH_FILTER
|
||||
|
||||
fix up handling of packets matching auth rules and interaction with state
|
||||
|
||||
add -q command line option to ipfstat on Solaris to list bound interfaces
|
||||
|
||||
add command line option to ipfstat/ipnat to select different core image
|
||||
|
||||
don't use ncurses on Solaris for STATETOP
|
||||
|
||||
fix includes to get FreeBSD version
|
||||
|
||||
do not byte swap ip_id
|
||||
|
||||
fix handling success for packets matching the auth rule
|
||||
|
||||
don't double-count short packets
|
||||
|
||||
add ICMP router discovery message size recognition
|
||||
|
||||
fix packet length calculation for IPv6
|
||||
|
||||
set CPUDIR when for install-sunos5 make target
|
||||
|
||||
SUNWspro -xF causes Solaris 2.5.1 kernel to crash
|
||||
|
||||
3.4.17 06/04/2001 - Released
|
||||
|
||||
fix fragment#0 handling bug where they could get in via cache information
|
||||
created by state table entries
|
||||
|
||||
use ire_walk to look for ire cache entries with link layer headers cached
|
||||
|
||||
deal with bad SPL assumptions for log reading on BSD
|
||||
|
||||
fix ftp proxy to allow logins with passwords
|
||||
|
||||
some auth rule patches, fixing byte endian problems and returning as an error
|
||||
|
||||
support LOG_SECURITY, where available, in ipmon
|
||||
|
||||
don't return an error for packets which match auth rules
|
||||
|
||||
introduce fr_icmpacktimeout to timeout entries once an ICMP reply has
|
||||
been seen separately to when created
|
||||
|
||||
3.4.16 15/01/2001 - Released
|
||||
|
||||
fix race condition in flushing of state entries that are timing out
|
||||
|
@ -3,41 +3,6 @@
|
||||
****************************************
|
||||
1)
|
||||
|
||||
If you're using this software and have a rule which ends like this:
|
||||
|
||||
flags S
|
||||
|
||||
(for TCP), then to make it totally effective, you need to change it to appear
|
||||
as follows:
|
||||
|
||||
flags S/SA
|
||||
|
||||
The problem is that the old code would compare all the TCP flags against the
|
||||
rule (which just has "S") to see if that matched exactly. It is very possible
|
||||
for this to not be the case and in these cases, the rule would fail to match
|
||||
a 'valid' TCP SYN packet.
|
||||
|
||||
Why does it need to be "S/SA" and not "S/S" ?
|
||||
|
||||
"S/S" will match the SYN-ACK as well the SYN.
|
||||
|
||||
By defalt, "flags S" will now be converted to "flags S/AUPRFS".
|
||||
|
||||
If you have any queries regarding this, see the examples and ipf(4).
|
||||
If you still have a query or suggestion, please email me.
|
||||
|
||||
|
||||
2)
|
||||
|
||||
If a filter rule used, in combination port comparisons and the flags
|
||||
keywords, a "short" TCP packet, if not explicitly blocked high up in
|
||||
the list of packets, would actually get matched even though it would
|
||||
otherwise not have been (due to the ports not). This behaviour has
|
||||
subsequently been fixed.
|
||||
|
||||
|
||||
3)
|
||||
|
||||
If you have BOTH GNU make and the normal make shipped with your system,
|
||||
DO NOT use the GNU make to build this package.
|
||||
|
||||
|
@ -1,11 +1,9 @@
|
||||
#
|
||||
# Copyright (C) 1993-2000 by Darren Reed.
|
||||
# Copyright (C) 1993-2001 by Darren Reed.
|
||||
#
|
||||
# Redistribution and use in source and binary forms are permitted
|
||||
# provided that this notice is preserved and due credit is given
|
||||
# to the original author and the contributors.
|
||||
# See the IPFILTER.LICENCE file for details on licencing.
|
||||
#
|
||||
# $Id: Makefile,v 2.11.2.6 2000/12/17 12:43:15 darrenr Exp $
|
||||
# $Id: Makefile,v 2.11.2.8 2001/06/26 10:43:10 darrenr Exp $
|
||||
#
|
||||
BINDEST=/usr/local/bin
|
||||
SBINDEST=/sbin
|
||||
@ -19,6 +17,7 @@ TOP=../..
|
||||
CFLAGS=-I$$(TOP)
|
||||
CPU=`uname -m`
|
||||
CPUDIR=`uname -s|sed -e 's@/@@g'`-`uname -r`-`uname -m`
|
||||
IPFILKERN=`/bin/ls -1tr /usr/src/sys/compile | grep -v .bak | tail -1`
|
||||
#
|
||||
# To enable this to work as a Loadable Kernel Module...
|
||||
#
|
||||
@ -262,7 +261,7 @@ install-sunos4: solaris
|
||||
(cd SunOS4; $(MAKE) "CPU=$(CPU) TOP=.." install)
|
||||
|
||||
install-sunos5: solaris
|
||||
(cd SunOS5; $(MAKE) "CPU=$(CPU) TOP=.." install)
|
||||
(cd SunOS5; $(MAKE) "CPUDIR=`uname -p`-`uname -r`" "CPU=$(CPU) TOP=.." install)
|
||||
|
||||
install-irix: irix
|
||||
(cd IRIX; smake install "CPU=$(CPU) TOP=.." $(DEST) $(MFLAGS))
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <sys/types.h>
|
||||
#if !defined(__SVR4) && !defined(__svr4__)
|
||||
|
@ -2360,6 +2360,7 @@ dpserve 7020/udp # DP Serve
|
||||
dpserveadmin 7021/tcp # DP Serve Admin
|
||||
dpserveadmin 7021/udp # DP Serve Admin
|
||||
arcp 7070/tcp # ARCP
|
||||
raudio 7070/tcp # Real Audio
|
||||
arcp 7070/udp # ARCP
|
||||
clutild 7174/tcp # Clutild
|
||||
clutild 7174/udp # Clutild
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@ -18,8 +16,12 @@
|
||||
#include <syslog.h>
|
||||
#include "facpri.h"
|
||||
|
||||
#ifndef __STDC__
|
||||
# define const
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3 2000/03/13 22:10:18 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: facpri.c,v 1.3.2.4 2001/07/15 22:06:12 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
typedef struct table {
|
||||
@ -54,6 +56,9 @@ table_t facs[] = {
|
||||
{ "cron", LOG_CRON2 },
|
||||
#else
|
||||
{ "cron2", LOG_CRON2 },
|
||||
#endif
|
||||
#ifdef LOG_SECURITY
|
||||
{ "security", LOG_SECURITY },
|
||||
#endif
|
||||
{ "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 },
|
||||
{ "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 },
|
||||
|
@ -1,10 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1999-2000 by Darren Reed.
|
||||
* Copyright (C) 1999-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* $Id: facpri.h,v 1.3 2000/03/13 22:10:18 darrenr Exp $
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
* $Id: facpri.h,v 1.3.2.1 2001/06/26 10:43:11 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __FACPRI_H__
|
||||
|
@ -1,15 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#include <sys/errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
@ -100,6 +93,11 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darr
|
||||
#endif
|
||||
#include "netinet/ipl.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#ifndef _KERNEL
|
||||
# include "ipf.h"
|
||||
# include "ipt.h"
|
||||
@ -115,12 +113,6 @@ extern int opts;
|
||||
# if SOLARIS || defined(__sgi)
|
||||
extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
|
||||
extern kmutex_t ipf_rw;
|
||||
# endif
|
||||
# if SOLARIS
|
||||
# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \
|
||||
ip, qif)
|
||||
# else /* SOLARIS */
|
||||
# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
|
||||
# endif /* SOLARIS || __sgi */
|
||||
#endif /* _KERNEL */
|
||||
|
||||
@ -226,7 +218,7 @@ fr_info_t *fin;
|
||||
if (v == 4) {
|
||||
fin->fin_id = ip->ip_id;
|
||||
fi->fi_tos = ip->ip_tos;
|
||||
off = (ip->ip_off & IP_OFFMASK) << 3;
|
||||
off = (ip->ip_off & IP_OFFMASK);
|
||||
tcp = (tcphdr_t *)((char *)ip + hlen);
|
||||
(*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
|
||||
fi->fi_src.i6[1] = 0;
|
||||
@ -239,7 +231,7 @@ fr_info_t *fin;
|
||||
fi->fi_daddr = ip->ip_dst.s_addr;
|
||||
p = ip->ip_p;
|
||||
fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
|
||||
if (ip->ip_off & 0x3fff)
|
||||
if (ip->ip_off & (IP_MF|IP_OFFMASK))
|
||||
fi->fi_fl |= FI_FRAG;
|
||||
plen = ip->ip_len;
|
||||
fin->fin_dlen = plen - hlen;
|
||||
@ -260,6 +252,7 @@ fr_info_t *fin;
|
||||
fi->fi_fl = 0;
|
||||
plen = ntohs(ip6->ip6_plen);
|
||||
fin->fin_dlen = plen;
|
||||
plen += sizeof(*ip6);
|
||||
}
|
||||
#endif
|
||||
else
|
||||
@ -268,6 +261,7 @@ fr_info_t *fin;
|
||||
fin->fin_off = off;
|
||||
fin->fin_plen = plen;
|
||||
fin->fin_dp = (void *)tcp;
|
||||
off <<= 3;
|
||||
|
||||
switch (p)
|
||||
{
|
||||
@ -315,25 +309,34 @@ fr_info_t *fin;
|
||||
|
||||
icmp = (icmphdr_t *)tcp;
|
||||
|
||||
if (icmp->icmp_type == ICMP_ECHOREPLY ||
|
||||
icmp->icmp_type == ICMP_ECHO)
|
||||
switch (icmp->icmp_type)
|
||||
{
|
||||
case ICMP_ECHOREPLY :
|
||||
case ICMP_ECHO :
|
||||
/* Router discovery messages - RFC 1256 */
|
||||
case ICMP_ROUTERADVERT :
|
||||
case ICMP_ROUTERSOLICIT :
|
||||
minicmpsz = ICMP_MINLEN;
|
||||
|
||||
break;
|
||||
/*
|
||||
* type(1) + code(1) + cksum(2) + id(2) seq(2) +
|
||||
* 3*timestamp(3*4)
|
||||
*/
|
||||
else if (icmp->icmp_type == ICMP_TSTAMP ||
|
||||
icmp->icmp_type == ICMP_TSTAMPREPLY)
|
||||
case ICMP_TSTAMP :
|
||||
case ICMP_TSTAMPREPLY :
|
||||
minicmpsz = 20;
|
||||
|
||||
break;
|
||||
/*
|
||||
* type(1) + code(1) + cksum(2) + id(2) seq(2) +
|
||||
* mask(4)
|
||||
*/
|
||||
else if (icmp->icmp_type == ICMP_MASKREQ ||
|
||||
icmp->icmp_type == ICMP_MASKREPLY)
|
||||
case ICMP_MASKREQ :
|
||||
case ICMP_MASKREPLY :
|
||||
minicmpsz = 12;
|
||||
break;
|
||||
default :
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if ((!(plen >= hlen + minicmpsz) && !off) ||
|
||||
@ -522,7 +525,7 @@ fr_info_t *fin;
|
||||
* satisfy the "short" class too).
|
||||
*/
|
||||
if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
|
||||
if (fin->fin_fi.fi_fl & FI_SHORT)
|
||||
if (fin->fin_fl & FI_SHORT)
|
||||
return !(ft->ftu_tcpf | ft->ftu_tcpfm);
|
||||
/*
|
||||
* Match the flags ? If not, abort this match.
|
||||
@ -557,10 +560,7 @@ void *m;
|
||||
fin->fin_fr = NULL;
|
||||
fin->fin_rule = 0;
|
||||
fin->fin_group = 0;
|
||||
if (fin->fin_v == 4)
|
||||
off = ip->ip_off & IP_OFFMASK;
|
||||
else
|
||||
off = 0;
|
||||
off = fin->fin_off;
|
||||
pass |= (fi->fi_fl << 24);
|
||||
|
||||
if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
|
||||
@ -787,7 +787,7 @@ int out;
|
||||
mb_t *mc = NULL;
|
||||
# if !defined(__SVR4) && !defined(__svr4__)
|
||||
# ifdef __sgi
|
||||
char hbuf[(0xf << 2) + sizeof(struct icmp) + sizeof(ip_t) + 8];
|
||||
char hbuf[128];
|
||||
# endif
|
||||
int up;
|
||||
|
||||
@ -812,6 +812,9 @@ int out;
|
||||
# ifdef USE_INET6
|
||||
if (v == 6) {
|
||||
len = ntohs(((ip6_t*)ip)->ip6_plen);
|
||||
if (!len)
|
||||
return -1; /* potential jumbo gram */
|
||||
len += sizeof(ip6_t);
|
||||
p = ((ip6_t *)ip)->ip6_nxt;
|
||||
} else
|
||||
# endif
|
||||
@ -820,7 +823,8 @@ int out;
|
||||
len = ip->ip_len;
|
||||
}
|
||||
|
||||
if ((p == IPPROTO_TCP || p == IPPROTO_UDP || p == IPPROTO_ICMP
|
||||
if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
|
||||
(v == 4 && p == IPPROTO_ICMP)
|
||||
# ifdef USE_INET6
|
||||
|| (v == 6 && p == IPPROTO_ICMPV6)
|
||||
# endif
|
||||
@ -889,13 +893,6 @@ int out;
|
||||
# endif
|
||||
#endif /* _KERNEL */
|
||||
|
||||
/*
|
||||
* Be careful here: ip_id is in network byte order when called
|
||||
* from ip_output()
|
||||
*/
|
||||
if ((out) && (v == 4))
|
||||
ip->ip_id = ntohs(ip->ip_id);
|
||||
|
||||
changed = 0;
|
||||
fin->fin_ifp = ifp;
|
||||
fin->fin_v = v;
|
||||
@ -940,15 +937,12 @@ int out;
|
||||
}
|
||||
#endif
|
||||
pass = fr_pass;
|
||||
if (fin->fin_fi.fi_fl & FI_SHORT) {
|
||||
if (fin->fin_fl & FI_SHORT) {
|
||||
ATOMIC_INCL(frstats[out].fr_short);
|
||||
}
|
||||
|
||||
READ_ENTER(&ipf_mutex);
|
||||
|
||||
if (fin->fin_fi.fi_fl & FI_SHORT)
|
||||
ATOMIC_INCL(frstats[out].fr_short);
|
||||
|
||||
/*
|
||||
* Check auth now. This, combined with the check below to see if apass
|
||||
* is 0 is to ensure that we don't count the packet twice, which can
|
||||
@ -972,8 +966,18 @@ int out;
|
||||
}
|
||||
}
|
||||
|
||||
if (apass || (!(fr = ipfr_knownfrag(ip, fin)) &&
|
||||
!(fr = fr_checkstate(ip, fin)))) {
|
||||
if (!apass) {
|
||||
if ((fin->fin_fl & FI_FRAG) == FI_FRAG)
|
||||
fr = ipfr_knownfrag(ip, fin);
|
||||
if (!fr && !(fin->fin_fl & FI_SHORT))
|
||||
fr = fr_checkstate(ip, fin);
|
||||
if (fr != NULL)
|
||||
pass = fr->fr_flags;
|
||||
if (fr && (pass & FR_LOGFIRST))
|
||||
pass &= ~(FR_LOGFIRST|FR_LOG);
|
||||
}
|
||||
|
||||
if (apass || !fr) {
|
||||
/*
|
||||
* If a packet is found in the auth table, then skip checking
|
||||
* the access lists for permission but we do need to consider
|
||||
@ -1008,22 +1012,26 @@ int out;
|
||||
ATOMIC_INCL(frstats[out].fr_nom);
|
||||
}
|
||||
}
|
||||
fr = fin->fin_fr;
|
||||
} else
|
||||
pass = apass;
|
||||
fr = fin->fin_fr;
|
||||
|
||||
/*
|
||||
* If we fail to add a packet to the authorization queue,
|
||||
* then we drop the packet later. However, if it was added
|
||||
* then pretend we've dropped it already.
|
||||
*/
|
||||
if ((pass & FR_AUTH))
|
||||
if (fr_newauth((mb_t *)m, fin, ip) != 0)
|
||||
if ((pass & FR_AUTH)) {
|
||||
if (fr_newauth((mb_t *)m, fin, ip) != 0) {
|
||||
#ifdef _KERNEL
|
||||
m = *mp = NULL;
|
||||
#else
|
||||
;
|
||||
#endif
|
||||
error = 0;
|
||||
} else
|
||||
error = ENOSPC;
|
||||
}
|
||||
|
||||
if (pass & FR_PREAUTH) {
|
||||
READ_ENTER(&ipf_auth);
|
||||
@ -1038,7 +1046,7 @@ int out;
|
||||
|
||||
fin->fin_fr = fr;
|
||||
if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
|
||||
if (fin->fin_fi.fi_fl & FI_FRAG) {
|
||||
if (fin->fin_fl & FI_FRAG) {
|
||||
if (ipfr_newfrag(ip, fin, pass) == -1) {
|
||||
ATOMIC_INCL(frstats[out].fr_bnfr);
|
||||
} else {
|
||||
@ -1116,9 +1124,6 @@ int out;
|
||||
}
|
||||
#endif /* IPFILTER_LOG */
|
||||
|
||||
if ((out) && (v == 4))
|
||||
ip->ip_id = htons(ip->ip_id);
|
||||
|
||||
#ifdef _KERNEL
|
||||
/*
|
||||
* Only allow FR_DUP to work if a rule matched - it makes no sense to
|
||||
@ -1160,7 +1165,7 @@ int out;
|
||||
send_icmp_err(ip, ICMP_UNREACH, fin, dst);
|
||||
ATOMIC_INCL(frstats[0].fr_ret);
|
||||
} else if (((pass & FR_RETMASK) == FR_RETRST) &&
|
||||
!(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
!(fin->fin_fl & FI_SHORT)) {
|
||||
if (send_reset(ip, fin) == 0) {
|
||||
ATOMIC_INCL(frstats[1].fr_ret);
|
||||
}
|
||||
@ -1173,7 +1178,7 @@ int out;
|
||||
verbose("- forged ICMP unreachable sent\n");
|
||||
ATOMIC_INCL(frstats[0].fr_ret);
|
||||
} else if (((pass & FR_RETMASK) == FR_RETRST) &&
|
||||
!(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
!(fin->fin_fl & FI_SHORT)) {
|
||||
verbose("- TCP RST sent\n");
|
||||
ATOMIC_INCL(frstats[1].fr_ret);
|
||||
}
|
||||
@ -1202,15 +1207,17 @@ int out;
|
||||
frdest_t *fdp = &fr->fr_tif;
|
||||
|
||||
if (((pass & FR_FASTROUTE) && !out) ||
|
||||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
|
||||
if (ipfr_fastroute(m, fin, fdp) == 0)
|
||||
m = *mp = NULL;
|
||||
}
|
||||
if (mc)
|
||||
ipfr_fastroute(mc, fin, &fr->fr_dif);
|
||||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
|
||||
(void) ipfr_fastroute(m, mp, fin, fdp);
|
||||
|
||||
if (mc != NULL)
|
||||
(void) ipfr_fastroute(mc, &mc, fin, &fr->fr_dif);
|
||||
}
|
||||
if (!(pass & FR_PASS) && m)
|
||||
|
||||
if (!(pass & FR_PASS) && m) {
|
||||
m_freem(m);
|
||||
m = *mp = NULL;
|
||||
}
|
||||
# ifdef __sgi
|
||||
else if (changed && up && m)
|
||||
m_copyback(m, 0, up, hbuf);
|
||||
@ -1221,12 +1228,11 @@ int out;
|
||||
frdest_t *fdp = &fr->fr_tif;
|
||||
|
||||
if (((pass & FR_FASTROUTE) && !out) ||
|
||||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
|
||||
if (ipfr_fastroute(ip, m, mp, fin, fdp) == 0)
|
||||
m = *mp = NULL;
|
||||
}
|
||||
if (mc)
|
||||
ipfr_fastroute(ip, mc, mp, fin, &fr->fr_dif);
|
||||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
|
||||
(void) ipfr_fastroute(ip, m, mp, fin, fdp);
|
||||
|
||||
if (mc != NULL)
|
||||
(void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
|
||||
}
|
||||
# endif /* !SOLARIS */
|
||||
return (pass & FR_PASS) ? 0 : error;
|
||||
@ -1458,7 +1464,7 @@ tcphdr_t *tcp;
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
|
||||
* $Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $
|
||||
* $Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $
|
||||
*/
|
||||
/*
|
||||
* Copy data from an mbuf chain starting "off" bytes from the beginning,
|
||||
@ -1907,7 +1913,7 @@ void frsync()
|
||||
ip_statesync(ifp);
|
||||
}
|
||||
ip_natsync((struct ifnet *)-1);
|
||||
# endif
|
||||
# endif /* !SOLARIS */
|
||||
|
||||
WRITE_ENTER(&ipf_mutex);
|
||||
frsynclist(ipacct[0][fr_active]);
|
||||
|
@ -1,12 +1,16 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#ifdef __FreeBSD__
|
||||
# include <osreldate.h>
|
||||
#ifdef __FreeBSD__
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@ -25,10 +29,6 @@
|
||||
#include <fcntl.h>
|
||||
#include <stddef.h>
|
||||
#include <nlist.h>
|
||||
#ifdef STATETOP
|
||||
#include <ctype.h>
|
||||
#include <ncurses.h>
|
||||
#endif
|
||||
#include <sys/socket.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <netinet/in.h>
|
||||
@ -56,8 +56,17 @@
|
||||
#include "netinet/ip_state.h"
|
||||
#include "netinet/ip_auth.h"
|
||||
#ifdef STATETOP
|
||||
#include "netinet/ipl.h"
|
||||
#endif
|
||||
# include "netinet/ipl.h"
|
||||
# include <ctype.h>
|
||||
# if SOLARIS
|
||||
# ifdef ERR
|
||||
# undef ERR
|
||||
# endif
|
||||
# include <curses.h>
|
||||
# else /* SOLARIS */
|
||||
# include <ncurses.h>
|
||||
# endif /* SOLARIS */
|
||||
#endif /* STATETOP */
|
||||
#include "kmem.h"
|
||||
#if defined(__NetBSD__) || (__OpenBSD__)
|
||||
# include <paths.h>
|
||||
@ -65,10 +74,11 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)fils.c 1.21 4/20/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.7 2000/12/02 00:13:56 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.17 2001/07/19 12:24:09 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern char *optarg;
|
||||
extern int optind;
|
||||
|
||||
#define PRINTF (void)printf
|
||||
#define FPRINTF (void)fprintf
|
||||
@ -86,6 +96,7 @@ int use_inet6 = 0;
|
||||
#ifdef STATETOP
|
||||
#define STSTRSIZE 80
|
||||
#define STGROWSIZE 16
|
||||
#define HOSTNMLEN 40
|
||||
|
||||
#define STSORT_PR 0
|
||||
#define STSORT_PKTS 1
|
||||
@ -128,6 +139,9 @@ static int sort_pkts __P((const void *, const void *));
|
||||
static int sort_bytes __P((const void *, const void *));
|
||||
static int sort_ttl __P((const void *, const void *));
|
||||
#endif
|
||||
#if SOLARIS
|
||||
void showqiflist __P((char *));
|
||||
#endif
|
||||
|
||||
static char *hostname(v, ip)
|
||||
int v;
|
||||
@ -160,7 +174,11 @@ char *name;
|
||||
#else
|
||||
fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name);
|
||||
#endif
|
||||
fprintf(stderr, " %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
|
||||
fprintf(stderr, "\t\t[-M corefile]");
|
||||
#if SOLARIS
|
||||
fprintf(stderr, " [-N symbol-list]");
|
||||
#endif
|
||||
fprintf(stderr, "\n %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@ -177,8 +195,11 @@ char *argv[];
|
||||
ips_stat_t *ipsstp = &ipsst;
|
||||
ipfrstat_t ifrst;
|
||||
ipfrstat_t *ifrstp = &ifrst;
|
||||
char *name = NULL, *device = IPL_NAME;
|
||||
int c, fd;
|
||||
char *name = NULL, *device = IPL_NAME, *memf = NULL;
|
||||
#if SOLARIS
|
||||
char *kern = NULL;
|
||||
#endif
|
||||
int c, fd, myoptind;
|
||||
struct protoent *proto;
|
||||
|
||||
int protocol = -1; /* -1 = wild card for any protocol */
|
||||
@ -190,13 +211,50 @@ char *argv[];
|
||||
saddr.s_addr = INADDR_ANY; /* default any source addr */
|
||||
daddr.s_addr = INADDR_ANY; /* default any dest addr */
|
||||
|
||||
if (openkmem() == -1)
|
||||
/*
|
||||
* Parse these two arguments now lest there be any buffer overflows
|
||||
* in the parsing of the rest.
|
||||
*/
|
||||
myoptind = optind;
|
||||
#if SOLARIS
|
||||
while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
|
||||
#else
|
||||
while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:P:S:T:")) != -1)
|
||||
#endif
|
||||
switch (c)
|
||||
{
|
||||
case 'M' :
|
||||
memf = optarg;
|
||||
break;
|
||||
#if SOLARIS
|
||||
case 'N' :
|
||||
kern = optarg;
|
||||
break;
|
||||
#endif
|
||||
}
|
||||
optind = myoptind;
|
||||
|
||||
#if SOLARIS
|
||||
if (kern != NULL || memf != NULL)
|
||||
#else
|
||||
if (memf != NULL)
|
||||
#endif
|
||||
{
|
||||
(void)setuid(getuid());
|
||||
(void)setgid(getgid());
|
||||
}
|
||||
|
||||
if (openkmem(memf) == -1)
|
||||
exit(-1);
|
||||
|
||||
(void)setuid(getuid());
|
||||
(void)setgid(getgid());
|
||||
|
||||
while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:P:S:T:")) != -1)
|
||||
#if SOLARIS
|
||||
while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
|
||||
#else
|
||||
while ((c = getopt(argc, argv, "6aACfghIilnostvd:D:M:P:S:T:")) != -1)
|
||||
#endif
|
||||
{
|
||||
switch (c)
|
||||
{
|
||||
@ -207,8 +265,7 @@ char *argv[];
|
||||
#endif
|
||||
case 'a' :
|
||||
opts |= OPT_ACCNT|OPT_SHOWLIST;
|
||||
break;
|
||||
case 'A' :
|
||||
break; case 'A' :
|
||||
device = IPAUTH_NAME;
|
||||
opts |= OPT_AUTHSTATS;
|
||||
break;
|
||||
@ -239,6 +296,10 @@ char *argv[];
|
||||
case 'l' :
|
||||
opts |= OPT_SHOWLIST;
|
||||
break;
|
||||
case 'M' :
|
||||
break;
|
||||
case 'N' :
|
||||
break;
|
||||
case 'n' :
|
||||
opts |= OPT_SHOWLINENO;
|
||||
break;
|
||||
@ -255,6 +316,12 @@ char *argv[];
|
||||
exit(-2);
|
||||
}
|
||||
break;
|
||||
#if SOLARIS
|
||||
case 'q' :
|
||||
showqiflist(kern);
|
||||
exit(0);
|
||||
break;
|
||||
#endif
|
||||
case 's' :
|
||||
opts |= OPT_IPSTATES;
|
||||
break;
|
||||
@ -653,13 +720,52 @@ ips_stat_t *ipsp;
|
||||
PRINTF("\tpkt_security & %x = %x, pkt_auth & %x = %x\n",
|
||||
ips.is_secmsk, ips.is_sec, ips.is_authmsk,
|
||||
ips.is_auth);
|
||||
PRINTF("interfaces: in %s[%p] ",
|
||||
PRINTF("\tinterfaces: in %s[%p] ",
|
||||
get_ifname(ips.is_ifpin), ips.is_ifpin);
|
||||
PRINTF("out %s[%p]\n",
|
||||
get_ifname(ips.is_ifpout), ips.is_ifpout);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#if SOLARIS
|
||||
void showqiflist(kern)
|
||||
char *kern;
|
||||
{
|
||||
struct nlist qifnlist[2] = {
|
||||
{ "qif_head" },
|
||||
{ NULL }
|
||||
};
|
||||
qif_t qif, *qf;
|
||||
|
||||
if (kern == NULL)
|
||||
kern = "/dev/ksyms";
|
||||
|
||||
if (nlist(kern, qifnlist) == -1) {
|
||||
fprintf(stderr, "nlist error\n");
|
||||
return;
|
||||
}
|
||||
|
||||
printf("List of interfaces bound by IPFilter:\n");
|
||||
if (kmemcpy((char *)&qf, (u_long)qifnlist[0].n_value, sizeof(qf)))
|
||||
return;
|
||||
while (qf) {
|
||||
if (kmemcpy((char *)&qif, (u_long)qf, sizeof(qif)))
|
||||
break;
|
||||
printf("\tName: %-8s Header Length: %2d SAP: %s (%04x)\n",
|
||||
qif.qf_name, qif.qf_hl,
|
||||
#ifdef IP6_DL_SAP
|
||||
(qif.qf_sap == IP6_DL_SAP) ? "IPv6" : "IPv4"
|
||||
#else
|
||||
"IPv4"
|
||||
#endif
|
||||
, qif.qf_sap);
|
||||
qf = qif.qf_next;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef STATETOP
|
||||
static void topipstates(fd, saddr, daddr, sport, dport, protocol,
|
||||
refreshtime, topclosed)
|
||||
@ -679,9 +785,10 @@ int topclosed;
|
||||
ips_stat_t ipsst, *ipsstp = &ipsst;
|
||||
statetop_t *tstable = NULL, *tp;
|
||||
struct timeval selecttimeout;
|
||||
char hostnm[HOSTNMLEN];
|
||||
struct protoent *proto;
|
||||
fd_set readfd;
|
||||
char c = '\0';
|
||||
int c = 0;
|
||||
time_t t;
|
||||
|
||||
/* open state device */
|
||||
@ -694,7 +801,10 @@ int topclosed;
|
||||
initscr();
|
||||
cbreak();
|
||||
noecho();
|
||||
nodelay(stdscr, 1);
|
||||
|
||||
/* init hostname */
|
||||
gethostname(hostnm, sizeof(hostnm) - 1);
|
||||
hostnm[sizeof(hostnm) - 1] = '\0';
|
||||
|
||||
/* repeat until user aborts */
|
||||
while ( 1 ) {
|
||||
@ -799,8 +909,8 @@ int topclosed;
|
||||
attron(A_BOLD);
|
||||
winx = 0;
|
||||
move(winx,0);
|
||||
sprintf(str1, "%s - state top", IPL_VERSION);
|
||||
for(j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
|
||||
sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION);
|
||||
for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
|
||||
printw(" ");
|
||||
printw("%s", str1);
|
||||
attroff(A_BOLD);
|
||||
@ -873,7 +983,9 @@ int topclosed;
|
||||
if (reverse)
|
||||
tp += tsentry;
|
||||
|
||||
for(i = 0; i <= tsentry; i++) {
|
||||
if (tsentry > maxy - 6)
|
||||
tsentry = maxy - 6;
|
||||
for (i = 0; i <= tsentry; i++) {
|
||||
/* print src/dest and port */
|
||||
if ((tp->st_p == IPPROTO_TCP) ||
|
||||
(tp->st_p == IPPROTO_UDP)) {
|
||||
@ -938,22 +1050,25 @@ int topclosed;
|
||||
select(1, &readfd, NULL, NULL, &selecttimeout);
|
||||
|
||||
/* if key pressed, read all waiting keys */
|
||||
if (FD_ISSET(0, &readfd))
|
||||
while ((c = wgetch(stdscr)) != ERR) {
|
||||
if (tolower(c) == 'l') {
|
||||
redraw = 1;
|
||||
} else if (tolower(c) == 'q') {
|
||||
nocbreak();
|
||||
endwin();
|
||||
exit(0);
|
||||
} else if (tolower(c) == 'r') {
|
||||
reverse = !reverse;
|
||||
} else if (tolower(c) == 's') {
|
||||
sorting++;
|
||||
if (sorting > STSORT_MAX)
|
||||
sorting = 0;
|
||||
}
|
||||
if (FD_ISSET(0, &readfd)) {
|
||||
c = wgetch(stdscr);
|
||||
if (c == ERR)
|
||||
continue;
|
||||
|
||||
if (tolower(c) == 'l') {
|
||||
redraw = 1;
|
||||
} else if (tolower(c) == 'q') {
|
||||
nocbreak();
|
||||
endwin();
|
||||
exit(0);
|
||||
} else if (tolower(c) == 'r') {
|
||||
reverse = !reverse;
|
||||
} else if (tolower(c) == 's') {
|
||||
sorting++;
|
||||
if (sorting > STSORT_MAX)
|
||||
sorting = 0;
|
||||
}
|
||||
}
|
||||
} /* while */
|
||||
|
||||
close(sfd);
|
||||
|
@ -52,10 +52,20 @@
|
||||
* -
|
||||
* --Copyright--
|
||||
*/
|
||||
#ifdef __STDC__
|
||||
# ifndef __P
|
||||
# define __P(x) x
|
||||
# endif
|
||||
#else
|
||||
# undef __P
|
||||
# define __P(x) ()
|
||||
# undef const
|
||||
# define const
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93";
|
||||
static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1.4.1 2001/07/15 22:06:14 darrenr Exp $";
|
||||
#endif /* LIBC_SCCS and not lint */
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -63,13 +73,6 @@ static const char rcsid[] = "@(#)$Id: inet_addr.c,v 2.1 1999/08/04 17:29:54 darr
|
||||
#include <arpa/inet.h>
|
||||
#include <ctype.h>
|
||||
|
||||
#ifndef __P
|
||||
# ifdef __STDC__
|
||||
# define __P(x) x
|
||||
# else
|
||||
# define __P(x) ()
|
||||
# endif
|
||||
#endif
|
||||
int inet_aton __P((const char *, struct in_addr *));
|
||||
|
||||
/*
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1998-2000 by Darren Reed & Guido van Rooij.
|
||||
* Copyright (C) 1998-2001 by Darren Reed & Guido van Rooij.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#include <sys/errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
@ -77,7 +71,7 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.5 2001/01/10 06:18:35 d
|
||||
#endif
|
||||
#include <netinet/tcp.h>
|
||||
#if defined(__sgi) && !defined(IFF_DRVRLOCK) /* IRIX < 6 */
|
||||
extern struct ifqueue ipintrq; /* ip packet input queue */
|
||||
extern struct ifqueue ipintrq; /* ip packet input queue */
|
||||
#else
|
||||
# ifndef linux
|
||||
# if __FreeBSD_version >= 300000
|
||||
@ -107,10 +101,13 @@ extern struct ifqueue ipintrq; /* ip packet input queue */
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.12 2001/07/18 14:57:08 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
|
||||
extern KRWLOCK_T ipf_auth;
|
||||
extern KRWLOCK_T ipf_auth, ipf_mutex;
|
||||
extern kmutex_t ipf_authmx;
|
||||
# if SOLARIS
|
||||
extern kcondvar_t ipfauthwait;
|
||||
@ -129,7 +126,8 @@ static frauth_t fr_auth[FR_NUMAUTH];
|
||||
mb_t *fr_authpkts[FR_NUMAUTH];
|
||||
static int fr_authstart = 0, fr_authend = 0, fr_authnext = 0;
|
||||
static frauthent_t *fae_list = NULL;
|
||||
frentry_t *ipauth = NULL;
|
||||
frentry_t *ipauth = NULL,
|
||||
*fr_authlist = NULL;
|
||||
|
||||
|
||||
/*
|
||||
@ -142,10 +140,12 @@ ip_t *ip;
|
||||
fr_info_t *fin;
|
||||
{
|
||||
u_short id = ip->ip_id;
|
||||
frentry_t *fr;
|
||||
frauth_t *fra;
|
||||
u_32_t pass;
|
||||
int i;
|
||||
|
||||
if (fr_auth_lock)
|
||||
if (fr_auth_lock || !fr_authused)
|
||||
return 0;
|
||||
|
||||
READ_ENTER(&ipf_auth);
|
||||
@ -155,24 +155,54 @@ fr_info_t *fin;
|
||||
* case the same packet gets sent again and it hasn't yet been
|
||||
* auth'd.
|
||||
*/
|
||||
if ((fr_auth[i].fra_index == -2) &&
|
||||
(id == fr_auth[i].fra_info.fin_id) &&
|
||||
!bcmp((char *)fin,(char *)&fr_auth[i].fra_info,FI_CSIZE)) {
|
||||
fra = fr_auth + i;
|
||||
if ((fra->fra_index == -2) && (id == fra->fra_info.fin_id) &&
|
||||
!bcmp((char *)fin, (char *)&fra->fra_info, FI_CSIZE)) {
|
||||
/*
|
||||
* Avoid feedback loop.
|
||||
*/
|
||||
if (!(pass = fr_auth[i].fra_pass) || (pass & FR_AUTH))
|
||||
if (!(pass = fra->fra_pass) || (pass & FR_AUTH))
|
||||
pass = FR_BLOCK;
|
||||
/*
|
||||
* Create a dummy rule for the stateful checking to
|
||||
* use and return. Zero out any values we don't
|
||||
* trust from userland!
|
||||
*/
|
||||
if ((pass & FR_KEEPSTATE) || ((pass & FR_KEEPFRAG) &&
|
||||
(fin->fin_fi.fi_fl & FI_FRAG))) {
|
||||
KMALLOC(fr, frentry_t *);
|
||||
if (fr) {
|
||||
bcopy((char *)fra->fra_info.fin_fr,
|
||||
fr, sizeof(*fr));
|
||||
fr->fr_grp = NULL;
|
||||
fr->fr_ifa = fin->fin_ifp;
|
||||
fr->fr_func = NULL;
|
||||
fr->fr_ref = 1;
|
||||
fr->fr_flags = pass;
|
||||
#if BSD >= 199306
|
||||
fr->fr_oifa = NULL;
|
||||
#endif
|
||||
}
|
||||
} else
|
||||
fr = fra->fra_info.fin_fr;
|
||||
fin->fin_fr = fr;
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
if (fr && fr != fra->fra_info.fin_fr) {
|
||||
fr->fr_next = fr_authlist;
|
||||
fr_authlist = fr;
|
||||
}
|
||||
fr_authstats.fas_hits++;
|
||||
fr_auth[i].fra_index = -1;
|
||||
fra->fra_index = -1;
|
||||
fr_authused--;
|
||||
if (i == fr_authstart) {
|
||||
while (fr_auth[i].fra_index == -1) {
|
||||
while (fra->fra_index == -1) {
|
||||
i++;
|
||||
if (i == FR_NUMAUTH)
|
||||
fra++;
|
||||
if (i == FR_NUMAUTH) {
|
||||
i = 0;
|
||||
fra = fr_auth;
|
||||
}
|
||||
fr_authstart = i;
|
||||
if (i == fr_authend)
|
||||
break;
|
||||
@ -208,6 +238,7 @@ ip_t *ip;
|
||||
#if defined(_KERNEL) && SOLARIS
|
||||
qif_t *qif = fin->fin_qif;
|
||||
#endif
|
||||
frauth_t *fra;
|
||||
int i;
|
||||
|
||||
if (fr_auth_lock)
|
||||
@ -219,7 +250,7 @@ ip_t *ip;
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
return 0;
|
||||
} else {
|
||||
if ((fr_authstart == 0) && (fr_authend == FR_NUMAUTH - 1)) {
|
||||
if (fr_authused == FR_NUMAUTH) {
|
||||
fr_authstats.fas_nospace++;
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
return 0;
|
||||
@ -232,51 +263,48 @@ ip_t *ip;
|
||||
if (fr_authend == FR_NUMAUTH)
|
||||
fr_authend = 0;
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
fr_auth[i].fra_index = i;
|
||||
fr_auth[i].fra_pass = 0;
|
||||
fr_auth[i].fra_age = fr_defaultauthage;
|
||||
bcopy((char *)fin, (char *)&fr_auth[i].fra_info, sizeof(*fin));
|
||||
#if !defined(sparc) && !defined(m68k)
|
||||
fra = fr_auth + i;
|
||||
fra->fra_index = i;
|
||||
fra->fra_pass = 0;
|
||||
fra->fra_age = fr_defaultauthage;
|
||||
bcopy((char *)fin, (char *)&fra->fra_info, sizeof(*fin));
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
# if !defined(sparc)
|
||||
/*
|
||||
* No need to copyback here as we want to undo the changes, not keep
|
||||
* them.
|
||||
*/
|
||||
# if SOLARIS && defined(_KERNEL)
|
||||
if ((ip == (ip_t *)m->b_rptr) && (ip->ip_v == 4))
|
||||
# endif
|
||||
{
|
||||
register u_short bo;
|
||||
|
||||
bo = ip->ip_len;
|
||||
ip->ip_len = htons(bo);
|
||||
# if !SOLARIS && !defined(__NetBSD__)
|
||||
/* 4.4BSD converts this ip_input.c, but I don't in solaris.c */
|
||||
bo = ip->ip_id;
|
||||
ip->ip_id = htons(bo);
|
||||
# endif
|
||||
bo = ip->ip_off;
|
||||
ip->ip_off = htons(bo);
|
||||
}
|
||||
#endif
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
# endif
|
||||
m->b_rptr -= qif->qf_off;
|
||||
fr_authpkts[i] = *(mblk_t **)fin->fin_mp;
|
||||
fr_auth[i].fra_q = qif->qf_q;
|
||||
fra->fra_q = qif->qf_q;
|
||||
cv_signal(&ipfauthwait);
|
||||
#else
|
||||
fr_authpkts[i] = m;
|
||||
# if defined(linux) && defined(_KERNEL)
|
||||
wake_up_interruptible(&ipfauthwait);
|
||||
# else
|
||||
WAKEUP(&fr_authnext);
|
||||
# if defined(BSD) && !defined(sparc) && (BSD >= 199306)
|
||||
if (!fin->fin_out) {
|
||||
HTONS(ip->ip_len);
|
||||
HTONS(ip->ip_off);
|
||||
}
|
||||
# endif
|
||||
fr_authpkts[i] = m;
|
||||
WAKEUP(&fr_authnext);
|
||||
#endif
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
int fr_auth_ioctl(data, cmd, fr, frptr)
|
||||
int fr_auth_ioctl(data, mode, cmd, fr, frptr)
|
||||
caddr_t data;
|
||||
int mode;
|
||||
#if defined(__NetBSD__) || defined(__OpenBSD__) || (FreeBSD_version >= 300003)
|
||||
u_long cmd;
|
||||
#else
|
||||
@ -287,8 +315,9 @@ frentry_t *fr, **frptr;
|
||||
mb_t *m;
|
||||
#if defined(_KERNEL) && !SOLARIS
|
||||
struct ifqueue *ifq;
|
||||
int s;
|
||||
#endif
|
||||
frauth_t auth, *au = &auth;
|
||||
frauth_t auth, *au = &auth, *fra;
|
||||
frauthent_t *fae, **faep;
|
||||
int i, error = 0;
|
||||
|
||||
@ -313,21 +342,26 @@ frentry_t *fr, **frptr;
|
||||
else
|
||||
faep = &fae->fae_next;
|
||||
if (cmd == SIOCRMAFR) {
|
||||
if (!fae)
|
||||
if (!fr || !frptr)
|
||||
error = EINVAL;
|
||||
else if (!fae)
|
||||
error = ESRCH;
|
||||
else {
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
SPL_NET(s);
|
||||
*faep = fae->fae_next;
|
||||
*frptr = fr->fr_next;
|
||||
SPL_X(s);
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
KFREE(fae);
|
||||
}
|
||||
} else {
|
||||
} else if (fr && frptr) {
|
||||
KMALLOC(fae, frauthent_t *);
|
||||
if (fae != NULL) {
|
||||
bcopy((char *)fr, (char *)&fae->fae_fr,
|
||||
sizeof(*fr));
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
SPL_NET(s);
|
||||
fae->fae_age = fr_defaultauthage;
|
||||
fae->fae_fr.fr_hits = 0;
|
||||
fae->fae_fr.fr_next = *frptr;
|
||||
@ -335,10 +369,12 @@ frentry_t *fr, **frptr;
|
||||
fae->fae_next = *faep;
|
||||
*faep = fae;
|
||||
ipauth = &fae_list->fae_fr;
|
||||
SPL_X(s);
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
} else
|
||||
error = ENOMEM;
|
||||
}
|
||||
} else
|
||||
error = EINVAL;
|
||||
break;
|
||||
case SIOCATHST:
|
||||
READ_ENTER(&ipf_auth);
|
||||
@ -348,6 +384,10 @@ frentry_t *fr, **frptr;
|
||||
sizeof(fr_authstats));
|
||||
break;
|
||||
case SIOCAUTHW:
|
||||
if (!(mode & FWRITE)) {
|
||||
error = EPERM;
|
||||
break;
|
||||
}
|
||||
fr_authioctlloop:
|
||||
READ_ENTER(&ipf_auth);
|
||||
if ((fr_authnext != fr_authend) && fr_authpkts[fr_authnext]) {
|
||||
@ -357,9 +397,11 @@ frentry_t *fr, **frptr;
|
||||
if (error)
|
||||
break;
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
SPL_NET(s);
|
||||
fr_authnext++;
|
||||
if (fr_authnext == FR_NUMAUTH)
|
||||
fr_authnext = 0;
|
||||
SPL_X(s);
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
return 0;
|
||||
}
|
||||
@ -372,55 +414,62 @@ frentry_t *fr, **frptr;
|
||||
}
|
||||
mutex_exit(&ipf_authmx);
|
||||
# else
|
||||
# ifdef linux
|
||||
interruptible_sleep_on(&ipfauthwait);
|
||||
if (current->signal & ~current->blocked)
|
||||
error = -EINTR;
|
||||
# else
|
||||
error = SLEEP(&fr_authnext, "fr_authnext");
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
if (!error)
|
||||
goto fr_authioctlloop;
|
||||
break;
|
||||
case SIOCAUTHR:
|
||||
if (!(mode & FWRITE)) {
|
||||
error = EPERM;
|
||||
break;
|
||||
}
|
||||
error = IRCOPYPTR(data, (caddr_t)&auth, sizeof(auth));
|
||||
if (error)
|
||||
return error;
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
SPL_NET(s);
|
||||
i = au->fra_index;
|
||||
fra = fr_auth + i;
|
||||
if ((i < 0) || (i > FR_NUMAUTH) ||
|
||||
(fr_auth[i].fra_info.fin_id != au->fra_info.fin_id)) {
|
||||
(fra->fra_info.fin_id != au->fra_info.fin_id)) {
|
||||
SPL_X(s);
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
return EINVAL;
|
||||
}
|
||||
m = fr_authpkts[i];
|
||||
fr_auth[i].fra_index = -2;
|
||||
fr_auth[i].fra_pass = au->fra_pass;
|
||||
fra->fra_index = -2;
|
||||
fra->fra_pass = au->fra_pass;
|
||||
fr_authpkts[i] = NULL;
|
||||
#ifdef _KERNEL
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
# ifndef linux
|
||||
#ifdef _KERNEL
|
||||
if (m && au->fra_info.fin_out) {
|
||||
# if SOLARIS
|
||||
error = fr_qout(fr_auth[i].fra_q, m);
|
||||
# else /* SOLARIS */
|
||||
# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__)
|
||||
error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
|
||||
# if SOLARIS
|
||||
error = fr_qout(fra->fra_q, m);
|
||||
# else /* SOLARIS */
|
||||
struct route ro;
|
||||
|
||||
bzero((char *)&ro, sizeof(ro));
|
||||
# if ((_BSDI_VERSION >= 199802) && (_BSDI_VERSION < 200005)) || \
|
||||
defined(__OpenBSD__)
|
||||
error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL,
|
||||
NULL);
|
||||
# else
|
||||
error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL);
|
||||
# endif
|
||||
# endif /* SOLARIS */
|
||||
# else
|
||||
error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL);
|
||||
# endif
|
||||
if (ro.ro_rt) {
|
||||
RTFREE(ro.ro_rt);
|
||||
}
|
||||
# endif /* SOLARIS */
|
||||
if (error)
|
||||
fr_authstats.fas_sendfail++;
|
||||
else
|
||||
fr_authstats.fas_sendok++;
|
||||
} else if (m) {
|
||||
# if SOLARIS
|
||||
error = fr_qin(fr_auth[i].fra_q, m);
|
||||
error = fr_qin(fra->fra_q, m);
|
||||
# else /* SOLARIS */
|
||||
ifq = &ipintrq;
|
||||
if (IF_QFULL(ifq)) {
|
||||
@ -438,7 +487,6 @@ frentry_t *fr, **frptr;
|
||||
fr_authstats.fas_queok++;
|
||||
} else
|
||||
error = EINVAL;
|
||||
# endif
|
||||
# if SOLARIS
|
||||
if (error)
|
||||
error = EINVAL;
|
||||
@ -449,10 +497,10 @@ frentry_t *fr, **frptr;
|
||||
*/
|
||||
if (error == ENOBUFS) {
|
||||
fr_authused--;
|
||||
fr_auth[i].fra_index = -1;
|
||||
fr_auth[i].fra_pass = 0;
|
||||
fra->fra_index = -1;
|
||||
fra->fra_pass = 0;
|
||||
if (i == fr_authstart) {
|
||||
while (fr_auth[i].fra_index == -1) {
|
||||
while (fra->fra_index == -1) {
|
||||
i++;
|
||||
if (i == FR_NUMAUTH)
|
||||
i = 0;
|
||||
@ -468,6 +516,7 @@ frentry_t *fr, **frptr;
|
||||
}
|
||||
# endif
|
||||
#endif /* _KERNEL */
|
||||
SPL_X(s);
|
||||
break;
|
||||
default :
|
||||
error = EINVAL;
|
||||
@ -485,6 +534,7 @@ void fr_authunload()
|
||||
{
|
||||
register int i;
|
||||
register frauthent_t *fae, **faep;
|
||||
frentry_t *fr, **frp;
|
||||
mb_t *m;
|
||||
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
@ -503,6 +553,26 @@ void fr_authunload()
|
||||
}
|
||||
ipauth = NULL;
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
|
||||
if (fr_authlist) {
|
||||
/*
|
||||
* We *MuST* reget ipf_auth because otherwise we won't get the
|
||||
* locks in the right order and risk deadlock.
|
||||
* We need ipf_mutex here to prevent a rule from using it
|
||||
* inside fr_check().
|
||||
*/
|
||||
WRITE_ENTER(&ipf_mutex);
|
||||
WRITE_ENTER(&ipf_auth);
|
||||
for (frp = &fr_authlist; (fr = *frp); ) {
|
||||
if (fr->fr_ref == 1) {
|
||||
*frp = fr->fr_next;
|
||||
KFREE(fr);
|
||||
} else
|
||||
frp = &fr->fr_next;
|
||||
}
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
RWLOCK_EXIT(&ipf_mutex);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -515,6 +585,7 @@ void fr_authexpire()
|
||||
register int i;
|
||||
register frauth_t *fra;
|
||||
register frauthent_t *fae, **faep;
|
||||
register frentry_t *fr, **frp;
|
||||
mb_t *m;
|
||||
#if !SOLARIS
|
||||
int s;
|
||||
@ -544,6 +615,14 @@ void fr_authexpire()
|
||||
faep = &fae->fae_next;
|
||||
}
|
||||
ipauth = &fae_list->fae_fr;
|
||||
|
||||
for (frp = &fr_authlist; (fr = *frp); ) {
|
||||
if (fr->fr_ref == 1) {
|
||||
*frp = fr->fr_next;
|
||||
KFREE(fr);
|
||||
} else
|
||||
frp = &fr->fr_next;
|
||||
}
|
||||
RWLOCK_EXIT(&ipf_auth);
|
||||
SPL_X(s);
|
||||
}
|
||||
|
@ -1,11 +1,9 @@
|
||||
/*
|
||||
* Copyright (C) 1997-2000 by Darren Reed & Guido Van Rooij.
|
||||
* Copyright (C) 1997-2001 by Darren Reed & Guido Van Rooij.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* $Id: ip_auth.h,v 2.3.2.2 2000/10/19 15:38:44 darrenr Exp $
|
||||
* $Id: ip_auth.h,v 2.3.2.4 2001/07/18 14:57:08 darrenr Exp $
|
||||
*
|
||||
*/
|
||||
#ifndef __IP_AUTH_H__
|
||||
@ -55,8 +53,8 @@ extern void fr_authunload __P((void));
|
||||
extern mb_t *fr_authpkts[];
|
||||
extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *));
|
||||
#if defined(__NetBSD__) || defined(__OpenBSD__)
|
||||
extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **));
|
||||
extern int fr_auth_ioctl __P((caddr_t, int, u_long, frentry_t *, frentry_t **));
|
||||
#else
|
||||
extern int fr_auth_ioctl __P((caddr_t, int, frentry_t *, frentry_t **));
|
||||
extern int fr_auth_ioctl __P((caddr_t, int, int, frentry_t *, frentry_t **));
|
||||
#endif
|
||||
#endif /* __IP_AUTH_H__ */
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ip_compat.h 1.8 1/14/96
|
||||
* $Id: ip_compat.h,v 2.26.2.9 2001/01/14 14:58:01 darrenr Exp $
|
||||
* $Id: ip_compat.h,v 2.26.2.17 2001/07/23 04:22:48 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IP_COMPAT_H__
|
||||
@ -27,6 +25,9 @@
|
||||
#ifndef SOLARIS
|
||||
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
|
||||
#endif
|
||||
#if SOLARIS && !defined(SOLARIS2)
|
||||
# define SOLARIS2 4 /* Pick an old version */
|
||||
#endif
|
||||
#if SOLARIS2 >= 8
|
||||
# ifndef USE_INET6
|
||||
# define USE_INET6
|
||||
@ -119,10 +120,34 @@ struct ether_addr {
|
||||
# define V4_PART_OF_V6(v6) v6.s6_addr32[3]
|
||||
# endif
|
||||
# endif
|
||||
#else
|
||||
|
||||
typedef struct qif {
|
||||
struct qif *qf_next;
|
||||
ill_t *qf_ill;
|
||||
kmutex_t qf_lock;
|
||||
void *qf_iptr;
|
||||
void *qf_optr;
|
||||
queue_t *qf_in;
|
||||
queue_t *qf_out;
|
||||
struct qinit *qf_wqinfo;
|
||||
struct qinit *qf_rqinfo;
|
||||
struct qinit qf_wqinit;
|
||||
struct qinit qf_rqinit;
|
||||
mblk_t *qf_m; /* These three fields are for passing data up from */
|
||||
queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */
|
||||
size_t qf_off;
|
||||
size_t qf_len; /* this field is used for in ipfr_fastroute */
|
||||
char qf_name[8];
|
||||
/*
|
||||
* in case the ILL has disappeared...
|
||||
*/
|
||||
size_t qf_hl; /* header length */
|
||||
int qf_sap;
|
||||
} qif_t;
|
||||
#else /* SOLARIS */
|
||||
# if !defined(__sgi)
|
||||
typedef int minor_t;
|
||||
#endif
|
||||
# endif
|
||||
#endif /* SOLARIS */
|
||||
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
|
||||
|
||||
@ -264,10 +289,26 @@ union i6addr {
|
||||
|
||||
#if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL))
|
||||
# ifdef IPFILTER_LKM
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# include <sys/param.h>
|
||||
# endif
|
||||
# endif
|
||||
# define ACTUALLY_LKM_NOT_KERNEL
|
||||
# else
|
||||
# include <sys/osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <sys/osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <sys/osreldate.h>
|
||||
# else
|
||||
# include <sys/param.h>
|
||||
# endif
|
||||
# endif
|
||||
# endif
|
||||
# if __FreeBSD__ < 3
|
||||
# include <machine/spl.h>
|
||||
@ -325,6 +366,7 @@ typedef struct {
|
||||
# define ATOMIC_DEC32(x) atomic_add_32((uint32_t*)&(x), -1)
|
||||
# define ATOMIC_DEC16(x) atomic_add_16((uint16_t*)&(x), -1)
|
||||
# else
|
||||
# define IRE_CACHE IRE_ROUTE
|
||||
# define ATOMIC_INC(x) { mutex_enter(&ipf_rw); (x)++; \
|
||||
mutex_exit(&ipf_rw); }
|
||||
# define ATOMIC_DEC(x) { mutex_enter(&ipf_rw); (x)--; \
|
||||
@ -374,29 +416,6 @@ typedef struct {
|
||||
# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
|
||||
# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
|
||||
# define GET_MINOR(x) getminor(x)
|
||||
typedef struct qif {
|
||||
struct qif *qf_next;
|
||||
ill_t *qf_ill;
|
||||
kmutex_t qf_lock;
|
||||
void *qf_iptr;
|
||||
void *qf_optr;
|
||||
queue_t *qf_in;
|
||||
queue_t *qf_out;
|
||||
struct qinit *qf_wqinfo;
|
||||
struct qinit *qf_rqinfo;
|
||||
struct qinit qf_wqinit;
|
||||
struct qinit qf_rqinit;
|
||||
mblk_t *qf_m; /* These three fields are for passing data up from */
|
||||
queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */
|
||||
size_t qf_off;
|
||||
size_t qf_len; /* this field is used for in ipfr_fastroute */
|
||||
char qf_name[8];
|
||||
/*
|
||||
* in case the ILL has disappeared...
|
||||
*/
|
||||
size_t qf_hl; /* header length */
|
||||
int qf_sap;
|
||||
} qif_t;
|
||||
extern ill_t *get_unit __P((char *, int));
|
||||
# define GETUNIT(n, v) get_unit(n, v)
|
||||
# define IFNAME(x) ((ill_t *)x)->ill_name
|
||||
@ -452,7 +471,9 @@ extern ill_t *get_unit __P((char *, int));
|
||||
(defined(OpenBSD) && (OpenBSD >= 199603))
|
||||
# define IFNAME(x) ((struct ifnet *)x)->if_xname
|
||||
# else
|
||||
# define IFNAME(x) ((struct ifnet *)x)->if_name
|
||||
# define USE_GETIFNAME 1
|
||||
# define IFNAME(x) get_ifname((struct ifnet *)x)
|
||||
extern char *get_ifname __P((struct ifnet *));
|
||||
# endif
|
||||
# endif
|
||||
# endif /* sun */
|
||||
@ -508,7 +529,8 @@ extern vm_map_t kmem_map;
|
||||
# define SLEEP(id, n) tsleep((id), PPAUSE|PCATCH, n, 0)
|
||||
# define WAKEUP(id) wakeup(id)
|
||||
# endif /* BSD */
|
||||
# if defined(NetBSD) && NetBSD <= 1991011 && NetBSD >= 199407
|
||||
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199407)) || \
|
||||
(defined(OpenBSD) && (OpenBSD >= 200006))
|
||||
# define SPL_NET(x) x = splsoftnet()
|
||||
# define SPL_X(x) (void) splx(x)
|
||||
# else
|
||||
@ -517,7 +539,7 @@ extern vm_map_t kmem_map;
|
||||
# define SPL_NET(x) x = splnet()
|
||||
# define SPL_X(x) (void) splx(x)
|
||||
# endif
|
||||
# endif /* NetBSD && NetBSD <= 1991011 && NetBSD >= 199407 */
|
||||
# endif /* NetBSD && (NetBSD <= 1991011) && (NetBSD >= 199407) */
|
||||
# define PANIC(x,y) if (x) panic y
|
||||
#else /* KERNEL */
|
||||
# define SLEEP(x,y) ;
|
||||
@ -576,7 +598,6 @@ typedef struct mbuf mb_t;
|
||||
# endif
|
||||
#endif /* SOLARIS */
|
||||
|
||||
#if defined(linux) || defined(__sgi)
|
||||
/*
|
||||
* These #ifdef's are here mainly for linux, but who knows, they may
|
||||
* not be in other places or maybe one day linux will grow up and some
|
||||
@ -615,6 +636,9 @@ typedef struct mbuf mb_t;
|
||||
#ifndef ICMP_MASKREPLY
|
||||
# define ICMP_MASKREPLY ICMP_ADDRESSREPLY
|
||||
#endif
|
||||
#ifndef ICMP_PARAMPROB_OPTABSENT
|
||||
# define ICMP_PARAMPROB_OPTABSENT 1
|
||||
#endif
|
||||
#ifndef IPVERSION
|
||||
# define IPVERSION 4
|
||||
#endif
|
||||
@ -702,7 +726,6 @@ typedef struct mbuf mb_t;
|
||||
#ifndef IPOPT_OLEN
|
||||
# define IPOPT_OLEN 1
|
||||
#endif
|
||||
#endif /* linux || __sgi */
|
||||
|
||||
#ifdef linux
|
||||
#include <linux/in_systm.h>
|
||||
|
@ -1,15 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#ifndef SOLARIS
|
||||
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
|
||||
#endif
|
||||
@ -118,6 +111,11 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.17 2000/10/19 15:39:42 d
|
||||
extern int ip_optcopy __P((struct ip *, struct ip *));
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.34 2001/07/23 13:49:57 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
extern struct protosw inetsw[];
|
||||
|
||||
@ -131,7 +129,11 @@ extern int tcp_ttl;
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#ifdef ICMP_UNREACH_FILTER_PROHIB
|
||||
int ipl_unreach = ICMP_UNREACH_FILTER_PROHIB;
|
||||
#else
|
||||
int ipl_unreach = ICMP_UNREACH_FILTER;
|
||||
#endif
|
||||
u_long ipl_frouteok[2] = {0, 0};
|
||||
|
||||
static int frzerostats __P((caddr_t));
|
||||
@ -171,6 +173,10 @@ struct callout_handle ipfr_slowtimer_ch;
|
||||
# include <sys/callout.h>
|
||||
struct callout ipfr_slowtimer_ch;
|
||||
#endif
|
||||
#if defined(__OpenBSD__)
|
||||
# include <sys/timeout.h>
|
||||
struct timeout ipfr_slowtimer_ch;
|
||||
#endif
|
||||
#if defined(__sgi) && defined(_KERNEL)
|
||||
toid_t ipfr_slowtimer_ch;
|
||||
#endif
|
||||
@ -246,12 +252,18 @@ int iplattach()
|
||||
# ifdef IPFILTER_LOG
|
||||
ipflog_init();
|
||||
# endif
|
||||
if (nat_init() == -1)
|
||||
return -1;
|
||||
if (fr_stateinit() == -1)
|
||||
return -1;
|
||||
if (appr_init() == -1)
|
||||
return -1;
|
||||
if (nat_init() == -1) {
|
||||
SPL_X(s);
|
||||
return EIO;
|
||||
}
|
||||
if (fr_stateinit() == -1) {
|
||||
SPL_X(s);
|
||||
return EIO;
|
||||
}
|
||||
if (appr_init() == -1) {
|
||||
SPL_X(s);
|
||||
return EIO;
|
||||
}
|
||||
|
||||
# ifdef NETBSD_PF
|
||||
# if __NetBSD_Version__ >= 104200000
|
||||
@ -261,6 +273,7 @@ int iplattach()
|
||||
# ifdef USE_INET6
|
||||
goto pfil_error;
|
||||
# else
|
||||
SPL_X(s);
|
||||
appr_unload();
|
||||
ip_natunload();
|
||||
fr_stateunload();
|
||||
@ -277,6 +290,7 @@ int iplattach()
|
||||
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
|
||||
&inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
|
||||
pfil_error:
|
||||
SPL_X(s);
|
||||
appr_unload();
|
||||
ip_natunload();
|
||||
fr_stateunload();
|
||||
@ -321,10 +335,15 @@ int iplattach()
|
||||
callout_init(&ipfr_slowtimer_ch);
|
||||
callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
|
||||
# else
|
||||
# if (__FreeBSD_version >= 300000) || defined(__sgi)
|
||||
ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
|
||||
# if defined(__OpenBSD__)
|
||||
timeout_set(&ipfr_slowtimer_ch, ipfr_slowtimer, NULL);
|
||||
timeout_add(&ipfr_slowtimer_ch, hz/2);
|
||||
# else
|
||||
# if (__FreeBSD_version >= 300000) || defined(__sgi)
|
||||
ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
|
||||
# else
|
||||
timeout(ipfr_slowtimer, NULL, hz/2);
|
||||
# endif
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
@ -353,8 +372,12 @@ int ipldetach()
|
||||
# ifdef __sgi
|
||||
untimeout(ipfr_slowtimer_ch);
|
||||
# else
|
||||
# if defined(__OpenBSD__)
|
||||
timeout_del(&ipfr_slowtimer_ch);
|
||||
# else
|
||||
untimeout(ipfr_slowtimer, NULL);
|
||||
# endif
|
||||
# endif /* OpenBSD */
|
||||
# endif /* __sgi */
|
||||
# endif /* FreeBSD */
|
||||
# endif /* NetBSD */
|
||||
#endif
|
||||
@ -376,16 +399,20 @@ int ipldetach()
|
||||
# if __NetBSD_Version__ >= 104200000
|
||||
error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
|
||||
&inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
|
||||
if (error)
|
||||
if (error) {
|
||||
SPL_X(s);
|
||||
return error;
|
||||
}
|
||||
# else
|
||||
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
|
||||
# endif
|
||||
# ifdef USE_INET6
|
||||
error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
|
||||
&inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
|
||||
if (error)
|
||||
if (error) {
|
||||
SPL_X(s);
|
||||
return error;
|
||||
}
|
||||
# endif
|
||||
# endif
|
||||
|
||||
@ -489,8 +516,9 @@ int mode;
|
||||
}
|
||||
if (unit == IPL_LOGAUTH) {
|
||||
if (!fr_running)
|
||||
return EIO;
|
||||
error = fr_auth_ioctl(data, cmd, NULL, NULL);
|
||||
error = EIO;
|
||||
else
|
||||
error = fr_auth_ioctl(data, mode, cmd, NULL, NULL);
|
||||
SPL_X(s);
|
||||
return error;
|
||||
}
|
||||
@ -564,7 +592,7 @@ int mode;
|
||||
fr_getstat(&fio);
|
||||
error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
|
||||
if (error)
|
||||
return EFAULT;
|
||||
error = EFAULT;
|
||||
break;
|
||||
}
|
||||
case SIOCFRZST :
|
||||
@ -607,7 +635,7 @@ int mode;
|
||||
error = IWCOPYPTR((caddr_t)ipfr_fragstats(), data,
|
||||
sizeof(ipfrstat_t));
|
||||
if (error)
|
||||
return EFAULT;
|
||||
error = EFAULT;
|
||||
break;
|
||||
case SIOCAUTHW :
|
||||
case SIOCAUTHR :
|
||||
@ -820,8 +848,6 @@ caddr_t data;
|
||||
return EBUSY;
|
||||
if (fg && fg->fg_head)
|
||||
fg->fg_head->fr_ref--;
|
||||
if (unit == IPL_LOGAUTH)
|
||||
return fr_auth_ioctl(data, req, f, ftail);
|
||||
if (f->fr_grhead)
|
||||
fr_delgroup((u_int)f->fr_grhead, fp->fr_flags,
|
||||
unit, set);
|
||||
@ -835,8 +861,6 @@ caddr_t data;
|
||||
if (f)
|
||||
error = EEXIST;
|
||||
else {
|
||||
if (unit == IPL_LOGAUTH)
|
||||
return fr_auth_ioctl(data, req, fp, ftail);
|
||||
KMALLOC(f, frentry_t *);
|
||||
if (f != NULL) {
|
||||
if (fg && fg->fg_head)
|
||||
@ -1068,7 +1092,7 @@ struct mbuf *m;
|
||||
# ifdef IPSEC
|
||||
m->m_pkthdr.rcvif = NULL;
|
||||
# endif
|
||||
return ipfr_fastroute(m, fin, NULL);
|
||||
return ipfr_fastroute(m, fin->fin_mp, fin, NULL);
|
||||
}
|
||||
|
||||
|
||||
@ -1079,6 +1103,7 @@ fr_info_t *fin;
|
||||
int dst;
|
||||
{
|
||||
int err, hlen = 0, xtra = 0, iclen, ohlen = 0, avail, code;
|
||||
u_short shlen, slen = 0, soff = 0;
|
||||
struct in_addr dst4;
|
||||
struct icmp *icmp;
|
||||
struct mbuf *m;
|
||||
@ -1220,6 +1245,11 @@ int dst;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
slen = oip->ip_len;
|
||||
oip->ip_len = htons(oip->ip_len);
|
||||
soff = oip->ip_off;
|
||||
oip->ip_off = htons(ip->ip_off);
|
||||
|
||||
ip->ip_src.s_addr = dst4.s_addr;
|
||||
ip->ip_dst.s_addr = oip->ip_src.s_addr;
|
||||
|
||||
@ -1233,7 +1263,18 @@ int dst;
|
||||
ip->ip_len = iclen;
|
||||
ip->ip_p = IPPROTO_ICMP;
|
||||
}
|
||||
|
||||
shlen = fin->fin_hlen;
|
||||
fin->fin_hlen = hlen;
|
||||
err = send_ip(oip, fin, m);
|
||||
fin->fin_hlen = shlen;
|
||||
#ifdef USE_INET6
|
||||
if (fin->fin_v == 4)
|
||||
#endif
|
||||
{
|
||||
oip->ip_len = slen;
|
||||
oip->ip_off = soff;
|
||||
}
|
||||
return err;
|
||||
}
|
||||
|
||||
@ -1268,8 +1309,8 @@ register struct mbuf *m0;
|
||||
}
|
||||
|
||||
|
||||
int ipfr_fastroute(m0, fin, fdp)
|
||||
struct mbuf *m0;
|
||||
int ipfr_fastroute(m0, mpp, fin, fdp)
|
||||
struct mbuf *m0, **mpp;
|
||||
fr_info_t *fin;
|
||||
frdest_t *fdp;
|
||||
{
|
||||
@ -1282,16 +1323,49 @@ frdest_t *fdp;
|
||||
struct route iproute;
|
||||
frentry_t *fr;
|
||||
|
||||
#ifdef M_WRITABLE
|
||||
/*
|
||||
* HOT FIX/KLUDGE:
|
||||
*
|
||||
* If the mbuf we're about to send is not writable (because of
|
||||
* a cluster reference, for example) we'll need to make a copy
|
||||
* of it since this routine modifies the contents.
|
||||
*
|
||||
* If you have non-crappy network hardware that can transmit data
|
||||
* from the mbuf, rather than making a copy, this is gonna be a
|
||||
* problem.
|
||||
*/
|
||||
if (M_WRITABLE(m) == 0) {
|
||||
if ((m0 = m_dup(m, M_DONTWAIT)) != 0) {
|
||||
m_freem(m);
|
||||
m = m0;
|
||||
} else {
|
||||
error = ENOBUFS;
|
||||
m_freem(m);
|
||||
ipl_frouteok[1]++;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
hlen = fin->fin_hlen;
|
||||
ip = mtod(m0, struct ip *);
|
||||
|
||||
#if defined(__NetBSD__) && defined(M_CSUM_IPv4)
|
||||
/*
|
||||
* Clear any in-bound checksum flags for this packet.
|
||||
*/
|
||||
m0->m_pkthdr.csuminfo = 0;
|
||||
#endif /* __NetBSD__ && M_CSUM_IPv4 */
|
||||
|
||||
#ifdef USE_INET6
|
||||
if (ip->ip_v == 6) {
|
||||
/*
|
||||
* currently "to <if>" and "to <if>:ip#" are not supported
|
||||
* for IPv6
|
||||
*/
|
||||
return ip6_output(m0, NULL, NULL, 0, NULL, NULL);
|
||||
error = ip6_output(m0, NULL, NULL, 0, NULL, NULL);
|
||||
*mpp = NULL;
|
||||
return error;
|
||||
}
|
||||
#endif
|
||||
/*
|
||||
@ -1316,10 +1390,15 @@ frdest_t *fdp;
|
||||
*/
|
||||
if ((fr != NULL) && (fin->fin_rev != 0)) {
|
||||
if ((ifp != NULL) && (fdp == &fr->fr_tif))
|
||||
return -1;
|
||||
return 0;
|
||||
dst->sin_addr = ip->ip_dst;
|
||||
} else if (fdp)
|
||||
dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
|
||||
} else if (fdp) {
|
||||
if (fdp->fd_ip.s_addr) {
|
||||
dst->sin_addr = fdp->fd_ip;
|
||||
ip->ip_dst = fdp->fd_ip;
|
||||
} else
|
||||
dst->sin_addr = ip->ip_dst;
|
||||
}
|
||||
|
||||
# if BSD >= 199306
|
||||
dst->sin_len = sizeof(*dst);
|
||||
@ -1374,36 +1453,44 @@ frdest_t *fdp;
|
||||
* If small enough for interface, can just send directly.
|
||||
*/
|
||||
if (ip->ip_len <= ifp->if_mtu) {
|
||||
# if BSD >= 199306
|
||||
# if defined(MCLISREFERENCED) && !defined(sparc)
|
||||
int i = 0;
|
||||
|
||||
# ifdef MCLISREFERENCED
|
||||
if ((m->m_flags & M_EXT) && MCLISREFERENCED(m))
|
||||
# else
|
||||
if (m->m_flags & M_EXT)
|
||||
# endif
|
||||
i = 1;
|
||||
# endif
|
||||
# ifndef sparc
|
||||
# if !(_BSDI_VERSION >= 199510)
|
||||
ip->ip_id = htons(ip->ip_id);
|
||||
# endif
|
||||
ip->ip_len = htons(ip->ip_len);
|
||||
ip->ip_off = htons(ip->ip_off);
|
||||
# endif
|
||||
# if defined(__NetBSD__) && defined(M_CSUM_IPv4)
|
||||
if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
|
||||
m->m_pkthdr.csuminfo |= M_CSUM_IPv4;
|
||||
else if (ip->ip_sum == 0)
|
||||
ip->ip_sum = in_cksum(m, hlen);
|
||||
# else
|
||||
if (!ip->ip_sum)
|
||||
ip->ip_sum = in_cksum(m, hlen);
|
||||
# endif /* __NetBSD__ && M_CSUM_IPv4 */
|
||||
# if BSD >= 199306
|
||||
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
|
||||
ro->ro_rt);
|
||||
# if defined(MCLISREFERENCED) && !defined(sparc)
|
||||
if (i) {
|
||||
ip->ip_id = ntohs(ip->ip_id);
|
||||
ip->ip_len = ntohs(ip->ip_len);
|
||||
ip->ip_off = ntohs(ip->ip_off);
|
||||
}
|
||||
# endif
|
||||
# else
|
||||
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
|
||||
# endif
|
||||
goto done;
|
||||
}
|
||||
|
||||
/*
|
||||
* Too large for interface; fragment if possible.
|
||||
* Must be able to put at least 8 bytes per fragment.
|
||||
@ -1506,9 +1593,11 @@ frdest_t *fdp;
|
||||
else
|
||||
ipl_frouteok[1]++;
|
||||
|
||||
if (ro->ro_rt)
|
||||
if (ro->ro_rt) {
|
||||
RTFREE(ro->ro_rt);
|
||||
return 0;
|
||||
}
|
||||
*mpp = NULL;
|
||||
return error;
|
||||
bad:
|
||||
if (error == EMSGSIZE) {
|
||||
sifp = fin->fin_ifp;
|
||||
@ -1550,6 +1639,18 @@ void *ifp;
|
||||
return (ifp == iproute.ro_rt->rt_ifp);
|
||||
}
|
||||
|
||||
|
||||
# ifdef USE_GETIFNAME
|
||||
char *
|
||||
get_ifname(ifp)
|
||||
struct ifnet *ifp;
|
||||
{
|
||||
static char workbuf[64];
|
||||
|
||||
sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit);
|
||||
return workbuf;
|
||||
}
|
||||
# endif
|
||||
#else /* #ifdef _KERNEL */
|
||||
|
||||
|
||||
@ -1586,9 +1687,9 @@ ip_t *ip;
|
||||
|
||||
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
|
||||
(defined(OpenBSD) && (OpenBSD >= 199603))
|
||||
sprintf(fname, "/tmp/%s", ifp->if_xname);
|
||||
sprintf(fname, "%s", ifp->if_xname);
|
||||
# else
|
||||
sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
|
||||
sprintf(fname, "%s%d", ifp->if_name, ifp->if_unit);
|
||||
# endif
|
||||
fd = open(fname, O_WRONLY|O_APPEND);
|
||||
if (fd == -1) {
|
||||
@ -1605,7 +1706,7 @@ struct ifnet *get_unit(name, v)
|
||||
char *name;
|
||||
int v;
|
||||
{
|
||||
struct ifnet *ifp, **ifa;
|
||||
struct ifnet *ifp, **ifa, **old_ifneta;
|
||||
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
|
||||
(defined(OpenBSD) && (OpenBSD >= 199603))
|
||||
for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
|
||||
@ -1634,10 +1735,12 @@ int v;
|
||||
}
|
||||
nifs = 1;
|
||||
} else {
|
||||
old_ifneta = ifneta;
|
||||
nifs++;
|
||||
ifneta = (struct ifnet **)realloc(ifneta,
|
||||
(nifs + 1) * sizeof(*ifa));
|
||||
if (!ifneta) {
|
||||
free(old_ifneta);
|
||||
nifs = 0;
|
||||
return NULL;
|
||||
}
|
||||
@ -1704,28 +1807,6 @@ void init_ifp()
|
||||
}
|
||||
|
||||
|
||||
int ipfr_fastroute(ip, fin, fdp)
|
||||
ip_t *ip;
|
||||
fr_info_t *fin;
|
||||
frdest_t *fdp;
|
||||
{
|
||||
struct ifnet *ifp = fdp->fd_ifp;
|
||||
|
||||
if (!ifp)
|
||||
return 0; /* no routing table out here */
|
||||
|
||||
ip->ip_len = htons((u_short)ip->ip_len);
|
||||
ip->ip_off = htons((u_short)(ip->ip_off | IP_MF));
|
||||
ip->ip_sum = 0;
|
||||
#ifdef __sgi
|
||||
(*ifp->if_output)(ifp, (void *)ip, NULL);
|
||||
#else
|
||||
(*ifp->if_output)(ifp, (void *)ip, NULL, 0);
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
int ipllog __P((void))
|
||||
{
|
||||
verbose("l");
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ip_fil.h 1.35 6/5/96
|
||||
* $Id: ip_fil.h,v 2.29.2.4 2000/11/12 11:54:53 darrenr Exp $
|
||||
* $Id: ip_fil.h,v 2.29.2.10 2001/07/15 13:51:42 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IP_FIL_H__
|
||||
@ -59,7 +57,7 @@
|
||||
# define SIOCSTLCK _IOWR('r', 79, u_int)
|
||||
# define SIOCSTPUT _IOWR('r', 80, struct ipstate_save *)
|
||||
# define SIOCSTGET _IOWR('r', 81, struct ipstate_save *)
|
||||
# define SIOCSTGSZ _IOWR('r', 82, struct natget *)
|
||||
# define SIOCSTGSZ _IOWR('r', 82, struct natget)
|
||||
# define SIOCGFRST _IOWR('r', 83, struct ipfrstat *)
|
||||
#else
|
||||
# define SIOCADAFR _IOW(r, 60, struct frentry *)
|
||||
@ -84,7 +82,7 @@
|
||||
# define SIOCSTLCK _IOWR(r, 79, u_int)
|
||||
# define SIOCSTPUT _IOWR(r, 80, struct ipstate_save *)
|
||||
# define SIOCSTGET _IOWR(r, 81, struct ipstate_save *)
|
||||
# define SIOCSTGSZ _IOWR(r, 82, struct natget *)
|
||||
# define SIOCSTGSZ _IOWR(r, 82, struct natget)
|
||||
# define SIOCGFRST _IOWR(r, 83, struct ipfrstat *)
|
||||
#endif
|
||||
#define SIOCADDFR SIOCADAFR
|
||||
@ -152,7 +150,10 @@ typedef struct fr_info {
|
||||
u_short fin_off;
|
||||
} fr_info_t;
|
||||
|
||||
#define fin_v fin_fi.fi_v
|
||||
#define fin_v fin_fi.fi_v
|
||||
#define fin_saddr fin_fi.fi_saddr
|
||||
#define fin_daddr fin_fi.fi_daddr
|
||||
#define fin_fl fin_fi.fi_fl
|
||||
|
||||
/*
|
||||
* Size for compares on fr_info structures
|
||||
@ -168,6 +169,9 @@ typedef struct frdest {
|
||||
void *fd_ifp;
|
||||
struct in_addr fd_ip;
|
||||
char fd_ifname[IFNAMSIZ];
|
||||
#if SOLARIS
|
||||
mb_t *fd_mp; /* cache resolver for to/dup-to */
|
||||
#endif
|
||||
} frdest_t;
|
||||
|
||||
typedef struct frpcmp {
|
||||
@ -192,8 +196,6 @@ typedef struct frtuc {
|
||||
|
||||
typedef struct frentry {
|
||||
struct frentry *fr_next;
|
||||
u_32_t fr_group; /* group to which this rule belongs */
|
||||
u_32_t fr_grhead; /* group # which this rule starts */
|
||||
struct frentry *fr_grp;
|
||||
int fr_ref; /* reference count - for grouping */
|
||||
void *fr_ifa;
|
||||
@ -217,6 +219,8 @@ typedef struct frentry {
|
||||
u_short fr_icmp;
|
||||
|
||||
frtuc_t fr_tuc;
|
||||
u_32_t fr_group; /* group to which this rule belongs */
|
||||
u_32_t fr_grhead; /* group # which this rule starts */
|
||||
u_32_t fr_flags; /* per-rule flags && options (see below) */
|
||||
u_int fr_skip; /* # of rules to skip */
|
||||
u_int fr_loglevel; /* syslog log facility + priority */
|
||||
@ -436,6 +440,8 @@ typedef struct ipflog {
|
||||
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
|
||||
#define IPLLOGSIZE 8192
|
||||
|
||||
#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */
|
||||
|
||||
/*
|
||||
* Device filenames for reading log information. Use ipf on Solaris2 because
|
||||
* ipl is already a name used by something else.
|
||||
@ -484,7 +490,6 @@ extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
|
||||
extern int send_reset __P((ip_t *, struct ifnet *));
|
||||
extern int icmp_error __P((ip_t *, struct ifnet *));
|
||||
extern int ipf_log __P((void));
|
||||
extern int ipfr_fastroute __P((ip_t *, fr_info_t *, frdest_t *));
|
||||
extern struct ifnet *get_unit __P((char *, int));
|
||||
# if defined(__NetBSD__) || defined(__OpenBSD__) || \
|
||||
(_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
|
||||
@ -530,7 +535,7 @@ extern int iplread __P((dev_t, struct uio *, cred_t *));
|
||||
# else /* SOLARIS */
|
||||
extern int fr_check __P((ip_t *, int, void *, int, mb_t **));
|
||||
extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
|
||||
extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *));
|
||||
extern int ipfr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *));
|
||||
extern size_t mbufchainlen __P((mb_t *));
|
||||
# ifdef __sgi
|
||||
# include <sys/cred.h>
|
||||
|
@ -1,15 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#if defined(KERNEL) && !defined(_KERNEL)
|
||||
# define _KERNEL
|
||||
#endif
|
||||
@ -81,7 +74,7 @@ static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.7 2000/11/27 10:26:56 d
|
||||
# ifndef IPFILTER_LKM
|
||||
# include <sys/libkern.h>
|
||||
# include <sys/systm.h>
|
||||
# endif
|
||||
# endif
|
||||
extern struct callout_handle ipfr_slowtimer_ch;
|
||||
# endif
|
||||
#endif
|
||||
@ -89,6 +82,15 @@ extern struct callout_handle ipfr_slowtimer_ch;
|
||||
# include <sys/callout.h>
|
||||
extern struct callout ipfr_slowtimer_ch;
|
||||
#endif
|
||||
#if defined(__OpenBSD__)
|
||||
# include <sys/timeout.h>
|
||||
extern struct timeout ipfr_slowtimer_ch;
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.14 2001/07/15 22:06:15 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
static ipfr_t *ipfr_heads[IPFT_SIZE];
|
||||
@ -141,12 +143,15 @@ fr_info_t *fin;
|
||||
u_int pass;
|
||||
ipfr_t *table[];
|
||||
{
|
||||
ipfr_t **fp, *fra, frag;
|
||||
u_int idx;
|
||||
ipfr_t **fp, *fra, frag;
|
||||
u_int idx, off;
|
||||
|
||||
if (ipfr_inuse >= IPFT_SIZE)
|
||||
return NULL;
|
||||
|
||||
if (!(fin->fin_fl & FI_FRAG))
|
||||
return NULL;
|
||||
|
||||
frag.ipfr_p = ip->ip_p;
|
||||
idx = ip->ip_p;
|
||||
frag.ipfr_id = ip->ip_id;
|
||||
@ -160,6 +165,10 @@ ipfr_t *table[];
|
||||
idx *= 127;
|
||||
idx %= IPFT_SIZE;
|
||||
|
||||
frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
|
||||
frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
|
||||
frag.ipfr_auth = fin->fin_fi.fi_auth;
|
||||
|
||||
/*
|
||||
* first, make sure it isn't already there...
|
||||
*/
|
||||
@ -200,7 +209,10 @@ ipfr_t *table[];
|
||||
/*
|
||||
* Compute the offset of the expected start of the next packet.
|
||||
*/
|
||||
fra->ipfr_off = (ip->ip_off & IP_OFFMASK) + (fin->fin_dlen >> 3);
|
||||
off = ip->ip_off & IP_OFFMASK;
|
||||
if (!off)
|
||||
fra->ipfr_seen0 = 1;
|
||||
fra->ipfr_off = off + (fin->fin_dlen >> 3);
|
||||
ATOMIC_INCL(ipfr_stats.ifs_new);
|
||||
ATOMIC_INC32(ipfr_inuse);
|
||||
return fra;
|
||||
@ -219,7 +231,12 @@ u_int pass;
|
||||
WRITE_ENTER(&ipf_frag);
|
||||
ipf = ipfr_new(ip, fin, pass, ipfr_heads);
|
||||
RWLOCK_EXIT(&ipf_frag);
|
||||
return ipf ? 0 : -1;
|
||||
if (ipf == NULL) {
|
||||
ATOMIC_INCL(frstats[fin->fin_out].fr_bnfr);
|
||||
return -1;
|
||||
}
|
||||
ATOMIC_INCL(frstats[fin->fin_out].fr_nfr);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@ -230,9 +247,16 @@ u_int pass;
|
||||
nat_t *nat;
|
||||
{
|
||||
ipfr_t *ipf;
|
||||
int off;
|
||||
|
||||
if ((ip->ip_v != 4) || (fr_frag_lock))
|
||||
return -1;
|
||||
|
||||
off = fin->fin_off;
|
||||
off <<= 3;
|
||||
if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
|
||||
return NULL;
|
||||
|
||||
WRITE_ENTER(&ipf_natfrag);
|
||||
ipf = ipfr_new(ip, fin, pass, ipfr_nattab);
|
||||
if (ipf != NULL) {
|
||||
@ -254,8 +278,8 @@ fr_info_t *fin;
|
||||
ipfr_t *table[];
|
||||
{
|
||||
ipfr_t *f, frag;
|
||||
u_int idx;
|
||||
|
||||
u_int idx;
|
||||
|
||||
/*
|
||||
* For fragments, we record protocol, packet id, TOS and both IP#'s
|
||||
* (these should all be the same for all fragments of a packet).
|
||||
@ -275,6 +299,10 @@ ipfr_t *table[];
|
||||
idx *= 127;
|
||||
idx %= IPFT_SIZE;
|
||||
|
||||
frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
|
||||
frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
|
||||
frag.ipfr_auth = fin->fin_fi.fi_auth;
|
||||
|
||||
/*
|
||||
* check the table, careful to only compare the right amount of data
|
||||
*/
|
||||
@ -283,6 +311,20 @@ ipfr_t *table[];
|
||||
IPFR_CMPSZ)) {
|
||||
u_short atoff, off;
|
||||
|
||||
off = fin->fin_off;
|
||||
|
||||
/*
|
||||
* XXX - We really need to be guarding against the
|
||||
* retransmission of (src,dst,id,offset-range) here
|
||||
* because a fragmented packet is never resent with
|
||||
* the same IP ID#.
|
||||
*/
|
||||
if (f->ipfr_seen0) {
|
||||
if (!off || (fin->fin_fl & FI_SHORT))
|
||||
continue;
|
||||
} else if (!off)
|
||||
f->ipfr_seen0 = 1;
|
||||
|
||||
if (f != table[idx]) {
|
||||
/*
|
||||
* move fragment info. to the top of the list
|
||||
@ -295,7 +337,6 @@ ipfr_t *table[];
|
||||
f->ipfr_prev = NULL;
|
||||
table[idx] = f;
|
||||
}
|
||||
off = ip->ip_off & IP_OFFMASK;
|
||||
atoff = off + (fin->fin_dlen >> 3);
|
||||
/*
|
||||
* If we've follwed the fragments, and this is the
|
||||
@ -321,11 +362,18 @@ nat_t *ipfr_nat_knownfrag(ip, fin)
|
||||
ip_t *ip;
|
||||
fr_info_t *fin;
|
||||
{
|
||||
nat_t *nat;
|
||||
ipfr_t *ipf;
|
||||
ipfr_t *ipf;
|
||||
nat_t *nat;
|
||||
int off;
|
||||
|
||||
if ((ip->ip_v != 4) || (fr_frag_lock))
|
||||
if ((fin->fin_v != 4) || (fr_frag_lock))
|
||||
return NULL;
|
||||
|
||||
off = fin->fin_off;
|
||||
off <<= 3;
|
||||
if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
|
||||
return NULL;
|
||||
|
||||
READ_ENTER(&ipf_natfrag);
|
||||
ipf = ipfr_lookup(ip, fin, ipfr_nattab);
|
||||
if (ipf != NULL) {
|
||||
@ -351,15 +399,24 @@ frentry_t *ipfr_knownfrag(ip, fin)
|
||||
ip_t *ip;
|
||||
fr_info_t *fin;
|
||||
{
|
||||
frentry_t *fr = NULL;
|
||||
ipfr_t *fra;
|
||||
frentry_t *fr;
|
||||
ipfr_t *fra;
|
||||
int off;
|
||||
|
||||
if ((ip->ip_v != 4) || (fr_frag_lock))
|
||||
if ((fin->fin_v != 4) || (fr_frag_lock))
|
||||
return NULL;
|
||||
|
||||
off = fin->fin_off;
|
||||
off <<= 3;
|
||||
if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
|
||||
return NULL;
|
||||
|
||||
READ_ENTER(&ipf_frag);
|
||||
fra = ipfr_lookup(ip, fin, ipfr_heads);
|
||||
if (fra != NULL)
|
||||
fr = fra->ipfr_rule;
|
||||
else
|
||||
fr = NULL;
|
||||
RWLOCK_EXIT(&ipf_frag);
|
||||
return fr;
|
||||
}
|
||||
@ -544,7 +601,11 @@ int ipfr_slowtimer()
|
||||
# if (__FreeBSD_version >= 300000)
|
||||
ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
|
||||
# else
|
||||
# if defined(__OpenBSD_)
|
||||
timeout_add(&ipfr_slowtimer_ch, hz/2, ipfr_slowtimer, NULL);
|
||||
# else
|
||||
timeout(ipfr_slowtimer, NULL, hz/2);
|
||||
# endif
|
||||
# endif
|
||||
# if (BSD < 199306) && !defined(__sgi)
|
||||
return 0;
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ip_frag.h 1.5 3/24/96
|
||||
* $Id: ip_frag.h,v 2.4.2.2 2000/11/10 13:10:54 darrenr Exp $
|
||||
* $Id: ip_frag.h,v 2.4.2.5 2001/06/26 10:43:13 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IP_FRAG_H__
|
||||
@ -20,11 +18,15 @@ typedef struct ipfr {
|
||||
struct in_addr ipfr_src;
|
||||
struct in_addr ipfr_dst;
|
||||
void *ipfr_ifp;
|
||||
u_32_t ipfr_optmsk;
|
||||
u_short ipfr_secmsk;
|
||||
u_short ipfr_auth;
|
||||
u_short ipfr_id;
|
||||
u_char ipfr_p;
|
||||
u_char ipfr_tos;
|
||||
u_short ipfr_off;
|
||||
u_short ipfr_ttl;
|
||||
u_char ipfr_ttl;
|
||||
u_char ipfr_seen0;
|
||||
frentry_t *ipfr_rule;
|
||||
} ipfr_t;
|
||||
|
||||
@ -40,7 +42,8 @@ typedef struct ipfrstat {
|
||||
struct ipfr **ifs_nattab;
|
||||
} ipfrstat_t;
|
||||
|
||||
#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1)
|
||||
#define IPFR_CMPSZ (offsetof(ipfr_t, ipfr_off) - \
|
||||
offsetof(ipfr_t, ipfr_src))
|
||||
|
||||
extern int fr_ipfrttl;
|
||||
extern int fr_frag_lock;
|
||||
|
@ -2,7 +2,7 @@
|
||||
* Simple FTP transparent proxy for in-kernel use. For use with the NAT
|
||||
* code.
|
||||
*
|
||||
* $Id: ip_ftp_pxy.c,v 2.7.2.20 2000/12/02 00:15:06 darrenr Exp $
|
||||
* $Id: ip_ftp_pxy.c,v 2.7.2.26 2001/07/15 13:50:54 darrenr Exp $
|
||||
*/
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
extern kmutex_t ipf_rw;
|
||||
@ -22,6 +22,22 @@ extern kmutex_t ipf_rw;
|
||||
#define IPF_MAX227LEN 51
|
||||
#define IPF_FTPBUFSZ 96 /* This *MUST* be >= 53! */
|
||||
|
||||
#define FTPXY_GO 0
|
||||
#define FTPXY_INIT 1
|
||||
#define FTPXY_USER_1 2
|
||||
#define FTPXY_USOK_1 3
|
||||
#define FTPXY_PASS_1 4
|
||||
#define FTPXY_PAOK_1 5
|
||||
#define FTPXY_AUTH_1 6
|
||||
#define FTPXY_AUOK_1 7
|
||||
#define FTPXY_ADAT_1 8
|
||||
#define FTPXY_ADOK_1 9
|
||||
#define FTPXY_ACCT_1 10
|
||||
#define FTPXY_ACOK_1 11
|
||||
#define FTPXY_USER_2 12
|
||||
#define FTPXY_USOK_2 13
|
||||
#define FTPXY_PASS_2 14
|
||||
#define FTPXY_PAOK_2 15
|
||||
|
||||
int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
|
||||
int ippr_ftp_complete __P((char *, size_t));
|
||||
@ -75,6 +91,7 @@ nat_t *nat;
|
||||
f = &ftp->ftp_side[1];
|
||||
f->ftps_rptr = f->ftps_buf;
|
||||
f->ftps_wptr = f->ftps_buf;
|
||||
ftp->ftp_passok = FTPXY_INIT;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -215,7 +232,7 @@ int dlen;
|
||||
sum2 -= sum1;
|
||||
sum2 = (sum2 & 0xffff) + (sum2 >> 16);
|
||||
|
||||
fix_outcksum(&ip->ip_sum, sum2);
|
||||
fix_outcksum(fin, &ip->ip_sum, sum2);
|
||||
#endif
|
||||
ip->ip_len += inc;
|
||||
}
|
||||
@ -255,6 +272,7 @@ int dlen;
|
||||
fi.fin_dlen = sizeof(*tcp2);
|
||||
fi.fin_dp = (char *)tcp2;
|
||||
fi.fin_fr = &natfr;
|
||||
fi.fin_out = 1;
|
||||
swip = ip->ip_src;
|
||||
fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
|
||||
ip->ip_src = nat->nat_inip;
|
||||
@ -297,11 +315,36 @@ int dlen;
|
||||
}
|
||||
cmd[i] = '\0';
|
||||
|
||||
if ((ftp->ftp_passok == 0) && !strncmp(cmd, "USER ", 5))
|
||||
ftp->ftp_passok = 1;
|
||||
else if ((ftp->ftp_passok == 2) && !strncmp(cmd, "PASS ", 5))
|
||||
ftp->ftp_passok = 3;
|
||||
else if ((ftp->ftp_passok == 4) && !ippr_ftp_pasvonly &&
|
||||
ftp->ftp_incok = 0;
|
||||
if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) {
|
||||
if (ftp->ftp_passok == FTPXY_ADOK_1 ||
|
||||
ftp->ftp_passok == FTPXY_AUOK_1) {
|
||||
ftp->ftp_passok = FTPXY_USER_2;
|
||||
ftp->ftp_incok = 1;
|
||||
} else {
|
||||
ftp->ftp_passok = FTPXY_USER_1;
|
||||
ftp->ftp_incok = 1;
|
||||
}
|
||||
} else if (!strncmp(cmd, "AUTH ", 5)) {
|
||||
ftp->ftp_passok = FTPXY_AUTH_1;
|
||||
ftp->ftp_incok = 1;
|
||||
} else if (!strncmp(cmd, "PASS ", 5)) {
|
||||
if (ftp->ftp_passok == FTPXY_USOK_1) {
|
||||
ftp->ftp_passok = FTPXY_PASS_1;
|
||||
ftp->ftp_incok = 1;
|
||||
} else if (ftp->ftp_passok == FTPXY_USOK_2) {
|
||||
ftp->ftp_passok = FTPXY_PASS_2;
|
||||
ftp->ftp_incok = 1;
|
||||
}
|
||||
} else if ((ftp->ftp_passok == FTPXY_AUOK_1) &&
|
||||
!strncmp(cmd, "ADAT ", 5)) {
|
||||
ftp->ftp_passok = FTPXY_ADAT_1;
|
||||
ftp->ftp_incok = 1;
|
||||
} else if ((ftp->ftp_passok == FTPXY_PAOK_2) &&
|
||||
!strncmp(cmd, "ACCT ", 5)) {
|
||||
ftp->ftp_passok = FTPXY_ACCT_1;
|
||||
ftp->ftp_incok = 1;
|
||||
} else if ((ftp->ftp_passok == FTPXY_GO) && !ippr_ftp_pasvonly &&
|
||||
!strncmp(cmd, "PORT ", 5)) {
|
||||
inc = ippr_ftp_port(fin, ip, nat, f, dlen);
|
||||
} else if (ippr_ftp_insecure && !ippr_ftp_pasvonly &&
|
||||
@ -332,12 +375,13 @@ int dlen;
|
||||
int inc;
|
||||
char *s;
|
||||
|
||||
#define PASV_REPLEN 24
|
||||
/*
|
||||
* Check for PASV reply message.
|
||||
*/
|
||||
if (dlen < IPF_MIN227LEN)
|
||||
return 0;
|
||||
else if (strncmp(f->ftps_rptr, "227 Entering Passive Mode", 25))
|
||||
else if (strncmp(f->ftps_rptr, "227 Entering Passive Mod", PASV_REPLEN))
|
||||
return 0;
|
||||
|
||||
tcp = (tcphdr_t *)fin->fin_dp;
|
||||
@ -345,7 +389,7 @@ int dlen;
|
||||
/*
|
||||
* Skip the PORT command + space
|
||||
*/
|
||||
s = f->ftps_rptr + 25;
|
||||
s = f->ftps_rptr + PASV_REPLEN;
|
||||
while (*s && !isdigit(*s))
|
||||
s++;
|
||||
/*
|
||||
@ -373,6 +417,8 @@ int dlen;
|
||||
|
||||
if (*s == ')')
|
||||
s++;
|
||||
if (*s == '.')
|
||||
s++;
|
||||
if (*s == '\n')
|
||||
s--;
|
||||
/*
|
||||
@ -445,7 +491,7 @@ int dlen;
|
||||
sum2 -= sum1;
|
||||
sum2 = (sum2 & 0xffff) + (sum2 >> 16);
|
||||
|
||||
fix_outcksum(&ip->ip_sum, sum2);
|
||||
fix_outcksum(fin, &ip->ip_sum, sum2);
|
||||
#endif /* SOLARIS || defined(__sgi) */
|
||||
ip->ip_len += inc;
|
||||
}
|
||||
@ -469,12 +515,13 @@ int dlen;
|
||||
tcp2->th_win = htons(8192);
|
||||
tcp2->th_sport = 0; /* XXX - fake it for nat_new */
|
||||
tcp2->th_off = 5;
|
||||
fi.fin_data[1] = a5 << 8 | a6;
|
||||
fi.fin_data[0] = a5 << 8 | a6;
|
||||
fi.fin_dlen = sizeof(*tcp2);
|
||||
tcp2->th_dport = htons(fi.fin_data[1]);
|
||||
fi.fin_data[0] = 0;
|
||||
tcp2->th_dport = htons(fi.fin_data[0]);
|
||||
fi.fin_data[1] = 0;
|
||||
fi.fin_dp = (char *)tcp2;
|
||||
fi.fin_fr = &natfr;
|
||||
fi.fin_out = 1;
|
||||
swip = ip->ip_src;
|
||||
swip2 = ip->ip_dst;
|
||||
fi.fin_fi.fi_daddr = ip->ip_src.s_addr;
|
||||
@ -511,17 +558,38 @@ int dlen;
|
||||
rptr = f->ftps_rptr;
|
||||
wptr = f->ftps_wptr;
|
||||
|
||||
if ((ftp->ftp_passok == 1) && !strncmp(rptr, "331", 3))
|
||||
ftp->ftp_passok = 2;
|
||||
else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "230", 3))
|
||||
ftp->ftp_passok = 4;
|
||||
else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "530", 3))
|
||||
ftp->ftp_passok = 0;
|
||||
else if ((ftp->ftp_passok == 4) && !strncmp(rptr, "227 ", 4)) {
|
||||
inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
|
||||
if (!isdigit(*rptr) || !isdigit(*(rptr + 1)) || !isdigit(*(rptr + 2)))
|
||||
return inc;
|
||||
if (ftp->ftp_passok == FTPXY_GO) {
|
||||
if (!strncmp(rptr, "227 ", 4))
|
||||
inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
|
||||
} else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) {
|
||||
inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
|
||||
} else if (*rptr == '5' || *rptr == '4')
|
||||
ftp->ftp_passok = FTPXY_INIT;
|
||||
else if (ftp->ftp_incok) {
|
||||
if (*rptr == '3') {
|
||||
if (ftp->ftp_passok == FTPXY_ACCT_1)
|
||||
ftp->ftp_passok = FTPXY_GO;
|
||||
else
|
||||
ftp->ftp_passok++;
|
||||
} else if (*rptr == '2') {
|
||||
switch (ftp->ftp_passok)
|
||||
{
|
||||
case FTPXY_USER_1 :
|
||||
case FTPXY_USER_2 :
|
||||
case FTPXY_PASS_1 :
|
||||
case FTPXY_PASS_2 :
|
||||
case FTPXY_ACCT_1 :
|
||||
ftp->ftp_passok = FTPXY_GO;
|
||||
break;
|
||||
default :
|
||||
ftp->ftp_passok += 3;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
ftp->ftp_incok = 0;
|
||||
while ((*rptr++ != '\n') && (rptr < wptr))
|
||||
;
|
||||
f->ftps_rptr = rptr;
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6 2000/03/13 22:10:21 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ip_lfil.c,v 2.6.2.2 2001/07/18 14:57:09 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#if defined(KERNEL) && !defined(_KERNEL)
|
||||
@ -337,7 +335,7 @@ int iplioctl(dev_t dev, int cmd, caddr_t data, int mode)
|
||||
break;
|
||||
}
|
||||
case SIOCATHST :
|
||||
error = fr_auth_ioctl(data, cmd, NULL, NULL);
|
||||
error = fr_auth_ioctl(data, mode, cmd, NULL, NULL);
|
||||
break;
|
||||
case SIOCFRSYN :
|
||||
if (!(mode & FWRITE))
|
||||
@ -484,7 +482,7 @@ caddr_t data;
|
||||
if (fg && fg->fg_head)
|
||||
fg->fg_head->fr_ref--;
|
||||
if (unit == IPL_LOGAUTH)
|
||||
return fr_auth_ioctl(data, req, f, ftail);
|
||||
return fr_auth_ioctl(data, mode, req, f, ftail);
|
||||
if (f->fr_grhead)
|
||||
fr_delgroup((u_int)f->fr_grhead, fp->fr_flags,
|
||||
unit, set);
|
||||
@ -497,7 +495,7 @@ caddr_t data;
|
||||
error = EEXIST;
|
||||
else {
|
||||
if (unit == IPL_LOGAUTH)
|
||||
return fr_auth_ioctl(data, req, f, ftail);
|
||||
return fr_auth_ioctl(data, mode, req, f, ftail);
|
||||
KMALLOC(f, frentry_t *);
|
||||
if (f != NULL) {
|
||||
if (fg && fg->fg_head)
|
||||
|
@ -1,11 +1,9 @@
|
||||
/*
|
||||
* Copyright (C) 1997-2000 by Darren Reed.
|
||||
* Copyright (C) 1997-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* $Id: ip_log.c,v 2.5.2.2 2000/08/13 03:50:41 darrenr Exp $
|
||||
* $Id: ip_log.c,v 2.5.2.5 2001/06/26 10:43:14 darrenr Exp $
|
||||
*/
|
||||
#include <sys/param.h>
|
||||
#if defined(KERNEL) && !defined(_KERNEL)
|
||||
@ -21,7 +19,13 @@
|
||||
# endif
|
||||
# else
|
||||
# ifdef KLD_MODULE
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
@ -45,7 +49,7 @@
|
||||
# include <sys/ioctl.h>
|
||||
# endif
|
||||
# include <sys/time.h>
|
||||
# if defined(_KERNEL) && !defined(linux)
|
||||
# if defined(_KERNEL)
|
||||
# include <sys/systm.h>
|
||||
# endif
|
||||
# include <sys/uio.h>
|
||||
@ -55,9 +59,7 @@
|
||||
# else
|
||||
# include <sys/dir.h>
|
||||
# endif
|
||||
# ifndef linux
|
||||
# include <sys/mbuf.h>
|
||||
# endif
|
||||
# include <sys/mbuf.h>
|
||||
# else
|
||||
# include <sys/filio.h>
|
||||
# include <sys/cred.h>
|
||||
@ -69,9 +71,7 @@
|
||||
# include <sys/dditypes.h>
|
||||
# include <sys/cmn_err.h>
|
||||
# endif
|
||||
# ifndef linux
|
||||
# include <sys/protosw.h>
|
||||
# endif
|
||||
# include <sys/protosw.h>
|
||||
# include <sys/socket.h>
|
||||
|
||||
# include <net/if.h>
|
||||
@ -89,7 +89,7 @@
|
||||
# include <sys/hashing.h>
|
||||
# endif
|
||||
# endif
|
||||
# if !defined(linux) && !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/
|
||||
# if !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/
|
||||
# include <netinet/in_var.h>
|
||||
# endif
|
||||
# include <netinet/in_systm.h>
|
||||
@ -97,9 +97,7 @@
|
||||
# include <netinet/tcp.h>
|
||||
# include <netinet/udp.h>
|
||||
# include <netinet/ip_icmp.h>
|
||||
# ifndef linux
|
||||
# include <netinet/ip_var.h>
|
||||
# endif
|
||||
# include <netinet/ip_var.h>
|
||||
# ifndef _KERNEL
|
||||
# include <syslog.h>
|
||||
# endif
|
||||
@ -130,9 +128,6 @@ extern kcondvar_t iplwait;
|
||||
iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1], *ipll[IPL_LOGMAX+1];
|
||||
size_t iplused[IPL_LOGMAX+1];
|
||||
static fr_info_t iplcrc[IPL_LOGMAX+1];
|
||||
# ifdef linux
|
||||
static struct wait_queue *iplwait[IPL_LOGMAX+1];
|
||||
# endif
|
||||
|
||||
|
||||
/*
|
||||
@ -229,9 +224,7 @@ mb_t *m;
|
||||
(defined(OpenBSD) && (OpenBSD >= 199603))
|
||||
strncpy(ipfl.fl_ifname, ifp->if_xname, IFNAMSIZ);
|
||||
# else
|
||||
# ifndef linux
|
||||
ipfl.fl_unit = (u_char)ifp->if_unit;
|
||||
# endif
|
||||
if ((ipfl.fl_ifname[0] = ifp->if_name[0]))
|
||||
if ((ipfl.fl_ifname[1] = ifp->if_name[1]))
|
||||
if ((ipfl.fl_ifname[2] = ifp->if_name[2]))
|
||||
@ -337,7 +330,7 @@ int *types, cnt;
|
||||
ipl->ipl_count = 1;
|
||||
ipl->ipl_next = NULL;
|
||||
ipl->ipl_dsize = len;
|
||||
# if SOLARIS || defined(sun) || defined(linux)
|
||||
# if SOLARIS || defined(sun)
|
||||
uniqtime((struct timeval *)&ipl->ipl_sec);
|
||||
# else
|
||||
# if BSD >= 199306 || defined(__FreeBSD__) || defined(__sgi)
|
||||
@ -370,11 +363,7 @@ int *types, cnt;
|
||||
mutex_exit(&ipl_mutex);
|
||||
# else
|
||||
MUTEX_EXIT(&ipl_mutex);
|
||||
# ifdef linux
|
||||
wake_up_interruptible(&iplwait[dev]);
|
||||
# else
|
||||
wakeup(&iplh[dev]);
|
||||
# endif
|
||||
# endif
|
||||
return 1;
|
||||
}
|
||||
@ -399,8 +388,7 @@ struct uio *uio;
|
||||
return ENXIO;
|
||||
if (!uio->uio_resid)
|
||||
return 0;
|
||||
if ((uio->uio_resid < sizeof(iplog_t)) ||
|
||||
(uio->uio_resid > IPLLOGSIZE))
|
||||
if (uio->uio_resid < sizeof(iplog_t))
|
||||
return EINVAL;
|
||||
|
||||
/*
|
||||
@ -417,19 +405,13 @@ struct uio *uio;
|
||||
return EINTR;
|
||||
}
|
||||
# else
|
||||
# ifdef linux
|
||||
interruptible_sleep_on(&iplwait[unit]);
|
||||
if (current->signal & ~current->blocked)
|
||||
return -EINTR;
|
||||
# else
|
||||
MUTEX_EXIT(&ipl_mutex);
|
||||
SPL_X(s);
|
||||
error = SLEEP(&iplh[unit], "ipl sleep");
|
||||
if (error)
|
||||
if (error) {
|
||||
SPL_X(s);
|
||||
return error;
|
||||
SPL_NET(s);
|
||||
}
|
||||
MUTEX_ENTER(&ipl_mutex);
|
||||
# endif /* linux */
|
||||
# endif /* SOLARIS */
|
||||
}
|
||||
|
||||
@ -447,10 +429,8 @@ struct uio *uio;
|
||||
iplt[unit] = ipl->ipl_next;
|
||||
iplused[unit] -= dlen;
|
||||
MUTEX_EXIT(&ipl_mutex);
|
||||
SPL_X(s);
|
||||
error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio);
|
||||
if (error) {
|
||||
SPL_NET(s);
|
||||
MUTEX_ENTER(&ipl_mutex);
|
||||
ipl->ipl_next = iplt[unit];
|
||||
iplt[unit] = ipl;
|
||||
@ -458,7 +438,6 @@ struct uio *uio;
|
||||
break;
|
||||
}
|
||||
KFREES((caddr_t)ipl, dlen);
|
||||
SPL_NET(s);
|
||||
MUTEX_ENTER(&ipl_mutex);
|
||||
}
|
||||
if (!iplt[unit]) {
|
||||
@ -469,13 +448,7 @@ struct uio *uio;
|
||||
|
||||
MUTEX_EXIT(&ipl_mutex);
|
||||
SPL_X(s);
|
||||
# ifdef linux
|
||||
if (!error)
|
||||
return (int)copied;
|
||||
return -error;
|
||||
# else
|
||||
return error;
|
||||
# endif
|
||||
}
|
||||
|
||||
|
||||
|
@ -1,17 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com)
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.32 2001/01/10 06:19:11 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
|
||||
#define _KERNEL
|
||||
#endif
|
||||
@ -91,6 +84,7 @@ extern struct ifnet vpnif;
|
||||
|
||||
#ifndef linux
|
||||
# include <netinet/ip_var.h>
|
||||
# include <netinet/tcp_fsm.h>
|
||||
#endif
|
||||
#include <netinet/tcp.h>
|
||||
#include <netinet/udp.h>
|
||||
@ -111,6 +105,11 @@ extern struct ifnet vpnif;
|
||||
#undef SOCKADDR_IN
|
||||
#define SOCKADDR_IN struct sockaddr_in
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.44 2001/07/21 07:17:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
nat_t **nat_table[2] = { NULL, NULL },
|
||||
*nat_instances = NULL;
|
||||
ipnat_t *nat_list = NULL;
|
||||
@ -301,7 +300,8 @@ struct hostmap *hm;
|
||||
}
|
||||
|
||||
|
||||
void fix_outcksum(sp, n)
|
||||
void fix_outcksum(fin, sp, n)
|
||||
fr_info_t *fin;
|
||||
u_short *sp;
|
||||
u_32_t n;
|
||||
{
|
||||
@ -310,12 +310,13 @@ u_32_t n;
|
||||
|
||||
if (!n)
|
||||
return;
|
||||
#if SOLARIS2 >= 6
|
||||
else if (n & NAT_HW_CKSUM) {
|
||||
n &= 0xffff;
|
||||
n += fin->fin_dlen;
|
||||
n = (n & 0xffff) + (n >> 16);
|
||||
*sp = n & 0xffff;
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
sum1 = (~ntohs(*sp)) & 0xffff;
|
||||
sum1 += (n);
|
||||
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
|
||||
@ -326,7 +327,8 @@ u_32_t n;
|
||||
}
|
||||
|
||||
|
||||
void fix_incksum(sp, n)
|
||||
void fix_incksum(fin, sp, n)
|
||||
fr_info_t *fin;
|
||||
u_short *sp;
|
||||
u_32_t n;
|
||||
{
|
||||
@ -335,12 +337,13 @@ u_32_t n;
|
||||
|
||||
if (!n)
|
||||
return;
|
||||
#if SOLARIS2 >= 6
|
||||
else if (n & NAT_HW_CKSUM) {
|
||||
n &= 0xffff;
|
||||
n += fin->fin_dlen;
|
||||
n = (n & 0xffff) + (n >> 16);
|
||||
*sp = n & 0xffff;
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
#ifdef sparc
|
||||
sum1 = (~(*sp)) & 0xffff;
|
||||
#else
|
||||
@ -625,9 +628,11 @@ int mode;
|
||||
nat_stats.ns_table[0] = nat_table[0];
|
||||
nat_stats.ns_table[1] = nat_table[1];
|
||||
nat_stats.ns_list = nat_list;
|
||||
nat_stats.ns_maptable = maptable;
|
||||
nat_stats.ns_nattab_sz = ipf_nattable_sz;
|
||||
nat_stats.ns_rultab_sz = ipf_natrules_sz;
|
||||
nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
|
||||
nat_stats.ns_hostmap_sz = ipf_hostmap_sz;
|
||||
nat_stats.ns_instances = nat_instances;
|
||||
nat_stats.ns_apslist = ap_sess_list;
|
||||
error = IWCOPYPTR((char *)&nat_stats, (char *)data,
|
||||
@ -1395,14 +1400,14 @@ int direction;
|
||||
CALC_SUMD(sum1, sum2, sumd);
|
||||
nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
|
||||
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
|
||||
if ((flags == IPN_TCP) && dohwcksum &&
|
||||
if ((flags & IPN_TCPUDP) && dohwcksum &&
|
||||
(qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
|
||||
if (direction == NAT_OUTBOUND)
|
||||
sum1 = LONG_SUM(ntohl(in.s_addr));
|
||||
else
|
||||
sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
|
||||
sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr));
|
||||
sum1 += 30;
|
||||
sum1 += IPPROTO_TCP;
|
||||
sum1 = (sum1 & 0xffff) + (sum1 >> 16);
|
||||
nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
|
||||
} else
|
||||
@ -1463,8 +1468,8 @@ int direction;
|
||||
void nat_insert(nat)
|
||||
nat_t *nat;
|
||||
{
|
||||
u_int hv1, hv2;
|
||||
nat_t **natp;
|
||||
u_int hv;
|
||||
|
||||
MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
|
||||
|
||||
@ -1477,18 +1482,30 @@ nat_t *nat;
|
||||
nat->nat_next = nat_instances;
|
||||
nat_instances = nat;
|
||||
|
||||
hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
|
||||
ipf_nattable_sz);
|
||||
natp = &nat_table[0][hv];
|
||||
if (!(nat->nat_flags & (FI_W_SPORT|FI_W_DPORT))) {
|
||||
hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
|
||||
0xffffffff);
|
||||
hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
|
||||
ipf_nattable_sz);
|
||||
hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
|
||||
0xffffffff);
|
||||
hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
|
||||
ipf_nattable_sz);
|
||||
} else {
|
||||
hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
|
||||
hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, ipf_nattable_sz);
|
||||
hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
|
||||
hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, ipf_nattable_sz);
|
||||
}
|
||||
|
||||
natp = &nat_table[0][hv1];
|
||||
if (*natp)
|
||||
(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
|
||||
nat->nat_phnext[0] = natp;
|
||||
nat->nat_hnext[0] = *natp;
|
||||
*natp = nat;
|
||||
|
||||
hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
|
||||
ipf_nattable_sz);
|
||||
natp = &nat_table[1][hv];
|
||||
natp = &nat_table[1][hv2];
|
||||
if (*natp)
|
||||
(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
|
||||
nat->nat_phnext[1] = natp;
|
||||
@ -1604,7 +1621,7 @@ int dir;
|
||||
ip_t *oip;
|
||||
int flags = 0;
|
||||
|
||||
if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK))
|
||||
if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0))
|
||||
return NULL;
|
||||
/*
|
||||
* nat_icmplookup() will return NULL for `defective' packets.
|
||||
@ -1878,13 +1895,14 @@ int dir;
|
||||
sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
|
||||
sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
|
||||
if (nat->nat_dir == NAT_OUTBOUND) {
|
||||
fix_outcksum(&icmp->icmp_cksum, sumd2);
|
||||
fix_outcksum(fin, &icmp->icmp_cksum, sumd2);
|
||||
} else {
|
||||
fix_incksum(&icmp->icmp_cksum, sumd2);
|
||||
fix_incksum(fin, &icmp->icmp_cksum, sumd2);
|
||||
}
|
||||
}
|
||||
}
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
if (oip->ip_p == IPPROTO_ICMP)
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
return nat;
|
||||
}
|
||||
|
||||
@ -1917,7 +1935,8 @@ int rw;
|
||||
sport = ports & 0xffff;
|
||||
flags &= IPN_TCPUDP;
|
||||
|
||||
hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(dst, dport, 0xffffffff);
|
||||
hv = NAT_HASH_FN(src.s_addr, hv + sport, ipf_nattable_sz);
|
||||
nat = nat_table[1][hv];
|
||||
for (; nat; nat = nat->nat_hnext[1]) {
|
||||
nflags = nat->nat_flags;
|
||||
@ -1935,7 +1954,8 @@ int rw;
|
||||
if (!rw) {
|
||||
RWLOCK_EXIT(&ipf_nat);
|
||||
}
|
||||
hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(dst, 0, 0xffffffff);
|
||||
hv = NAT_HASH_FN(src.s_addr, hv, ipf_nattable_sz);
|
||||
if (!rw) {
|
||||
WRITE_ENTER(&ipf_nat);
|
||||
}
|
||||
@ -1999,7 +2019,8 @@ u_32_t ports;
|
||||
/*
|
||||
* Add into the NAT table in the new position
|
||||
*/
|
||||
hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, 0xffffffff);
|
||||
hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
|
||||
natp = &nat_table[0][hv];
|
||||
if (*natp)
|
||||
(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
|
||||
@ -2007,7 +2028,8 @@ u_32_t ports;
|
||||
nat->nat_hnext[0] = *natp;
|
||||
*natp = nat;
|
||||
|
||||
hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, 0xffffffff);
|
||||
hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
|
||||
natp = &nat_table[1][hv];
|
||||
if (*natp)
|
||||
(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
|
||||
@ -2041,7 +2063,8 @@ int rw;
|
||||
flags &= IPN_TCPUDP;
|
||||
srcip = src.s_addr;
|
||||
|
||||
hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
|
||||
hv = NAT_HASH_FN(dst.s_addr, hv + dport, ipf_nattable_sz);
|
||||
nat = nat_table[0][hv];
|
||||
for (; nat; nat = nat->nat_hnext[0]) {
|
||||
nflags = nat->nat_flags;
|
||||
@ -2061,6 +2084,7 @@ int rw;
|
||||
RWLOCK_EXIT(&ipf_nat);
|
||||
}
|
||||
hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz);
|
||||
hv = NAT_HASH_FN(dst.s_addr, hv, ipf_nattable_sz);
|
||||
if (!rw) {
|
||||
WRITE_ENTER(&ipf_nat);
|
||||
}
|
||||
@ -2145,8 +2169,8 @@ ip_t *ip;
|
||||
}
|
||||
|
||||
ft = &np->in_tuc;
|
||||
if (!(fin->fin_fi.fi_fl & FI_TCPUDP) ||
|
||||
(fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) {
|
||||
if (!(fin->fin_fl & FI_TCPUDP) ||
|
||||
(fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) {
|
||||
if (ft->ftu_scmp || ft->ftu_dcmp)
|
||||
return 0;
|
||||
return 1;
|
||||
@ -2168,13 +2192,12 @@ fr_info_t *fin;
|
||||
register u_32_t ipa;
|
||||
tcphdr_t *tcp = NULL;
|
||||
u_short sport = 0, dport = 0, *csump = NULL;
|
||||
struct ifnet *ifp;
|
||||
int natadd = 1;
|
||||
frentry_t *fr;
|
||||
int natadd = 1, i, icmpset = 1;
|
||||
u_int nflags = 0, hv, msk;
|
||||
struct ifnet *ifp;
|
||||
frentry_t *fr;
|
||||
u_32_t iph;
|
||||
nat_t *nat;
|
||||
int i;
|
||||
|
||||
if (nat_list == NULL || (fr_nat_lock))
|
||||
return 0;
|
||||
@ -2185,7 +2208,7 @@ fr_info_t *fin;
|
||||
else
|
||||
ifp = fin->fin_ifp;
|
||||
|
||||
if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
||||
if (ip->ip_p == IPPROTO_TCP)
|
||||
nflags = IPN_TCP;
|
||||
else if (ip->ip_p == IPPROTO_UDP)
|
||||
@ -2203,8 +2226,8 @@ fr_info_t *fin;
|
||||
|
||||
if ((ip->ip_p == IPPROTO_ICMP) &&
|
||||
(nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
|
||||
;
|
||||
else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
|
||||
icmpset = 1;
|
||||
else if ((fin->fin_fl & FI_FRAG) &&
|
||||
(nat = ipfr_nat_knownfrag(ip, fin)))
|
||||
natadd = 0;
|
||||
else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p,
|
||||
@ -2238,8 +2261,7 @@ fr_info_t *fin;
|
||||
hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
|
||||
for (np = nat_rules[hv]; np; np = np->in_mnext)
|
||||
{
|
||||
if ((np->in_ifp && (np->in_ifp != ifp)) ||
|
||||
!np->in_space)
|
||||
if (np->in_ifp && (np->in_ifp != ifp))
|
||||
continue;
|
||||
if ((np->in_flags & IPN_RF) &&
|
||||
!(np->in_flags & nflags))
|
||||
@ -2283,7 +2305,7 @@ fr_info_t *fin;
|
||||
*/
|
||||
if (nat) {
|
||||
np = nat->nat_ptr;
|
||||
if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
|
||||
if (natadd && (fin->fin_fl & FI_FRAG) && np)
|
||||
ipfr_nat_newfrag(ip, fin, 0, nat);
|
||||
MUTEX_ENTER(&nat->nat_lock);
|
||||
nat->nat_age = fr_defnatage;
|
||||
@ -2303,22 +2325,21 @@ fr_info_t *fin;
|
||||
CALC_SUMD(s1, s2, sumd);
|
||||
|
||||
if (nat->nat_dir == NAT_OUTBOUND)
|
||||
fix_incksum(&ip->ip_sum, sumd);
|
||||
fix_incksum(fin, &ip->ip_sum, sumd);
|
||||
else
|
||||
fix_outcksum(&ip->ip_sum, sumd);
|
||||
fix_outcksum(fin, &ip->ip_sum, sumd);
|
||||
}
|
||||
#if SOLARIS || defined(__sgi)
|
||||
else {
|
||||
if (nat->nat_dir == NAT_OUTBOUND)
|
||||
fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
|
||||
fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
||||
else
|
||||
fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
|
||||
fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
||||
}
|
||||
#endif
|
||||
ip->ip_src = nat->nat_outip;
|
||||
|
||||
if (!(ip->ip_off & IP_OFFMASK) &&
|
||||
!(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
||||
|
||||
if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
|
||||
tcp->th_sport = nat->nat_outport;
|
||||
@ -2351,14 +2372,15 @@ fr_info_t *fin;
|
||||
if (udp->uh_sum)
|
||||
csump = &udp->uh_sum;
|
||||
} else if (ip->ip_p == IPPROTO_ICMP) {
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
if (!icmpset)
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
}
|
||||
|
||||
if (csump) {
|
||||
if (nat->nat_dir == NAT_OUTBOUND)
|
||||
fix_outcksum(csump, nat->nat_sumd[1]);
|
||||
fix_outcksum(fin, csump, nat->nat_sumd[1]);
|
||||
else
|
||||
fix_incksum(csump, nat->nat_sumd[1]);
|
||||
fix_incksum(fin, csump, nat->nat_sumd[1]);
|
||||
}
|
||||
}
|
||||
|
||||
@ -2389,18 +2411,18 @@ fr_info_t *fin;
|
||||
register struct in_addr src;
|
||||
register struct in_addr in;
|
||||
register ipnat_t *np;
|
||||
u_short sport = 0, dport = 0, *csump = NULL;
|
||||
u_int nflags = 0, natadd = 1, hv, msk;
|
||||
struct ifnet *ifp = fin->fin_ifp;
|
||||
tcphdr_t *tcp = NULL;
|
||||
u_short sport = 0, dport = 0, *csump = NULL;
|
||||
int i, icmpset = 0;
|
||||
nat_t *nat;
|
||||
u_32_t iph;
|
||||
int i;
|
||||
|
||||
if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
|
||||
return 0;
|
||||
|
||||
if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
||||
if (ip->ip_p == IPPROTO_TCP)
|
||||
nflags = IPN_TCP;
|
||||
else if (ip->ip_p == IPPROTO_UDP)
|
||||
@ -2420,8 +2442,8 @@ fr_info_t *fin;
|
||||
|
||||
if ((ip->ip_p == IPPROTO_ICMP) &&
|
||||
(nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
|
||||
;
|
||||
else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
|
||||
icmpset = 1;
|
||||
else if ((fin->fin_fl & FI_FRAG) &&
|
||||
(nat = ipfr_nat_knownfrag(ip, fin)))
|
||||
natadd = 0;
|
||||
else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p,
|
||||
@ -2488,7 +2510,7 @@ fr_info_t *fin;
|
||||
if (nat) {
|
||||
np = nat->nat_ptr;
|
||||
fin->fin_fr = nat->nat_fr;
|
||||
if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
|
||||
if (natadd && (fin->fin_fl & FI_FRAG) && np)
|
||||
ipfr_nat_newfrag(ip, fin, 0, nat);
|
||||
if ((np->in_apr != NULL) && (np->in_dport == 0 ||
|
||||
(tcp != NULL && sport == np->in_dport))) {
|
||||
@ -2515,12 +2537,11 @@ fr_info_t *fin;
|
||||
*/
|
||||
#if SOLARIS || defined(__sgi)
|
||||
if (nat->nat_dir == NAT_OUTBOUND)
|
||||
fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
|
||||
fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
||||
else
|
||||
fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
|
||||
fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
||||
#endif
|
||||
if (!(ip->ip_off & IP_OFFMASK) &&
|
||||
!(fin->fin_fi.fi_fl & FI_SHORT)) {
|
||||
if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
||||
|
||||
if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
|
||||
tcp->th_dport = nat->nat_inport;
|
||||
@ -2553,14 +2574,15 @@ fr_info_t *fin;
|
||||
if (udp->uh_sum)
|
||||
csump = &udp->uh_sum;
|
||||
} else if (ip->ip_p == IPPROTO_ICMP) {
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
if (!icmpset)
|
||||
nat->nat_age = fr_defnaticmpage;
|
||||
}
|
||||
|
||||
if (csump) {
|
||||
if (nat->nat_dir == NAT_OUTBOUND)
|
||||
fix_incksum(csump, nat->nat_sumd[0]);
|
||||
fix_incksum(fin, csump, nat->nat_sumd[0]);
|
||||
else
|
||||
fix_outcksum(csump, nat->nat_sumd[0]);
|
||||
fix_outcksum(fin, csump, nat->nat_sumd[0]);
|
||||
}
|
||||
}
|
||||
ATOMIC_INCL(nat_stats.ns_mapped[0]);
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ip_nat.h 1.5 2/4/96
|
||||
* $Id: ip_nat.h,v 2.17.2.14 2000/11/18 03:58:04 darrenr Exp $
|
||||
* $Id: ip_nat.h,v 2.17.2.20 2001/06/26 10:43:15 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IP_NAT_H__
|
||||
@ -35,10 +33,18 @@
|
||||
* appropriate sizes. The figures below were used for
|
||||
* a setup with 1000-2000 networks to NAT.
|
||||
*/
|
||||
#define NAT_SIZE 127
|
||||
#define RDR_SIZE 127
|
||||
#define HOSTMAP_SIZE 127
|
||||
#define NAT_TABLE_SZ 127
|
||||
#ifndef NAT_SIZE
|
||||
# define NAT_SIZE 127
|
||||
#endif
|
||||
#ifndef RDR_SIZE
|
||||
# define RDR_SIZE 127
|
||||
#endif
|
||||
#ifndef HOSTMAP_SIZE
|
||||
# define HOSTMAP_SIZE 127
|
||||
#endif
|
||||
#ifndef NAT_TABLE_SZ
|
||||
# define NAT_TABLE_SZ 127
|
||||
#endif
|
||||
#ifdef LARGE_NAT
|
||||
#undef NAT_SIZE
|
||||
#undef RDR_SIZE
|
||||
@ -201,11 +207,13 @@ typedef struct natstat {
|
||||
u_long ns_memfail;
|
||||
u_long ns_badnat;
|
||||
nat_t **ns_table[2];
|
||||
hostmap_t **ns_maptable;
|
||||
ipnat_t *ns_list;
|
||||
void *ns_apslist;
|
||||
u_int ns_nattab_sz;
|
||||
u_int ns_rultab_sz;
|
||||
u_int ns_rdrtab_sz;
|
||||
u_int ns_hostmap_sz;
|
||||
nat_t *ns_instances;
|
||||
u_int ns_wilds;
|
||||
} natstat_t;
|
||||
@ -220,12 +228,13 @@ typedef struct natstat {
|
||||
#define IPN_AUTOPORTMAP 0x010
|
||||
#define IPN_IPRANGE 0x020
|
||||
#define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
|
||||
IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST)
|
||||
IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|IPN_FRAG)
|
||||
#define IPN_FILTER 0x040
|
||||
#define IPN_SPLIT 0x080
|
||||
#define IPN_ROUNDR 0x100
|
||||
#define IPN_NOTSRC 0x080000
|
||||
#define IPN_NOTDST 0x100000
|
||||
#define IPN_FRAG 0x200000
|
||||
|
||||
|
||||
typedef struct natlog {
|
||||
@ -300,8 +309,8 @@ extern int ip_natout __P((ip_t *, fr_info_t *));
|
||||
extern int ip_natin __P((ip_t *, fr_info_t *));
|
||||
extern void ip_natunload __P((void)), ip_natexpire __P((void));
|
||||
extern void nat_log __P((struct nat *, u_int));
|
||||
extern void fix_incksum __P((u_short *, u_32_t));
|
||||
extern void fix_outcksum __P((u_short *, u_32_t));
|
||||
extern void fix_incksum __P((fr_info_t *, u_short *, u_32_t));
|
||||
extern void fix_outcksum __P((fr_info_t *, u_short *, u_32_t));
|
||||
extern void fix_datacksum __P((u_short *, u_32_t));
|
||||
|
||||
#endif /* __IP_NAT_H__ */
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1997-2000 by Darren Reed.
|
||||
* Copyright (C) 1997-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
|
||||
# define _KERNEL
|
||||
#endif
|
||||
@ -78,6 +72,10 @@ static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 d
|
||||
# include <sys/malloc.h>
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.6 2001/07/15 22:06:15 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
#ifndef MIN
|
||||
#define MIN(a,b) (((a)<(b))?(a):(b))
|
||||
@ -216,9 +214,13 @@ ip_t *ip;
|
||||
fr_info_t *fin;
|
||||
nat_t *nat;
|
||||
{
|
||||
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
|
||||
mb_t *m = fin->fin_qfm;
|
||||
int dosum = 1;
|
||||
#endif
|
||||
tcphdr_t *tcp = NULL;
|
||||
ap_session_t *aps;
|
||||
aproxy_t *apr;
|
||||
tcphdr_t *tcp = NULL;
|
||||
u_32_t sum;
|
||||
short rv;
|
||||
int err;
|
||||
@ -234,8 +236,13 @@ nat_t *nat;
|
||||
* verify that the checksum is correct. If not, then
|
||||
* don't do anything with this packet.
|
||||
*/
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
|
||||
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
|
||||
if (dohwcksum && (m->b_ick_flag == ICK_VALID)) {
|
||||
sum = tcp->th_sum;
|
||||
dosum = 0;
|
||||
}
|
||||
if (dosum)
|
||||
sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
|
||||
#else
|
||||
sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
|
||||
#endif
|
||||
@ -261,8 +268,9 @@ nat_t *nat;
|
||||
|
||||
if (tcp != NULL) {
|
||||
err = appr_fixseqack(fin, ip, aps, APR_INC(err));
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
|
||||
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
|
||||
if (dosum)
|
||||
tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
|
||||
#else
|
||||
tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
|
||||
#endif
|
||||
|
@ -1,11 +1,9 @@
|
||||
/*
|
||||
* Copyright (C) 1997-2000 by Darren Reed.
|
||||
* Copyright (C) 1997-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* $Id: ip_proxy.h,v 2.8.2.4 2000/12/02 00:15:03 darrenr Exp $
|
||||
* $Id: ip_proxy.h,v 2.8.2.7 2001/06/26 10:43:16 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IP_PROXY_H__
|
||||
@ -102,7 +100,8 @@ typedef struct ftpside {
|
||||
} ftpside_t;
|
||||
|
||||
typedef struct ftpinfo {
|
||||
u_int ftp_passok;
|
||||
int ftp_passok;
|
||||
int ftp_incok;
|
||||
ftpside_t ftp_side[2];
|
||||
} ftpinfo_t;
|
||||
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
* $Id: ip_raudio_pxy.c,v 1.7.2.3 2000/10/27 22:54:04 darrenr Exp $
|
||||
* $Id: ip_raudio_pxy.c,v 1.7.2.6 2001/07/23 04:17:56 darrenr Exp $
|
||||
*/
|
||||
#if SOLARIS && defined(_KERNEL)
|
||||
extern kmutex_t ipf_rw;
|
||||
@ -62,8 +62,8 @@ nat_t *nat;
|
||||
raudio_t *rap = aps->aps_data;
|
||||
unsigned char membuf[512 + 1], *s;
|
||||
u_short id = 0;
|
||||
tcphdr_t *tcp;
|
||||
int off, dlen;
|
||||
tcphdr_t *tcp;
|
||||
int len = 0;
|
||||
mb_t *m;
|
||||
#if SOLARIS
|
||||
@ -86,14 +86,16 @@ nat_t *nat;
|
||||
dlen = msgdsize(m) - off;
|
||||
if (dlen <= 0)
|
||||
return 0;
|
||||
copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
|
||||
dlen = MIN(sizeof(membuf), dlen);
|
||||
copyout_mblk(m, off, dlen, (char *)membuf);
|
||||
#else
|
||||
m = *(mb_t **)fin->fin_mp;
|
||||
|
||||
dlen = mbufchainlen(m) - off;
|
||||
if (dlen <= 0)
|
||||
return 0;
|
||||
m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
|
||||
dlen = MIN(sizeof(membuf), dlen);
|
||||
m_copydata(m, off, dlen, (char *)membuf);
|
||||
#endif
|
||||
/*
|
||||
* In all the startup parsing, ensure that we don't go outside
|
||||
@ -170,8 +172,8 @@ nat_t *nat;
|
||||
unsigned char membuf[IPF_MAXPORTLEN + 1], *s;
|
||||
tcphdr_t *tcp, tcph, *tcp2 = &tcph;
|
||||
raudio_t *rap = aps->aps_data;
|
||||
int off, dlen, slen, clen;
|
||||
struct in_addr swa, swb;
|
||||
int off, dlen, slen;
|
||||
int a1, a2, a3, a4;
|
||||
u_short sp, dp;
|
||||
fr_info_t fi;
|
||||
@ -202,13 +204,15 @@ nat_t *nat;
|
||||
if (dlen <= 0)
|
||||
return 0;
|
||||
bzero(membuf, sizeof(membuf));
|
||||
copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
|
||||
clen = MIN(sizeof(membuf), dlen);
|
||||
copyout_mblk(m, off, clen, (char *)membuf);
|
||||
#else
|
||||
dlen = mbufchainlen(m) - off;
|
||||
if (dlen <= 0)
|
||||
return 0;
|
||||
bzero(membuf, sizeof(membuf));
|
||||
m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
|
||||
clen = MIN(sizeof(membuf), dlen);
|
||||
m_copydata(m, off, clen, (char *)membuf);
|
||||
#endif
|
||||
|
||||
seq = ntohl(tcp->th_seq);
|
||||
@ -217,7 +221,7 @@ nat_t *nat;
|
||||
* We only care for the first 19 bytes coming back from the server.
|
||||
*/
|
||||
if (rap->rap_sseq == 0) {
|
||||
s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
|
||||
s = (u_char *)memstr("PNA", (char *)membuf, 3, clen);
|
||||
if (s == NULL)
|
||||
return 0;
|
||||
a1 = s - membuf;
|
||||
@ -278,6 +282,7 @@ nat_t *nat;
|
||||
tcp2->th_dport = htons(dp);
|
||||
fi.fin_data[0] = dp;
|
||||
fi.fin_data[1] = sp;
|
||||
fi.fin_out = 0;
|
||||
ipn = nat_new(nat->nat_ptr, ip, &fi,
|
||||
IPN_UDP | (sp ? 0 : FI_W_SPORT), NAT_OUTBOUND);
|
||||
if (ipn != NULL) {
|
||||
@ -292,6 +297,7 @@ nat_t *nat;
|
||||
tcp2->th_dport = 0; /* XXX - don't specify remote port */
|
||||
fi.fin_data[0] = sp;
|
||||
fi.fin_data[1] = 0;
|
||||
fi.fin_out = 1;
|
||||
ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT,
|
||||
NAT_OUTBOUND);
|
||||
if (ipn != NULL) {
|
||||
|
@ -1,15 +1,13 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* I hate legaleese, don't you ?
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.9 2000/11/12 11:55:17 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.12 2001/07/18 14:57:09 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#include <sys/types.h>
|
||||
@ -197,7 +195,7 @@ int *rp;
|
||||
return error;
|
||||
}
|
||||
if (unit == IPL_LOGAUTH) {
|
||||
error = fr_auth_ioctl((caddr_t)data, cmd, NULL, NULL);
|
||||
error = fr_auth_ioctl((caddr_t)data, mode, cmd, NULL, NULL);
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
return error;
|
||||
}
|
||||
@ -458,6 +456,7 @@ caddr_t data;
|
||||
}
|
||||
|
||||
fdp = &fp->fr_dif;
|
||||
fdp->fd_mp = NULL;
|
||||
fp->fr_flags &= ~FR_DUP;
|
||||
if (*fdp->fd_ifname) {
|
||||
ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
|
||||
@ -491,6 +490,7 @@ caddr_t data;
|
||||
}
|
||||
|
||||
fdp = &fp->fr_tif;
|
||||
fdp->fd_mp = NULL;
|
||||
if (*fdp->fd_ifname) {
|
||||
ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
|
||||
if (!ill)
|
||||
@ -577,10 +577,6 @@ caddr_t data;
|
||||
}
|
||||
if (fg && fg->fg_head)
|
||||
fg->fg_head->fr_ref--;
|
||||
if (unit == IPL_LOGAUTH) {
|
||||
error = fr_auth_ioctl(data, req, fp, ftail);
|
||||
goto out;
|
||||
}
|
||||
if (f->fr_grhead)
|
||||
fr_delgroup(f->fr_grhead, fp->fr_flags,
|
||||
unit, set);
|
||||
@ -594,10 +590,6 @@ caddr_t data;
|
||||
if (f) {
|
||||
error = EEXIST;
|
||||
} else {
|
||||
if (unit == IPL_LOGAUTH) {
|
||||
error = fr_auth_ioctl(data, req, fp, ftail);
|
||||
goto out;
|
||||
}
|
||||
KMALLOC(f, frentry_t *);
|
||||
if (f != NULL) {
|
||||
if (fg && fg->fg_head)
|
||||
|
@ -1,15 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#include <sys/errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
@ -97,6 +90,11 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.28 2001/01/08 14:04:46
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.38 2001/07/23 13:49:46 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#ifndef MIN
|
||||
# define MIN(a,b) (((a)<(b))?(a):(b))
|
||||
#endif
|
||||
@ -140,7 +138,9 @@ u_long fr_tcpidletimeout = FIVE_DAYS,
|
||||
fr_tcpclosed = 120,
|
||||
fr_tcphalfclosed = 2 * 2 * 3600, /* 2 hours */
|
||||
fr_udptimeout = 240,
|
||||
fr_icmptimeout = 120;
|
||||
fr_udpacktimeout = 24,
|
||||
fr_icmptimeout = 120,
|
||||
fr_icmpacktimeout = 12;
|
||||
int fr_statemax = IPSTATE_MAX,
|
||||
fr_statesize = IPSTATE_SIZE;
|
||||
int fr_state_doflush = 0,
|
||||
@ -241,6 +241,7 @@ caddr_t data;
|
||||
if (error)
|
||||
return EFAULT;
|
||||
|
||||
WRITE_ENTER(&ipf_state);
|
||||
for (sp = ips_list; sp; sp = sp->is_next)
|
||||
if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
|
||||
!bcmp((char *)&sp->is_src, (char *)&st.is_src,
|
||||
@ -249,7 +250,6 @@ caddr_t data;
|
||||
sizeof(st.is_dst)) &&
|
||||
!bcmp((char *)&sp->is_ps, (char *)&st.is_ps,
|
||||
sizeof(st.is_ps))) {
|
||||
WRITE_ENTER(&ipf_state);
|
||||
#ifdef IPFILTER_LOG
|
||||
ipstate_log(sp, ISL_REMOVE);
|
||||
#endif
|
||||
@ -257,6 +257,7 @@ caddr_t data;
|
||||
RWLOCK_EXIT(&ipf_state);
|
||||
return 0;
|
||||
}
|
||||
RWLOCK_EXIT(&ipf_state);
|
||||
return ESRCH;
|
||||
}
|
||||
|
||||
@ -502,8 +503,7 @@ u_int flags;
|
||||
u_int pass;
|
||||
int out;
|
||||
|
||||
if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
|
||||
(fin->fin_fi.fi_fl & FI_SHORT))
|
||||
if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT))
|
||||
return NULL;
|
||||
if (ips_num == fr_statemax) {
|
||||
ips_stats.iss_max++;
|
||||
@ -663,7 +663,7 @@ u_int flags;
|
||||
is->is_secmsk = 0xffff;
|
||||
is->is_auth = fin->fin_fi.fi_auth;
|
||||
is->is_authmsk = 0xffff;
|
||||
is->is_flags = fin->fin_fi.fi_fl & FI_CMP;
|
||||
is->is_flags = fin->fin_fl & FI_CMP;
|
||||
is->is_flags |= FI_CMP << 4;
|
||||
is->is_flags |= flags & (FI_WILDP|FI_WILDA);
|
||||
if (flags & (FI_WILDP|FI_WILDA))
|
||||
@ -688,7 +688,7 @@ u_int flags;
|
||||
#endif
|
||||
RWLOCK_EXIT(&ipf_state);
|
||||
fin->fin_rev = IP6NEQ(is->is_dst, fin->fin_fi.fi_dst);
|
||||
if (fin->fin_fi.fi_fl & FI_FRAG)
|
||||
if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG))
|
||||
ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
|
||||
return is;
|
||||
}
|
||||
@ -717,6 +717,8 @@ tcphdr_t *tcp;
|
||||
* Find difference between last checked packet and this packet.
|
||||
*/
|
||||
source = IP6EQ(fin->fin_fi.fi_src, is->is_src);
|
||||
if (source && (ntohs(is->is_sport) != fin->fin_data[0]))
|
||||
source = 0;
|
||||
fdata = &is->is_tcp.ts_data[!source];
|
||||
tdata = &is->is_tcp.ts_data[source];
|
||||
seq = ntohl(tcp->th_seq);
|
||||
@ -809,7 +811,7 @@ tcphdr_t *tcp;
|
||||
u_short sp, dp;
|
||||
void *ifp;
|
||||
|
||||
rev = fin->fin_rev = IP6NEQ(is->is_dst, dst);
|
||||
rev = IP6NEQ(is->is_dst, dst);
|
||||
ifp = fin->fin_ifp;
|
||||
out = fin->fin_out;
|
||||
|
||||
@ -817,6 +819,12 @@ tcphdr_t *tcp;
|
||||
flags = is->is_flags;
|
||||
sp = tcp->th_sport;
|
||||
dp = tcp->th_dport;
|
||||
if (!rev) {
|
||||
if (!(flags & FI_W_SPORT) && (sp != is->is_sport))
|
||||
rev = 1;
|
||||
else if (!(flags & FI_W_DPORT) && (dp != is->is_dport))
|
||||
rev = 1;
|
||||
}
|
||||
} else {
|
||||
flags = is->is_flags & FI_WILDA;
|
||||
sp = 0;
|
||||
@ -871,10 +879,10 @@ tcphdr_t *tcp;
|
||||
if (tcp == NULL)
|
||||
flags = is->is_flags & (FI_CMP|(FI_CMP<<4));
|
||||
|
||||
if (((fin->fin_fi.fi_fl & (flags >> 4)) != (flags & FI_CMP)) ||
|
||||
((fin->fin_fi.fi_optmsk & is->is_optmsk) != is->is_opt) ||
|
||||
((fin->fin_fi.fi_secmsk & is->is_secmsk) != is->is_sec) ||
|
||||
((fin->fin_fi.fi_auth & is->is_authmsk) != is->is_auth))
|
||||
if (((fin->fin_fl & (flags >> 4)) != (flags & FI_CMP)) ||
|
||||
(fin->fin_fi.fi_optmsk != is->is_opt) ||
|
||||
(fin->fin_fi.fi_secmsk != is->is_sec) ||
|
||||
(fin->fin_fi.fi_auth != is->is_auth))
|
||||
return 0;
|
||||
|
||||
if ((flags & (FI_W_SPORT|FI_W_DPORT))) {
|
||||
@ -924,16 +932,11 @@ tcphdr_t *tcp;
|
||||
if (ret >= 0) {
|
||||
is->is_ifp[ret] = ifp;
|
||||
#ifdef _KERNEL
|
||||
strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
|
||||
sizeof(is->is_ifname[1]));
|
||||
strncpy(is->is_ifname[ret], IFNAME(fin->fin_ifp),
|
||||
sizeof(is->is_ifname[ret]));
|
||||
#endif
|
||||
}
|
||||
#ifdef _KERNEL
|
||||
if (ret >= 0) {
|
||||
strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
|
||||
sizeof(is->is_ifname[1]));
|
||||
}
|
||||
#endif
|
||||
fin->fin_rev = rev;
|
||||
return 1;
|
||||
}
|
||||
|
||||
@ -1209,8 +1212,7 @@ fr_info_t *fin;
|
||||
frentry_t *fr;
|
||||
tcphdr_t *tcp;
|
||||
|
||||
if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
|
||||
(fin->fin_fi.fi_fl & FI_SHORT))
|
||||
if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT))
|
||||
return NULL;
|
||||
|
||||
is = NULL;
|
||||
@ -1254,7 +1256,10 @@ fr_info_t *fin;
|
||||
if ((is->is_p == pr) && (is->is_v == v) &&
|
||||
fr_matchsrcdst(is, src, dst, fin, NULL) &&
|
||||
fr_matchicmpqueryreply(v, is, ic)) {
|
||||
is->is_age = fr_icmptimeout;
|
||||
if (fin->fin_rev)
|
||||
is->is_age = fr_icmpacktimeout;
|
||||
else
|
||||
is->is_age = fr_icmptimeout;
|
||||
break;
|
||||
}
|
||||
}
|
||||
@ -1302,6 +1307,11 @@ fr_info_t *fin;
|
||||
if (!fr_tcpstate(is, fin, ip, tcp)) {
|
||||
continue;
|
||||
}
|
||||
} else if ((pr == IPPROTO_UDP)) {
|
||||
if (fin->fin_rev)
|
||||
is->is_age = fr_udpacktimeout;
|
||||
else
|
||||
is->is_age = fr_udptimeout;
|
||||
}
|
||||
break;
|
||||
}
|
||||
@ -1345,7 +1355,7 @@ fr_info_t *fin;
|
||||
fr_delstate(is);
|
||||
#endif
|
||||
RWLOCK_EXIT(&ipf_state);
|
||||
if (fin->fin_fi.fi_fl & FI_FRAG)
|
||||
if ((fin->fin_fl & FI_FRAG) && (pass & FR_KEEPFRAG))
|
||||
ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
|
||||
return fr;
|
||||
}
|
||||
@ -1420,7 +1430,8 @@ void fr_stateunload()
|
||||
ips_stats.iss_inuse = 0;
|
||||
ips_num = 0;
|
||||
RWLOCK_EXIT(&ipf_state);
|
||||
KFREES(ips_table, fr_statesize * sizeof(ipstate_t *));
|
||||
if (ips_table)
|
||||
KFREES(ips_table, fr_statesize * sizeof(ipstate_t *));
|
||||
ips_table = NULL;
|
||||
}
|
||||
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
|
||||
* $Id: ip_state.h,v 2.13.2.2 2000/08/23 11:01:31 darrenr Exp $
|
||||
* $Id: ip_state.h,v 2.13.2.4 2001/06/26 10:43:17 darrenr Exp $
|
||||
*/
|
||||
#ifndef __IP_STATE_H__
|
||||
#define __IP_STATE_H__
|
||||
@ -17,8 +15,12 @@
|
||||
# define SIOCDELST _IOW(r, 61, struct ipstate *)
|
||||
#endif
|
||||
|
||||
#define IPSTATE_SIZE 5737
|
||||
#define IPSTATE_MAX 4013 /* Maximum number of states held */
|
||||
#ifndef IPSTATE_SIZE
|
||||
# define IPSTATE_SIZE 5737
|
||||
#endif
|
||||
#ifndef IPSTATE_MAX
|
||||
# define IPSTATE_MAX 4013 /* Maximum number of states held */
|
||||
#endif
|
||||
|
||||
#define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
|
||||
(((s1) == (d2)) && ((d1) == (s2))))
|
||||
|
@ -1,12 +1,16 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#ifdef __FreeBSD__
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
@ -43,7 +47,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.5 2000/10/25 10:37:11 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipf.c,v 2.10.2.10 2001/07/18 11:34:19 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#if SOLARIS
|
||||
@ -74,13 +78,19 @@ static void closedevice __P((void));
|
||||
static char *getline __P((char *, size_t, FILE *, int *));
|
||||
static char *ipfname = IPL_NAME;
|
||||
static void usage __P((void));
|
||||
static void showversion __P((void));
|
||||
static int showversion __P((void));
|
||||
static int get_flags __P((void));
|
||||
|
||||
|
||||
#if SOLARIS
|
||||
# define OPTS "6AdDEf:F:Il:noPrsUvVyzZ"
|
||||
#else
|
||||
# define OPTS "6AdDEf:F:Il:noPrsvVyzZ"
|
||||
#endif
|
||||
|
||||
static void usage()
|
||||
{
|
||||
fprintf(stderr, "usage: ipf [-6AdDEInoPrsUvVyzZ] %s %s %s\n",
|
||||
fprintf(stderr, "usage: ipf [-%s] %s %s %s\n", OPTS,
|
||||
"[-l block|pass|nomatch]", "[-F i|o|a|s|S]", "[-f filename]");
|
||||
exit(1);
|
||||
}
|
||||
@ -92,11 +102,9 @@ char *argv[];
|
||||
{
|
||||
int c;
|
||||
|
||||
while ((c = getopt(argc, argv, "6AdDEf:F:Il:noPrsUvVyzZ")) != -1) {
|
||||
while ((c = getopt(argc, argv, OPTS)) != -1) {
|
||||
switch (c)
|
||||
{
|
||||
case '?' :
|
||||
usage();
|
||||
#ifdef USE_INET6
|
||||
case '6' :
|
||||
use_inet6 = 1;
|
||||
@ -146,10 +154,11 @@ char *argv[];
|
||||
break;
|
||||
#endif
|
||||
case 'v' :
|
||||
opts |= OPT_VERBOSE;
|
||||
opts += OPT_VERBOSE;
|
||||
break;
|
||||
case 'V' :
|
||||
showversion();
|
||||
if (showversion())
|
||||
exit(1);
|
||||
break;
|
||||
case 'y' :
|
||||
frsync();
|
||||
@ -160,6 +169,9 @@ char *argv[];
|
||||
case 'Z' :
|
||||
zerostats();
|
||||
break;
|
||||
default :
|
||||
usage();
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
@ -553,7 +565,7 @@ static void blockunknown()
|
||||
#endif
|
||||
|
||||
|
||||
static void showversion()
|
||||
static int showversion()
|
||||
{
|
||||
struct friostat fio;
|
||||
struct friostat *fiop=&fio;
|
||||
@ -565,13 +577,13 @@ static void showversion()
|
||||
|
||||
if ((vfd = open(ipfname, O_RDONLY)) == -1) {
|
||||
perror("open device");
|
||||
return;
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (ioctl(vfd, SIOCGETFS, &fiop)) {
|
||||
perror("ioctl(SIOCGETFS)");
|
||||
close(vfd);
|
||||
return;
|
||||
return 1;
|
||||
}
|
||||
close(vfd);
|
||||
flags = get_flags();
|
||||
@ -610,4 +622,6 @@ static void showversion()
|
||||
s = "nomatch -> block";
|
||||
printf("%s all, Logging: %savailable\n", s, fio.f_logging ? "" : "un");
|
||||
printf("Active list: %d\n", fio.f_active);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ipf.h 1.12 6/5/96
|
||||
* $Id: ipf.h,v 2.9.2.2 2000/05/06 11:20:20 darrenr Exp $
|
||||
* $Id: ipf.h,v 2.9.2.3 2001/06/26 10:43:18 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IPF_H__
|
||||
|
@ -1,12 +1,16 @@
|
||||
/*
|
||||
* Copyright (C) 1999 by Darren Reed.
|
||||
* Copyright (C) 1999-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#ifdef __FreeBSD__
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
@ -41,7 +45,7 @@
|
||||
#include "ipf.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.3 2001/01/10 06:20:12 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipfs.c,v 2.6.2.7 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#ifndef IPF_SAVEDIR
|
||||
@ -532,6 +536,7 @@ char *file;
|
||||
}
|
||||
|
||||
bzero((char *)&ipn, sizeof(ipn));
|
||||
ipnp = &ipn;
|
||||
|
||||
/*
|
||||
* 1. Read all state information in.
|
||||
@ -573,7 +578,7 @@ char *file;
|
||||
}
|
||||
} else
|
||||
in = (nat_save_t *)malloc(sizeof(*in));
|
||||
bcopy((char *)&ipnp, (char *)in, sizeof(ipn));
|
||||
bcopy((char *)ipnp, (char *)in, sizeof(ipn));
|
||||
|
||||
/*
|
||||
* Check to see if this is the first state entry that will
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
/*
|
||||
@ -51,7 +49,7 @@ etherfind -n -t
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipft_ef.c 1.6 2/4/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
static int etherf_open __P((char *));
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <ctype.h>
|
||||
@ -42,7 +40,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipft_hx.c 1.1 3/9/96 (C) 1996 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern int opts;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@ -33,7 +31,7 @@
|
||||
#include "ipt.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
struct llc {
|
||||
@ -46,7 +44,7 @@ struct llc {
|
||||
* While many of these maybe the same, some do have different header formats
|
||||
* which make this useful.
|
||||
*/
|
||||
#define DLT_MAX 10
|
||||
#define DLT_MAX 14
|
||||
|
||||
static struct llc llcs[DLT_MAX+1] = {
|
||||
{ 0, 0, 0 }, /* DLT_NULL */
|
||||
@ -59,7 +57,10 @@ static struct llc llcs[DLT_MAX+1] = {
|
||||
{ 0, 0, 0 }, /* DLT_ARCNET */
|
||||
{ 0, 0, 0 }, /* DLT_SLIP */
|
||||
{ 0, 0, 0 }, /* DLT_PPP */
|
||||
{ 0, 0, 0 } /* DLT_FDDI */
|
||||
{ 0, 0, 0 }, /* DLT_FDDI */
|
||||
{ 0, 0, 0 }, /* DLT_ATMRFC1483 */
|
||||
{ 0, 0, 0 }, /* DLT_LOOP */
|
||||
{ 0, 0, 0 } /* DLT_ENC */
|
||||
};
|
||||
|
||||
static int pcap_open __P((char *));
|
||||
@ -114,7 +115,7 @@ char *fname;
|
||||
swap_hdr(&ph);
|
||||
}
|
||||
|
||||
if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type > DLT_MAX) {
|
||||
if (ph.pc_v_maj != PCAP_VERSION_MAJ || ph.pc_type >= DLT_MAX) {
|
||||
(void) close(fd);
|
||||
return -2;
|
||||
}
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
/*
|
||||
@ -37,7 +35,7 @@
|
||||
#include "ipt.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 2.2.2.2 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
struct llc {
|
||||
@ -78,6 +76,7 @@ char *fname;
|
||||
{
|
||||
struct snoophdr sh;
|
||||
int fd;
|
||||
int s_v;
|
||||
|
||||
if (sfd != -1)
|
||||
return sfd;
|
||||
@ -90,16 +89,18 @@ char *fname;
|
||||
if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh))
|
||||
return -2;
|
||||
|
||||
if (sh.s_v != SNOOP_VERSION ||
|
||||
sh.s_type < 0 || sh.s_type > SDL_MAX) {
|
||||
s_v = (int)ntohl(sh.s_v);
|
||||
s_type = (int)ntohl(sh.s_type);
|
||||
|
||||
if (s_v != SNOOP_VERSION ||
|
||||
s_type < 0 || s_type > SDL_MAX) {
|
||||
(void) close(fd);
|
||||
return -2;
|
||||
}
|
||||
|
||||
sfd = fd;
|
||||
s_type = sh.s_type;
|
||||
printf("opened snoop file %s:\n", fname);
|
||||
printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, sh.s_v, s_type);
|
||||
printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type);
|
||||
|
||||
return fd;
|
||||
}
|
||||
@ -118,20 +119,22 @@ static int snoop_close()
|
||||
static int snoop_read_rec(rec)
|
||||
struct snooppkt *rec;
|
||||
{
|
||||
int n, p;
|
||||
int n, plen, ilen;
|
||||
|
||||
if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec))
|
||||
return -2;
|
||||
|
||||
if (rec->sp_ilen > rec->sp_plen || rec->sp_plen < sizeof(*rec))
|
||||
ilen = (int)ntohl(rec->sp_ilen);
|
||||
plen = (int)ntohl(rec->sp_plen);
|
||||
if (ilen > plen || plen < sizeof(*rec))
|
||||
return -2;
|
||||
|
||||
p = rec->sp_plen - sizeof(*rec);
|
||||
n = MIN(p, rec->sp_ilen);
|
||||
plen -= sizeof(*rec);
|
||||
n = MIN(plen, ilen);
|
||||
if (!n || n < 0)
|
||||
return -3;
|
||||
|
||||
return p;
|
||||
return plen;
|
||||
}
|
||||
|
||||
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
/*
|
||||
@ -60,7 +58,7 @@ tcpdump -nqte
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipft_td.c 1.8 2/4/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2 2000/03/13 22:10:24 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_td.c,v 2.2.2.1 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
static int tcpd_open __P((char *));
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1995-2000 by Darren Reed.
|
||||
* Copyright (C) 1995-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <ctype.h>
|
||||
@ -43,7 +41,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.1 2001/01/10 06:19:53 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 2.3.2.4 2001/06/26 10:43:18 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern int opts;
|
||||
@ -223,12 +221,12 @@ int *out;
|
||||
bzero(ipopts, sizeof(ipopts));
|
||||
ip->ip_hl = sizeof(*ip) >> 2;
|
||||
ip->ip_v = IPVERSION;
|
||||
for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; )
|
||||
for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && (i < 19); )
|
||||
cps[++i] = strtok(NULL, " \b\t\r\n");
|
||||
if (i < 2)
|
||||
return 1;
|
||||
|
||||
cpp = cps;
|
||||
if (!*cpp)
|
||||
return 1;
|
||||
|
||||
c = **cpp;
|
||||
if (!isalpha(c) || (tolower(c) != 'o' && tolower(c) != 'i')) {
|
||||
@ -237,12 +235,16 @@ int *out;
|
||||
}
|
||||
*out = (tolower(c) == 'o') ? 1 : 0;
|
||||
cpp++;
|
||||
if (!*cpp)
|
||||
return 1;
|
||||
|
||||
if (!strcasecmp(*cpp, "on")) {
|
||||
cpp++;
|
||||
if (!*cpp)
|
||||
return 1;
|
||||
*ifn = strdup(*cpp++);
|
||||
if (!*cpp)
|
||||
return 1;
|
||||
}
|
||||
|
||||
c = **cpp;
|
||||
|
@ -1,17 +1,15 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)ipl.h 1.21 6/5/96
|
||||
* $Id: ipl.h,v 2.15.2.17 2001/01/14 13:47:15 darrenr Exp $
|
||||
* $Id: ipl.h,v 2.15.2.23 2001/07/23 13:52:10 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IPL_H__
|
||||
#define __IPL_H__
|
||||
|
||||
#define IPL_VERSION "IP Filter: v3.4.16"
|
||||
#define IPL_VERSION "IP Filter: v3.4.20"
|
||||
|
||||
#endif
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1997-1998 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
typedef struct iface {
|
||||
int if_MTU;
|
||||
|
@ -1,15 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#ifndef SOLARIS
|
||||
#define SOLARIS (defined(__SVR4) || defined(__svr4__)) && defined(sun)
|
||||
#endif
|
||||
@ -37,7 +30,9 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar
|
||||
# include <sys/filio.h>
|
||||
# include <sys/byteorder.h>
|
||||
#endif
|
||||
#include <strings.h>
|
||||
#if !defined(__SVR4) && !defined(__GNUC__)
|
||||
# include <strings.h>
|
||||
#endif
|
||||
#include <signal.h>
|
||||
#include <stdlib.h>
|
||||
#include <stddef.h>
|
||||
@ -70,6 +65,11 @@ static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.8 2001/01/10 06:18:08 dar
|
||||
#include "netinet/ip_nat.h"
|
||||
#include "netinet/ip_state.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipmon.c,v 2.12.2.13 2001/07/19 12:24:59 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
#if defined(sun) && !defined(SOLARIS2)
|
||||
#define STRERROR(x) sys_errlist[x]
|
||||
@ -121,6 +121,7 @@ static void print_statelog __P((FILE *, char *, int));
|
||||
static void dumphex __P((FILE *, u_char *, int));
|
||||
static int read_log __P((int, int *, char *, int));
|
||||
static void write_pid __P((char *));
|
||||
static char *icmpname __P((u_int, u_int));
|
||||
|
||||
char *hostname __P((int, int, u_32_t *));
|
||||
char *portname __P((int, char *, u_int));
|
||||
@ -133,7 +134,7 @@ static char *getproto __P((u_int));
|
||||
static char **protocols = NULL;
|
||||
static char **udp_ports = NULL;
|
||||
static char **tcp_ports = NULL;
|
||||
|
||||
static char *argv0 = "ipmon";
|
||||
|
||||
#define OPT_SYSLOG 0x001
|
||||
#define OPT_RESOLVE 0x002
|
||||
@ -155,7 +156,49 @@ static char **tcp_ports = NULL;
|
||||
#endif
|
||||
|
||||
|
||||
void handlehup(sig)
|
||||
#define ICMPUNREACHNAMES 14
|
||||
static char *icmpunreachnames[ICMPUNREACHNAMES] = {
|
||||
"net",
|
||||
"host",
|
||||
"protocol",
|
||||
"port",
|
||||
"needfrag",
|
||||
"srcfail",
|
||||
"net_unknown",
|
||||
"host_unknown",
|
||||
"isolated",
|
||||
"net_prohib",
|
||||
"host_prohib",
|
||||
"tosnet",
|
||||
"toshost",
|
||||
"admin_prohibit"
|
||||
};
|
||||
|
||||
#define ICMPTYPES 19
|
||||
static char *icmptypes[ICMPTYPES] = {
|
||||
"echoreply",
|
||||
NULL,
|
||||
NULL,
|
||||
"unreach",
|
||||
"sourcequench",
|
||||
"redirect",
|
||||
NULL,
|
||||
NULL,
|
||||
"echo",
|
||||
"routeradvert",
|
||||
"routersolicit",
|
||||
"timxceed",
|
||||
"paramprob",
|
||||
"timestamp",
|
||||
"timestampreply",
|
||||
"inforeq",
|
||||
"inforeply",
|
||||
"maskreq",
|
||||
"maskreply"
|
||||
};
|
||||
|
||||
|
||||
static void handlehup(sig)
|
||||
int sig;
|
||||
{
|
||||
FILE *fp;
|
||||
@ -265,6 +308,8 @@ char *hostname(res, v, ip)
|
||||
int res, v;
|
||||
u_32_t *ip;
|
||||
{
|
||||
# define MAX_INETA 16
|
||||
static char hname[MAXHOSTNAMELEN + MAX_INETA + 3];
|
||||
#ifdef USE_INET6
|
||||
static char hostbuf[MAXHOSTNAMELEN+1];
|
||||
#endif
|
||||
@ -278,8 +323,8 @@ u_32_t *ip;
|
||||
hp = gethostbyaddr((char *)ip, sizeof(ip), AF_INET);
|
||||
if (!hp)
|
||||
return inet_ntoa(ipa);
|
||||
return hp->h_name;
|
||||
|
||||
sprintf(hname, "%.*s[%s]", MAXHOSTNAMELEN, hp->h_name, inet_ntoa(ipa));
|
||||
return hname;
|
||||
}
|
||||
#ifdef USE_INET6
|
||||
(void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1);
|
||||
@ -315,6 +360,67 @@ u_int port;
|
||||
}
|
||||
|
||||
|
||||
#define TYPECODE(x,y) (((x) << 8) | (y))
|
||||
|
||||
static char *icmpname(type, code)
|
||||
u_int type;
|
||||
u_int code;
|
||||
{
|
||||
static char name[80];
|
||||
char codeval[8], *s;
|
||||
u_int typecode;
|
||||
|
||||
sprintf(codeval, "%d", code);
|
||||
|
||||
s = NULL;
|
||||
if (type < ICMPTYPES)
|
||||
s = icmptypes[type];
|
||||
if (s == NULL)
|
||||
sprintf(name, "icmptype(%d)/", type);
|
||||
else
|
||||
sprintf(name, "%s/", s);
|
||||
|
||||
if (type == ICMP_UNREACH) {
|
||||
if (code >= ICMPUNREACHNAMES)
|
||||
sprintf(name + strlen(name), "%d", code);
|
||||
else
|
||||
strcat(name, icmpunreachnames[code]);
|
||||
} else {
|
||||
typecode = (type << 8) | code;
|
||||
|
||||
switch (typecode)
|
||||
{
|
||||
case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_NET) :
|
||||
strcat(name, "net");
|
||||
break;
|
||||
case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_HOST) :
|
||||
strcat(name, "host");
|
||||
break;
|
||||
case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSNET) :
|
||||
strcat(name, "tosnet");
|
||||
break;
|
||||
case TYPECODE(ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST) :
|
||||
strcat(name, "toshost");
|
||||
break;
|
||||
case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS) :
|
||||
strcat(name, "intrans");
|
||||
break;
|
||||
case TYPECODE(ICMP_TIMXCEED, ICMP_TIMXCEED_REASS) :
|
||||
strcat(name, "reass");
|
||||
break;
|
||||
case TYPECODE(ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT) :
|
||||
strcat(name, "optabsent");
|
||||
break;
|
||||
default:
|
||||
strcat(name, codeval);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return name;
|
||||
}
|
||||
|
||||
|
||||
static void dumphex(log, buf, len)
|
||||
FILE *log;
|
||||
u_char *buf;
|
||||
@ -739,9 +845,9 @@ int blen;
|
||||
ic = (struct icmp *)((char *)ip + hl);
|
||||
(void) sprintf(t, "%s -> ", hostname(res, v, s));
|
||||
t += strlen(t);
|
||||
(void) sprintf(t, "%s PR icmp len %hu %hu icmp %d/%d",
|
||||
(void) sprintf(t, "%s PR icmp len %hu %hu icmp %s",
|
||||
hostname(res, v, d), hl, plen,
|
||||
ic->icmp_type, ic->icmp_code);
|
||||
icmpname((u_int) ic->icmp_type, (u_int) ic->icmp_code));
|
||||
if (ic->icmp_type == ICMP_UNREACH ||
|
||||
ic->icmp_type == ICMP_SOURCEQUENCH ||
|
||||
ic->icmp_type == ICMP_PARAMPROB ||
|
||||
@ -879,7 +985,7 @@ FILE *log;
|
||||
|
||||
if ((fd = open(file, O_RDWR)) == -1) {
|
||||
(void) fprintf(stderr, "%s: open: %s\n", file,STRERROR(errno));
|
||||
exit(-1);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (ioctl(fd, SIOCIPFFB, &flushed) == 0) {
|
||||
@ -942,7 +1048,7 @@ char *argv[];
|
||||
int fd[3], doread, n, i;
|
||||
int tr, nr, regular[3], c;
|
||||
int fdt[3], devices = 0, make_daemon = 0;
|
||||
char buf[512], *iplfile[3], *s;
|
||||
char buf[512], *iplfile[3];
|
||||
extern int optind;
|
||||
extern char *optarg;
|
||||
|
||||
@ -952,6 +1058,12 @@ char *argv[];
|
||||
iplfile[1] = IPNAT_NAME;
|
||||
iplfile[2] = IPSTATE_NAME;
|
||||
|
||||
argv0 = strrchr(argv[0], '/');
|
||||
if (argv0 == NULL)
|
||||
argv0 = argv[0];
|
||||
else
|
||||
argv0++;
|
||||
|
||||
while ((c = getopt(argc, argv, "?abDf:FhnN:o:O:pP:sS:tvxX")) != -1)
|
||||
switch (c)
|
||||
{
|
||||
@ -1002,14 +1114,9 @@ char *argv[];
|
||||
pidfile = optarg;
|
||||
break;
|
||||
case 's' :
|
||||
s = strrchr(argv[0], '/');
|
||||
if (s == NULL)
|
||||
s = argv[0];
|
||||
else
|
||||
s++;
|
||||
openlog(s, LOG_NDELAY|LOG_PID, LOGFAC);
|
||||
s = NULL;
|
||||
openlog(argv0, LOG_NDELAY|LOG_PID, LOGFAC);
|
||||
opts |= OPT_SYSLOG;
|
||||
log = NULL;
|
||||
break;
|
||||
case 'S' :
|
||||
opts |= OPT_STATE;
|
||||
@ -1031,7 +1138,7 @@ char *argv[];
|
||||
default :
|
||||
case 'h' :
|
||||
case '?' :
|
||||
usage(argv[0]);
|
||||
usage(argv0);
|
||||
}
|
||||
|
||||
init_tabs();
|
||||
@ -1052,13 +1159,14 @@ char *argv[];
|
||||
(void) fprintf(stderr,
|
||||
"%s: open: %s\n", iplfile[i],
|
||||
STRERROR(errno));
|
||||
exit(-1);
|
||||
exit(1);
|
||||
/* NOTREACHED */
|
||||
}
|
||||
|
||||
if (fstat(fd[i], &sb) == -1) {
|
||||
(void) fprintf(stderr, "%d: fstat: %s\n",fd[i],
|
||||
STRERROR(errno));
|
||||
exit(-1);
|
||||
exit(1);
|
||||
/* NOTREACHED */
|
||||
}
|
||||
if (!(regular[i] = !S_ISCHR(sb.st_mode)))
|
||||
devices++;
|
||||
@ -1069,25 +1177,36 @@ char *argv[];
|
||||
logfile = argv[optind];
|
||||
log = logfile ? fopen(logfile, "a") : stdout;
|
||||
if (log == NULL) {
|
||||
|
||||
(void) fprintf(stderr, "%s: fopen: %s\n", argv[optind],
|
||||
STRERROR(errno));
|
||||
exit(-1);
|
||||
exit(1);
|
||||
/* NOTREACHED */
|
||||
}
|
||||
setvbuf(log, NULL, _IONBF, 0);
|
||||
} else
|
||||
log = NULL;
|
||||
|
||||
if (make_daemon && ((log != stdout) || (opts & OPT_SYSLOG))) {
|
||||
if (fork() > 0)
|
||||
#if BSD
|
||||
daemon(0, !(opts & OPT_SYSLOG));
|
||||
#else
|
||||
int pid;
|
||||
if ((pid = fork()) > 0)
|
||||
exit(0);
|
||||
write_pid(pidfile);
|
||||
if (pid < 0) {
|
||||
(void) fprintf(stderr, "%s: fork() failed: %s\n", argv0,
|
||||
STRERROR(errno));
|
||||
exit(1);
|
||||
/* NOTREACHED */
|
||||
}
|
||||
setsid();
|
||||
if ((opts & OPT_SYSLOG))
|
||||
close(2);
|
||||
#endif /* !BSD */
|
||||
close(0);
|
||||
close(1);
|
||||
close(2);
|
||||
setsid();
|
||||
} else
|
||||
write_pid(pidfile);
|
||||
}
|
||||
write_pid(pidfile);
|
||||
|
||||
signal(SIGHUP, handlehup);
|
||||
|
||||
@ -1100,8 +1219,12 @@ char *argv[];
|
||||
continue;
|
||||
if (!regular[i]) {
|
||||
if (ioctl(fd[i], FIONREAD, &tr) == -1) {
|
||||
perror("ioctl(FIONREAD)");
|
||||
exit(-1);
|
||||
if (opts & OPT_SYSLOG)
|
||||
syslog(LOG_CRIT, "ioctl(FIONREAD): %m");
|
||||
else
|
||||
perror("ioctl(FIONREAD)");
|
||||
exit(1);
|
||||
/* NOTREACHED */
|
||||
}
|
||||
} else {
|
||||
tr = (lseek(fd[i], 0, SEEK_CUR) < sb.st_size);
|
||||
@ -1126,14 +1249,14 @@ char *argv[];
|
||||
{
|
||||
case -1 :
|
||||
if (opts & OPT_SYSLOG)
|
||||
syslog(LOG_ERR, "read: %m\n");
|
||||
syslog(LOG_CRIT, "read: %m\n");
|
||||
else
|
||||
perror("read");
|
||||
doread = 0;
|
||||
break;
|
||||
case 1 :
|
||||
if (opts & OPT_SYSLOG)
|
||||
syslog(LOG_ERR, "aborting logging\n");
|
||||
syslog(LOG_CRIT, "aborting logging\n");
|
||||
else
|
||||
fprintf(log, "aborting logging\n");
|
||||
doread = 0;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
|
||||
*/
|
||||
@ -57,7 +55,7 @@ extern char *sys_errlist[];
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.5 2000/12/02 00:15:04 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipnat.c,v 2.16.2.9 2001/07/18 15:06:33 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
@ -110,10 +108,10 @@ int main(argc, argv)
|
||||
int argc;
|
||||
char *argv[];
|
||||
{
|
||||
char *file = NULL;
|
||||
int fd = -1, opts = 0, c, mode = O_RDWR;
|
||||
char *file = NULL, *core = NULL;
|
||||
|
||||
while ((c = getopt(argc, argv, "CdFf:hlnrsv")) != -1)
|
||||
while ((c = getopt(argc, argv, "CdFf:hlM:nrsv")) != -1)
|
||||
switch (c)
|
||||
{
|
||||
case 'C' :
|
||||
@ -135,6 +133,9 @@ char *argv[];
|
||||
opts |= OPT_LIST;
|
||||
mode = O_RDONLY;
|
||||
break;
|
||||
case 'M' :
|
||||
core = optarg;
|
||||
break;
|
||||
case 'n' :
|
||||
opts |= OPT_NODO;
|
||||
mode = O_RDONLY;
|
||||
@ -153,6 +154,13 @@ char *argv[];
|
||||
usage(argv[0]);
|
||||
}
|
||||
|
||||
if (core != NULL) {
|
||||
if (openkmem(core) == -1)
|
||||
exit(1);
|
||||
(void) setgid(getgid());
|
||||
(void) setuid(getuid());
|
||||
}
|
||||
|
||||
gethostname(thishost, sizeof(thishost));
|
||||
thishost[sizeof(thishost) - 1] = '\0';
|
||||
|
||||
@ -292,8 +300,10 @@ ipnat_t *ipnat;
|
||||
void dostats(fd, opts)
|
||||
int fd, opts;
|
||||
{
|
||||
hostmap_t hm, *hmp, **maptable;
|
||||
natstat_t ns, *nsp = &ns;
|
||||
nat_t **nt[2], *np, nat;
|
||||
u_int hv, hv1, hv2;
|
||||
ipnat_t ipn;
|
||||
|
||||
bzero((char *)&ns, sizeof(ns));
|
||||
@ -353,15 +363,21 @@ int fd, opts;
|
||||
printf("\n\tage %lu use %hu sumd %s/",
|
||||
nat.nat_age, nat.nat_use,
|
||||
getsumd(nat.nat_sumd[0]));
|
||||
hv1 = NAT_HASH_FN(nat.nat_inip.s_addr,
|
||||
nat.nat_inport,
|
||||
0xffffffff),
|
||||
hv1 = NAT_HASH_FN(nat.nat_oip.s_addr,
|
||||
hv1 + nat.nat_oport,
|
||||
NAT_TABLE_SZ),
|
||||
hv2 = NAT_HASH_FN(nat.nat_outip.s_addr,
|
||||
nat.nat_outport,
|
||||
0xffffffff),
|
||||
hv2 = NAT_HASH_FN(nat.nat_oip.s_addr,
|
||||
hv2 + nat.nat_oport,
|
||||
NAT_TABLE_SZ),
|
||||
printf("%s pr %u bkt %d/%d flags %x ",
|
||||
getsumd(nat.nat_sumd[1]), nat.nat_p,
|
||||
(int)NAT_HASH_FN(nat.nat_inip.s_addr,
|
||||
nat.nat_inport,
|
||||
NAT_TABLE_SZ),
|
||||
(int)NAT_HASH_FN(nat.nat_outip.s_addr,
|
||||
nat.nat_outport,
|
||||
NAT_TABLE_SZ),
|
||||
nat.nat_flags);
|
||||
hv1, hv2, nat.nat_flags);
|
||||
#ifdef USE_QUAD_T
|
||||
printf("bytes %qu pkts %qu",
|
||||
(unsigned long long)nat.nat_bytes,
|
||||
@ -379,6 +395,38 @@ int fd, opts;
|
||||
printaps(nat.nat_aps, opts);
|
||||
}
|
||||
|
||||
if (opts & OPT_VERBOSE) {
|
||||
printf("\nList of active host mappings:\n");
|
||||
|
||||
maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
|
||||
ns.ns_hostmap_sz);
|
||||
if (kmemcpy((char *)maptable, (u_long)ns.ns_maptable,
|
||||
sizeof(hostmap_t *) * ns.ns_hostmap_sz)) {
|
||||
perror("kmemcpy (maptable)");
|
||||
return;
|
||||
}
|
||||
|
||||
for (hv = 0; hv < ns.ns_hostmap_sz; hv++) {
|
||||
hmp = maptable[hv];
|
||||
|
||||
while(hmp) {
|
||||
|
||||
if (kmemcpy((char *)&hm, (u_long)hmp,
|
||||
sizeof(hostmap_t))) {
|
||||
perror("kmemcpy (hostmap)");
|
||||
return;
|
||||
}
|
||||
|
||||
printf("%s -> ",
|
||||
inet_ntoa(hm.hm_realip));
|
||||
printf("%s ", inet_ntoa(hm.hm_mapip));
|
||||
printf("(use = %d hv = %u)\n",
|
||||
hm.hm_ref, hv);
|
||||
hmp = hm.hm_next;
|
||||
}
|
||||
}
|
||||
free(maptable);
|
||||
}
|
||||
free(nt[0]);
|
||||
}
|
||||
}
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1995-1998 Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* The author of this software makes no garuntee about the
|
||||
* performance of this package or its suitability to fulfill any purpose.
|
||||
@ -37,7 +35,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static const char sccsid[] = "@(#)ipsd.c 1.3 12/3/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1 1999/08/04 17:30:56 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern char *optarg;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1995-1998 Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* The author of this software makes no garuntee about the
|
||||
* performance of this package or its suitability to fulfill any purpose.
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1995-1998 Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* The author of this software makes no garuntee about the
|
||||
* performance of this package or its suitability to fulfill any purpose.
|
||||
@ -38,7 +36,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static const char sccsid[] = "@(#)ipsdr.c 1.3 12/3/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1 1999/08/04 17:30:57 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.1.4.1 2001/06/26 10:43:21 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern char *optarg;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1997-1998 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)linux.h 1.1 8/19/95
|
||||
*/
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1995-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
*/
|
||||
#include <stdio.h>
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
*/
|
||||
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* The author of this software makes no garuntee about the
|
||||
* performance of this package or its suitability to fulfill any purpose.
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* The author of this software makes no garuntee about the
|
||||
* performance of this package or its suitability to fulfill any purpose.
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* arp.c (C) 1995-1998 Darren Reed
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
@ -30,6 +24,11 @@ static const char rcsid[] = "@(#)$Id: arp.c,v 2.1 1999/08/04 17:31:03 darrenr Ex
|
||||
#include "ipsend.h"
|
||||
#include "iplang/iplang.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)arp.c 1.4 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: arp.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
/*
|
||||
* lookup host and return
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1997-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <strings.h>
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* ip.c (C) 1995-1998 Darren Reed
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995";
|
||||
static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr Exp $";
|
||||
#endif
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
@ -33,6 +27,10 @@ static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.1 2001/01/10 06:21:19 darrenr
|
||||
#endif
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995";
|
||||
static const char rcsid[] = "@(#)$Id: ip.c,v 2.1.4.3 2001/07/15 22:00:13 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
static char *ipbuf = NULL, *ethbuf = NULL;
|
||||
|
||||
|
@ -2,7 +2,7 @@
|
||||
.SH NAME
|
||||
ipresend \- resend IP packets out to network
|
||||
.SH SYNOPSIS
|
||||
.B ipsend
|
||||
.B ipresend
|
||||
[
|
||||
.B \-EHPRSTX
|
||||
] [
|
||||
|
@ -6,14 +6,8 @@
|
||||
* conditions, enough of the TCP header is missing for unpredictable
|
||||
* results unless the filter is aware that this can happen.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
@ -34,6 +28,11 @@ static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1 1999/08/04 17:31:05 darre
|
||||
#endif
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipresend.c,v 2.1.4.2 2001/07/15 22:00:13 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
extern char *optarg;
|
||||
extern int optind;
|
||||
|
@ -6,14 +6,8 @@
|
||||
* conditions, enough of the TCP header is missing for unpredictable
|
||||
* results unless the filter is aware that this can happen.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
@ -36,6 +30,11 @@ static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.1 2001/01/10 06:21:19 dar
|
||||
#include "ipsend.h"
|
||||
#include "ipf.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipsend.c 1.5 12/10/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsend.c,v 2.2.2.3 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
extern char *optarg;
|
||||
extern int optind;
|
||||
|
@ -6,11 +6,7 @@
|
||||
* conditions, enough of the TCP header is missing for unpredictable
|
||||
* results unless the filter is aware that this can happen.
|
||||
*
|
||||
* The author provides this program as-is, with no gaurantee for its
|
||||
* suitability for any specific purpose. The author takes no responsibility
|
||||
* for the misuse/abuse of this program and provides it for the sole purpose
|
||||
* of testing packet filter policies. This file maybe distributed freely
|
||||
* providing it is not modified and that this notice remains in tact.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
*/
|
||||
#ifndef __P
|
||||
@ -67,3 +63,9 @@ extern int kmemcpy __P((char *, void *, int));
|
||||
#ifndef OPT_RAW
|
||||
#define OPT_RAW 0x80000
|
||||
#endif
|
||||
|
||||
#ifndef __STDC__
|
||||
# ifndef const
|
||||
# define const
|
||||
# endif
|
||||
#endif
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1995-1998 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
@ -25,13 +19,9 @@ static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1 1999/08/04 17:31:07 darrenr
|
||||
#include <arpa/inet.h>
|
||||
#include "ipsend.h"
|
||||
|
||||
|
||||
#ifndef __P
|
||||
# ifdef __STDC__
|
||||
# define __P(x) x
|
||||
# else
|
||||
# define __P(x) ()
|
||||
# endif
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipsopt.c 1.2 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipsopt.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
|
@ -6,14 +6,8 @@
|
||||
* conditions, enough of the TCP header is missing for unpredictable
|
||||
* results unless the filter is aware that this can happen.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <netdb.h>
|
||||
#include <unistd.h>
|
||||
@ -38,6 +32,11 @@ static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2 1999/12/04 03:37:05 darrenr
|
||||
#endif
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: iptest.c,v 2.2.2.2 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
extern char *optarg;
|
||||
extern int optind;
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-1998 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
@ -80,6 +74,11 @@ static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1 1999/08/04 17:31:09 darren
|
||||
#endif
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "%W% %G% (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: iptests.c,v 2.1.4.2 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
#define PAUSE() tv.tv_sec = 0; tv.tv_usec = 10000; \
|
||||
(void) select(0, NULL, NULL, NULL, &tv)
|
||||
|
@ -1,13 +1,11 @@
|
||||
/*
|
||||
* larp.c (C) 1995-1998 Darren Reed
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)larp.c 1.1 8/19/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: larp.c,v 2.1 1999/08/04 17:31:10 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: larp.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1995-1998 by Darren Reed.
|
||||
*
|
||||
* This code may be freely distributed as long as it retains this notice
|
||||
* and is not changed in any way. The author accepts no responsibility
|
||||
* for the use of this software. I hate legaleese, don't you ?
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* @(#)linux.h 1.1 8/19/95
|
||||
*/
|
||||
|
@ -1,13 +1,11 @@
|
||||
/*
|
||||
* lsock.c (C) 1995-1998 Darren Reed
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)lsock.c 1.2 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1 1999/08/04 17:31:11 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: lsock.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
|
@ -6,14 +6,8 @@
|
||||
* conditions, enough of the TCP header is missing for unpredictable
|
||||
* results unless the filter is aware that this can happen.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <netdb.h>
|
||||
#include <string.h>
|
||||
@ -39,6 +33,12 @@ static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.1 2001/01/10 06:21:20 dar
|
||||
#endif
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)resend.c 1.3 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: resend.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
extern int opts;
|
||||
|
||||
static u_char pbuf[65536]; /* 1 big packet */
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1995-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <netdb.h>
|
||||
@ -43,7 +41,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)sbpf.c 1.3 8/25/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: sbpf.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
/*
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@ -40,7 +38,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)sdlpi.c 1.3 10/30/95 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1 1999/08/04 17:31:13 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: sdlpi.c,v 2.1.4.2 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#define CHUNKSIZE 8192
|
||||
@ -58,7 +56,8 @@ int sport, tout;
|
||||
char devname[16], *s, buf[256];
|
||||
int i, fd;
|
||||
|
||||
(void) sprintf(devname, "/dev/%s", device);
|
||||
(void) strcpy(devname, "/dev/");
|
||||
(void) strncat(devname, device, sizeof(devname) - strlen(devname));
|
||||
|
||||
s = devname + 5;
|
||||
while (*s && !isdigit(*s))
|
||||
|
@ -2,9 +2,7 @@
|
||||
* (C)opyright 1992-1998 Darren Reed.
|
||||
* (C)opyright 1997 Marc Boucher.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@ -29,7 +27,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)slinux.c 1.2 8/25/95";
|
||||
static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1 1999/08/04 17:31:14 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: slinux.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#define CHUNKSIZE 8192
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1992-1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@ -40,7 +38,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)snit.c 1.5 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: snit.c,v 2.1 1999/08/04 17:31:15 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: snit.c,v 2.1.4.1 2001/06/26 10:43:22 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
#define CHUNKSIZE 8192
|
||||
|
@ -1,14 +1,8 @@
|
||||
/*
|
||||
* sock.c (C) 1995-1998 Darren Reed
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darrenr Exp $";
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
@ -66,6 +60,12 @@ static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.1 2000/12/16 21:05:44 darre
|
||||
#include <netinet/tcp_var.h>
|
||||
#include "ipsend.h"
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)sock.c 1.2 1/11/96 (C)1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: sock.c,v 2.1.4.3 2001/07/15 22:00:14 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
int nproc;
|
||||
struct proc *proc;
|
||||
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* (C)opyright 1998 Darren Reed. (from tcplog)
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <strings.h>
|
||||
|
@ -1,12 +1,16 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#ifdef __FreeBSD__
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <assert.h>
|
||||
@ -55,7 +59,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6 2000/03/13 22:10:25 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: ipt.c,v 2.6.2.2 2001/06/26 10:43:19 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern char *optarg;
|
||||
|
@ -1,10 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* $Id: ipt.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
* $Id: ipt.h,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __IPT_H__
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
/*
|
||||
* kmemcpy() - copies n bytes from kernel memory into user buffer.
|
||||
@ -18,16 +16,24 @@
|
||||
#include <sys/file.h>
|
||||
#include "kmem.h"
|
||||
|
||||
#ifndef __STDC__
|
||||
# define const
|
||||
#endif
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)kmem.c 1.4 1/12/96 (C) 1992 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: kmem.c,v 2.2.2.3 2001/07/15 22:06:16 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
static int kmemfd = -1;
|
||||
|
||||
int openkmem()
|
||||
int openkmem(core)
|
||||
char *core;
|
||||
{
|
||||
if ((kmemfd = open(KMEM,O_RDONLY)) == -1)
|
||||
if (core == NULL)
|
||||
core = KMEM;
|
||||
|
||||
if ((kmemfd = open(core, O_RDONLY)) == -1)
|
||||
{
|
||||
perror("kmeminit:open");
|
||||
return -1;
|
||||
@ -45,7 +51,7 @@ register int n;
|
||||
if (!n)
|
||||
return 0;
|
||||
if (kmemfd == -1)
|
||||
if (openkmem() == -1)
|
||||
if (openkmem(NULL) == -1)
|
||||
return -1;
|
||||
if (lseek(kmemfd, pos, 0) == -1)
|
||||
{
|
||||
@ -76,7 +82,7 @@ register int n;
|
||||
if (!n)
|
||||
return 0;
|
||||
if (kmemfd == -1)
|
||||
if (openkmem() == -1)
|
||||
if (openkmem(NULL) == -1)
|
||||
return -1;
|
||||
if (lseek(kmemfd, pos, 0) == -1)
|
||||
{
|
||||
|
@ -1,10 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* $Id: kmem.h,v 2.2 2000/03/13 22:10:25 darrenr Exp $
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
* $Id: kmem.h,v 2.2.2.2 2001/06/26 10:43:19 darrenr Exp $
|
||||
*/
|
||||
|
||||
#ifndef __KMEM_H__
|
||||
@ -17,7 +15,7 @@
|
||||
# define __P(x) ()
|
||||
# endif
|
||||
#endif
|
||||
extern int openkmem __P((void));
|
||||
extern int openkmem __P((char *));
|
||||
extern int kmemcpy __P((char *, long, int));
|
||||
extern int kstrncpy __P((char *, long, int));
|
||||
|
||||
|
@ -374,7 +374,7 @@ against, e.g.:
|
||||
# packets with ONLY the SYN flag set.
|
||||
|
||||
... flags SA
|
||||
# becomes "flags SA/AUPRFS" and will match any
|
||||
# becomes "flags SA/AUPRFSC" and will match any
|
||||
# packet with only the SYN and ACK flags set.
|
||||
|
||||
... flags S/SA
|
||||
|
@ -76,4 +76,4 @@ ipf(4)
|
||||
.SH BUGS
|
||||
Packet headers are dropped when the internal buffer (static size) fills.
|
||||
.SH FILES
|
||||
/dev/ipl0
|
||||
/dev/ipl
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#if (SOLARIS2 >= 7)
|
||||
# define _SYS_VARARGS_H
|
||||
@ -52,7 +50,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)misc.c 1.3 2/4/96 (C) 1995 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: misc.c,v 2.2 2000/03/13 22:10:25 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: misc.c,v 2.2.2.1 2001/06/26 10:43:19 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern int opts;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors. The author accepts no
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
* responsibility and is not changed in any way.
|
||||
*
|
||||
* I hate legaleese, don't you ?
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
/*
|
||||
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
|
||||
@ -13,12 +11,24 @@
|
||||
|
||||
#include <sys/param.h>
|
||||
|
||||
#if defined(__FreeBSD__) && (__FreeBSD__ > 1)
|
||||
#if defined(__FreeBSD__)
|
||||
# ifdef IPFILTER_LKM
|
||||
# include <osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
# define ACTUALLY_LKM_NOT_KERNEL
|
||||
# else
|
||||
# include <sys/osreldate.h>
|
||||
# ifndef __FreeBSD_cc_version
|
||||
# include <sys/osreldate.h>
|
||||
# else
|
||||
# if __FreeBSD_cc_version < 430000
|
||||
# include <sys/osreldate.h>
|
||||
# endif
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
#include <sys/systm.h>
|
||||
@ -53,19 +63,16 @@
|
||||
#if (__FreeBSD_version >= 300000)
|
||||
# include <sys/socket.h>
|
||||
#endif
|
||||
#if (__FreeBSD_version >= 199511)
|
||||
#include <net/if.h>
|
||||
#include <netinet/in_systm.h>
|
||||
#include <netinet/in.h>
|
||||
#include <netinet/ip.h>
|
||||
#include <net/route.h>
|
||||
#include <net/if.h>
|
||||
#include <netinet/ip_var.h>
|
||||
#include <netinet/tcp.h>
|
||||
#include <netinet/tcpip.h>
|
||||
#endif
|
||||
#if (__FreeBSD__ > 1)
|
||||
# include <sys/sysent.h>
|
||||
#endif
|
||||
#include <sys/sysent.h>
|
||||
#include <sys/lkm.h>
|
||||
#include "netinet/ipl.h"
|
||||
#include "netinet/ip_compat.h"
|
||||
@ -392,7 +399,7 @@ int cmd, ver;
|
||||
# endif
|
||||
}
|
||||
# endif /* IPFILTER_LKM */
|
||||
static ipl_devsw_installed = 0;
|
||||
static int ipl_devsw_installed = 0;
|
||||
|
||||
static void ipl_drvinit __P((void *unused))
|
||||
{
|
||||
|
@ -1,10 +1,8 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
* (C)opyright 1997 by Marc Boucher.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original authors and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
/* TODO: (MARCXXX)
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
/*
|
||||
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
/*
|
||||
* 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
|
||||
@ -42,7 +40,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)mls_ipl.c 2.6 10/15/95 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: mls_ipl.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern int ipldetach __P((void));
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@ -54,7 +52,7 @@ extern char *sys_errlist[];
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.6 2000/07/08 02:14:40 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.11 2001/07/17 14:33:09 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
|
||||
@ -160,6 +158,8 @@ void *ptr;
|
||||
printf(" udp");
|
||||
if (np->in_flags & IPN_ROUNDR)
|
||||
printf(" round-robin");
|
||||
if (np->in_flags & IPN_FRAG)
|
||||
printf(" frag");
|
||||
printf("\n");
|
||||
if (opts & OPT_DEBUG)
|
||||
printf("\t%p %lu %#x %u %p %d\n", np->in_ifp,
|
||||
@ -231,6 +231,8 @@ void *ptr;
|
||||
ntohs(np->in_pmax));
|
||||
}
|
||||
}
|
||||
if (np->in_flags & IPN_FRAG)
|
||||
printf(" frag");
|
||||
printf("\n");
|
||||
if (opts & OPT_DEBUG) {
|
||||
printf("\tifp %p space %lu nextip %s pnext %d",
|
||||
@ -277,6 +279,7 @@ int linenum;
|
||||
char *s, *t, *cps[31], **cpp;
|
||||
int i, cnt;
|
||||
|
||||
proto = NULL;
|
||||
|
||||
if ((s = strchr(line, '\n')))
|
||||
*s = '\0';
|
||||
@ -553,7 +556,7 @@ int linenum;
|
||||
} else
|
||||
ipn.in_pmin = 0;
|
||||
} else if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) {
|
||||
if (strrchr(*cpp, '/') != NULL) {
|
||||
if (!*cpp || strrchr(*cpp, '/') != NULL) {
|
||||
fprintf(stderr, "%d: No netmask supported in %s\n",
|
||||
linenum, "destination host for redirect");
|
||||
return NULL;
|
||||
@ -623,6 +626,11 @@ int linenum;
|
||||
ipn.in_flags |= IPN_ROUNDR;
|
||||
}
|
||||
|
||||
if (*cpp && !strcasecmp(*cpp, "frag")) {
|
||||
cpp++;
|
||||
ipn.in_flags |= IPN_FRAG;
|
||||
}
|
||||
|
||||
if (*cpp) {
|
||||
fprintf(stderr,
|
||||
"%d: extra junk at the end of rdr: %s\n",
|
||||
@ -641,6 +649,11 @@ int linenum;
|
||||
if ((ipn.in_redir & NAT_MAPBLK) != 0)
|
||||
nat_setgroupmap(&ipn);
|
||||
|
||||
if (*cpp && !strcasecmp(*cpp, "frag")) {
|
||||
cpp++;
|
||||
ipn.in_flags |= IPN_FRAG;
|
||||
}
|
||||
|
||||
if (!*cpp)
|
||||
return &ipn;
|
||||
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@ -27,7 +25,7 @@
|
||||
|
||||
#if !defined(lint)
|
||||
static const char sccsid[] = "@(#)opt.c 1.8 4/10/96 (C) 1993-2000 Darren Reed";
|
||||
static const char rcsid[] = "@(#)$Id: opt.c,v 2.2 2000/03/13 22:10:26 darrenr Exp $";
|
||||
static const char rcsid[] = "@(#)$Id: opt.c,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $";
|
||||
#endif
|
||||
|
||||
extern int opts;
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
#include <sys/types.h>
|
||||
#if !defined(__SVR4) && !defined(__svr4__)
|
||||
@ -394,7 +392,15 @@ int linenum;
|
||||
linenum);
|
||||
return NULL;
|
||||
}
|
||||
if (**cpp == '!') {
|
||||
if (!strcmp(*cpp, "!")) {
|
||||
fil.fr_flags |= FR_NOTSRCIP;
|
||||
if (!*++cpp) {
|
||||
fprintf(stderr,
|
||||
"%d: missing host after from\n",
|
||||
linenum);
|
||||
return NULL;
|
||||
}
|
||||
} else if (**cpp == '!') {
|
||||
fil.fr_flags |= FR_NOTSRCIP;
|
||||
(*cpp)++;
|
||||
}
|
||||
@ -424,7 +430,15 @@ int linenum;
|
||||
return NULL;
|
||||
}
|
||||
ch = 0;
|
||||
if (**cpp == '!') {
|
||||
if (!strcmp(*cpp, "!")) {
|
||||
fil.fr_flags |= FR_NOTDSTIP;
|
||||
if (!*++cpp) {
|
||||
fprintf(stderr,
|
||||
"%d: missing host after from\n",
|
||||
linenum);
|
||||
return NULL;
|
||||
}
|
||||
} else if (**cpp == '!') {
|
||||
fil.fr_flags |= FR_NOTDSTIP;
|
||||
(*cpp)++;
|
||||
}
|
||||
|
@ -1,10 +1,9 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* $Id: pcap.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*
|
||||
* $Id: pcap.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $
|
||||
*/
|
||||
/*
|
||||
* This header file is constructed to match the version described by
|
||||
|
@ -107,7 +107,7 @@ char *argv[];
|
||||
int fd, sl = sizeof(sl), se;
|
||||
|
||||
openlog(argv[0], LOG_PID|LOG_NDELAY, LOG_DAEMON);
|
||||
if ((fd = open("/dev/ipl", O_RDONLY)) == -1) {
|
||||
if ((fd = open("/dev/ipnat", O_RDONLY)) == -1) {
|
||||
se = errno;
|
||||
perror("open");
|
||||
errno = se;
|
||||
@ -115,6 +115,9 @@ char *argv[];
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
bzero(&nl, sizeof(nl));
|
||||
nl.nl_flags = IPN_TCP;
|
||||
|
||||
bzero(&sin, sizeof(sin));
|
||||
sin.sin_family = AF_INET;
|
||||
sl = sizeof(sin);
|
||||
@ -151,8 +154,8 @@ char *argv[];
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
sin.sin_port = nl.nl_inport;
|
||||
sin.sin_addr = nl.nl_inip;
|
||||
sin.sin_port = nl.nl_realport;
|
||||
sin.sin_addr = nl.nl_realip;
|
||||
sl = sizeof(sin);
|
||||
|
||||
fd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
|
@ -1,9 +1,7 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
|
||||
#ifndef __SNOOP_H__
|
||||
@ -11,7 +9,7 @@
|
||||
|
||||
/*
|
||||
* written to comply with the RFC (1761) from Sun.
|
||||
* $Id: snoop.h,v 2.2 2000/03/13 22:10:27 darrenr Exp $
|
||||
* $Id: snoop.h,v 2.2.2.1 2001/06/26 10:43:20 darrenr Exp $
|
||||
*/
|
||||
struct snoophdr {
|
||||
char s_id[8];
|
||||
|
@ -1,12 +1,10 @@
|
||||
/*
|
||||
* Copyright (C) 1993-2000 by Darren Reed.
|
||||
* Copyright (C) 1993-2001 by Darren Reed.
|
||||
*
|
||||
* Redistribution and use in source and binary forms are permitted
|
||||
* provided that this notice is preserved and due credit is given
|
||||
* to the original author and the contributors.
|
||||
* See the IPFILTER.LICENCE file for details on licencing.
|
||||
*/
|
||||
/* #pragma ident "@(#)solaris.c 1.12 6/5/96 (C) 1995 Darren Reed"*/
|
||||
#pragma ident "@(#)$Id: solaris.c,v 2.15.2.8 2000/11/27 10:28:41 darrenr Exp $"
|
||||
#pragma ident "@(#)$Id: solaris.c,v 2.15.2.20 2001/07/18 14:58:28 darrenr Exp $"
|
||||
|
||||
#include <sys/systm.h>
|
||||
#include <sys/types.h>
|
||||
@ -147,7 +145,7 @@ static struct modlinkage modlink1 = { MODREV_1, &iplmod, NULL };
|
||||
static size_t hdrsizes[57][2] = {
|
||||
{ 0, 0 },
|
||||
{ IFT_OTHER, 0 },
|
||||
{ IFT_1822, 0 },
|
||||
{ IFT_1822, 14 }, /* 14 for ire0 ?? */
|
||||
{ IFT_HDH1822, 0 },
|
||||
{ IFT_X25DDN, 0 },
|
||||
{ IFT_X25, 0 },
|
||||
@ -210,8 +208,6 @@ int _init()
|
||||
{
|
||||
int ipfinst;
|
||||
|
||||
if (fr_running < 0)
|
||||
return -1;
|
||||
ipfinst = mod_install(&modlink1);
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: _init() = %d", ipfinst);
|
||||
@ -224,8 +220,6 @@ int _fini(void)
|
||||
{
|
||||
int ipfinst;
|
||||
|
||||
if (fr_running < 0)
|
||||
return -1;
|
||||
ipfinst = mod_remove(&modlink1);
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: _fini() = %d", ipfinst);
|
||||
@ -239,8 +233,6 @@ struct modinfo *modinfop;
|
||||
{
|
||||
int ipfinst;
|
||||
|
||||
if (fr_running < 0)
|
||||
return -1;
|
||||
ipfinst = mod_info(&modlink1, modinfop);
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: _info(%x) = %x", modinfop, ipfinst);
|
||||
@ -275,6 +267,31 @@ dev_info_t *dip;
|
||||
}
|
||||
|
||||
|
||||
static void ipf_ire_walk(ire, arg)
|
||||
ire_t *ire;
|
||||
void *arg;
|
||||
{
|
||||
qif_t *qif = arg;
|
||||
|
||||
if ((ire->ire_type == IRE_CACHE) &&
|
||||
#if SOLARIS2 >= 6
|
||||
(ire->ire_ipif != NULL) &&
|
||||
(ire->ire_ipif->ipif_ill == qif->qf_ill)
|
||||
#else
|
||||
(ire_to_ill(ire) == qif->qf_ill)
|
||||
#endif
|
||||
) {
|
||||
#if SOLARIS2 >= 8
|
||||
mblk_t *m = ire->ire_fp_mp;
|
||||
#else
|
||||
mblk_t *m = ire->ire_ll_hdr_mp;
|
||||
#endif
|
||||
if (m != NULL)
|
||||
qif->qf_hl = m->b_wptr - m->b_rptr;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static int ipf_attach(dip, cmd)
|
||||
dev_info_t *dip;
|
||||
ddi_attach_cmd_t cmd;
|
||||
@ -336,6 +353,14 @@ ddi_attach_cmd_t cmd;
|
||||
drv_usectohz(500000));
|
||||
if (fr_running == 1)
|
||||
return DDI_SUCCESS;
|
||||
#if SOLARIS2 >= 8
|
||||
case DDI_RESUME :
|
||||
case DDI_PM_RESUME :
|
||||
if (ipfr_timer_id == 0)
|
||||
ipfr_timer_id = timeout(ipfr_slowtimer, NULL,
|
||||
drv_usectohz(500000));
|
||||
return DDI_SUCCESS;
|
||||
#endif
|
||||
default:
|
||||
return DDI_FAILURE;
|
||||
}
|
||||
@ -403,6 +428,19 @@ ddi_detach_cmd_t cmd;
|
||||
cmn_err(CE_CONT, "%s detached\n", ipfilter_version);
|
||||
return (DDI_SUCCESS);
|
||||
}
|
||||
#if SOLARIS2 >= 8
|
||||
case DDI_SUSPEND :
|
||||
case DDI_PM_SUSPEND :
|
||||
if (ipfr_timer_id != 0) {
|
||||
untimeout(ipfr_timer_id);
|
||||
ipfr_timer_id = 0;
|
||||
}
|
||||
if (synctimeoutid) {
|
||||
untimeout(synctimeoutid);
|
||||
synctimeoutid = 0;
|
||||
}
|
||||
return DDI_SUCCESS;
|
||||
#endif
|
||||
default:
|
||||
return (DDI_FAILURE);
|
||||
}
|
||||
@ -479,7 +517,7 @@ size_t off;
|
||||
m = m->b_cont;
|
||||
|
||||
cmn_err(CE_CONT, " !IP %s:%d %d %p %p %p %d %p/%d %p/%d %p %d %d %p\n",
|
||||
qif ? qif->qf_name : "?", out, qif->qf_hl, q,
|
||||
qif ? qif->qf_name : "?", out, qif ? qif->qf_hl : -1, q,
|
||||
q ? q->q_ptr : NULL, q ? q->q_qinfo : NULL,
|
||||
mt->b_wptr - mt->b_rptr, m, MTYPE(m), mt, MTYPE(mt), m->b_rptr,
|
||||
m->b_wptr - m->b_rptr, off, ip);
|
||||
@ -529,8 +567,8 @@ int out;
|
||||
{
|
||||
register mblk_t *m, *mt = *mp;
|
||||
register ip_t *ip;
|
||||
size_t hlen, len, off, mlen, iphlen, plen;
|
||||
int err, synced = 0, sap, p;
|
||||
size_t hlen, len, off, off2, mlen, iphlen, plen, woff;
|
||||
int err, synced = 0, sap, p, realigned = 0, multi = 0;
|
||||
u_char *bp;
|
||||
#if SOLARIS2 >= 8
|
||||
ip6_t *ip6;
|
||||
@ -556,8 +594,21 @@ int out;
|
||||
bp = (u_char *)ALIGN32(mt->b_rptr);
|
||||
if (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO) {
|
||||
dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp;
|
||||
if (dl->dl_primitive != DL_UNITDATA_IND &&
|
||||
dl->dl_primitive != DL_UNITDATA_REQ) {
|
||||
if (dl->dl_primitive == DL_UNITDATA_IND) {
|
||||
multi = dl->dl_group_address;
|
||||
m = mt->b_cont;
|
||||
/*
|
||||
* This is a complete kludge to try and work around
|
||||
* some bizarre packets which drop through into
|
||||
* fr_donotip.
|
||||
*/
|
||||
if (m && multi && ((*((u_char *)m->b_rptr) == 0x0) &&
|
||||
((*((u_char *)m->b_rptr + 2) == 0x45)))) {
|
||||
ip = (ip_t *)(m->b_rptr + 2);
|
||||
off = 2;
|
||||
} else
|
||||
off = 0;
|
||||
} else if (dl->dl_primitive != DL_UNITDATA_REQ) {
|
||||
ip = (ip_t *)dl;
|
||||
if ((ip->ip_v == IPVERSION) &&
|
||||
(ip->ip_hl == (sizeof(*ip) >> 2)) &&
|
||||
@ -584,19 +635,6 @@ int out;
|
||||
return 0; /* No data blocks */
|
||||
}
|
||||
|
||||
/*
|
||||
* This is a complete kludge to try and work around some bizarre
|
||||
* packets which drop through into fr_donotip.
|
||||
*/
|
||||
if ((mt != m) && (MTYPE(mt) == M_PROTO || MTYPE(mt) == M_PCPROTO)) {
|
||||
dl_unitdata_ind_t *dl = (dl_unitdata_ind_t *)bp;
|
||||
if ((dl->dl_primitive == DL_UNITDATA_IND) &&
|
||||
(dl->dl_group_address == 1))
|
||||
if (((*((u_char *)m->b_rptr) == 0x0) &&
|
||||
((*((u_char *)m->b_rptr + 2) == 0x45))))
|
||||
off += 2;
|
||||
}
|
||||
|
||||
ip = (ip_t *)(m->b_rptr + off); /* MMM */
|
||||
|
||||
/*
|
||||
@ -648,10 +686,13 @@ int out;
|
||||
((char *)&tlen)[0] = ((char *)&ip6->ip6_plen)[0];
|
||||
((char *)&tlen)[1] = ((char *)&ip6->ip6_plen)[1];
|
||||
plen = ntohs(tlen);
|
||||
sap = IP6_DL_SAP;
|
||||
if (!plen)
|
||||
return -1; /* Jumbo gram */
|
||||
plen += sizeof(*ip6);
|
||||
}
|
||||
#endif
|
||||
else {
|
||||
plen = 0;
|
||||
hlen = 0;
|
||||
sap = -1;
|
||||
}
|
||||
@ -659,34 +700,77 @@ int out;
|
||||
/*
|
||||
* Ok, the IP header isn't on a 32bit aligned address so junk it.
|
||||
*/
|
||||
if (((u_int)ip & 0x3) || (len < hlen) || (sap == -1)) {
|
||||
mblk_t *m2;
|
||||
u_char *s;
|
||||
if (((u_long)ip & 0x3) || (plen > mlen) || (len < hlen) ||
|
||||
(sap == -1)) {
|
||||
mblk_t *m1, *m2;
|
||||
u_char *s, c;
|
||||
int v;
|
||||
|
||||
/*
|
||||
* Junk using pullupmsg - it's next to useless.
|
||||
*/
|
||||
fixalign:
|
||||
if (off)
|
||||
m->b_rptr -= off;
|
||||
c = *(u_char *)ip;
|
||||
c >>= 4;
|
||||
if (c != 4
|
||||
#if SOLARIS2 >= 8
|
||||
&& c != 6
|
||||
#endif
|
||||
) {
|
||||
frstats[out].fr_notip++;
|
||||
return (fr_flags & FF_BLOCKNONIP) ? -1 : 0;
|
||||
}
|
||||
|
||||
if (realigned)
|
||||
return -1;
|
||||
realigned = 1;
|
||||
off2 = (size_t)((u_long)ip & 0x3);
|
||||
if (off2)
|
||||
off2 = 4 - off2;
|
||||
len = msgdsize(m);
|
||||
m2 = allocb(len, BPRI_HI);
|
||||
m2 = allocb(len + off2, BPRI_HI);
|
||||
if (m2 == NULL) {
|
||||
frstats[out].fr_pull[1]++;
|
||||
return -1;
|
||||
}
|
||||
|
||||
m2->b_wptr = m2->b_rptr + len;
|
||||
s = (u_char *)ip;
|
||||
for (bp = m2->b_rptr; m; bp += len) {
|
||||
len = m->b_wptr - s;
|
||||
bcopy(m->b_rptr, bp, len);
|
||||
m = m->b_cont;
|
||||
if (m)
|
||||
s = m->b_rptr;
|
||||
}
|
||||
*mp = m2;
|
||||
MTYPE(m2) = M_DATA;
|
||||
freemsg(mt);
|
||||
mt = m2;
|
||||
if (m->b_rptr != (u_char *)ip)
|
||||
m2->b_rptr += off2;
|
||||
m2->b_wptr = m2->b_rptr + len;
|
||||
m1 = m;
|
||||
s = (u_char *)m->b_rptr;
|
||||
for (bp = m2->b_rptr; m1 && (bp < m2->b_wptr); bp += len) {
|
||||
len = MIN(m1->b_wptr - s, m2->b_wptr - bp);
|
||||
bcopy(s, bp, len);
|
||||
m1 = m1->b_cont;
|
||||
if (m1)
|
||||
s = m1->b_rptr;
|
||||
}
|
||||
|
||||
if (mt != m && mt->b_cont == m && !off) {
|
||||
/*
|
||||
* check if the buffer we're changing is chained in-
|
||||
* between other buffers and unlink/relink as required.
|
||||
*/
|
||||
(void) unlinkb(mt); /* should return 'm' */
|
||||
m1 = unlinkb(m);
|
||||
if (m1)
|
||||
linkb(m2, m1);
|
||||
freemsg(m);
|
||||
linkb(mt, m2);
|
||||
} else {
|
||||
if (m == mt) {
|
||||
m1 = unlinkb(mt);
|
||||
if (m1)
|
||||
linkb(m2, m1);
|
||||
}
|
||||
freemsg(mt);
|
||||
*mp = m2;
|
||||
mt = m2;
|
||||
}
|
||||
|
||||
frstats[out].fr_pull[0]++;
|
||||
synced = 1;
|
||||
@ -714,7 +798,7 @@ int out;
|
||||
#ifndef sparc
|
||||
# if SOLARIS2 >= 8
|
||||
if (sap == IP6_DL_SAP) {
|
||||
ip6->ip6_plen = plen;
|
||||
ip6->ip6_plen = plen - sizeof(*ip6);
|
||||
} else {
|
||||
# endif
|
||||
__ipoff = (u_short)ip->ip_off;
|
||||
@ -734,7 +818,7 @@ int out;
|
||||
|
||||
if ((
|
||||
#if SOLARIS2 >= 8
|
||||
(sap == IP6_DL_SAP) && (mlen < iphlen + plen)) ||
|
||||
(sap == IP6_DL_SAP) && (mlen < plen)) ||
|
||||
((sap == 0) &&
|
||||
#endif
|
||||
((iphlen < hlen) || (iphlen > plen) || (mlen < plen)))) {
|
||||
@ -744,7 +828,7 @@ int out;
|
||||
#ifndef sparc
|
||||
# if SOLARIS2 >= 8
|
||||
if (sap == IP6_DL_SAP) {
|
||||
ip6->ip6_plen = htons(plen);
|
||||
ip6->ip6_plen = htons(plen - sizeof(*ip6));
|
||||
} else {
|
||||
# endif
|
||||
__ipoff = (u_short)ip->ip_off;
|
||||
@ -790,15 +874,13 @@ int out;
|
||||
break;
|
||||
}
|
||||
|
||||
woff = 0;
|
||||
if (hlen > mlen) {
|
||||
hlen = mlen;
|
||||
#if SOLARIS2 >= 8
|
||||
} else if (sap == IP6_DL_SAP) {
|
||||
if (m->b_wptr - m->b_rptr > plen + hlen)
|
||||
m->b_wptr = m->b_rptr + plen + hlen;
|
||||
#endif
|
||||
} else if (m->b_wptr - m->b_rptr > plen)
|
||||
m->b_wptr = m->b_rptr + plen;
|
||||
} else if (m->b_wptr - m->b_rptr > plen) {
|
||||
woff = m->b_wptr - m->b_rptr - plen;
|
||||
m->b_wptr -= woff;
|
||||
}
|
||||
|
||||
/*
|
||||
* If we don't have enough data in the mblk or we haven't yet copied
|
||||
@ -806,7 +888,7 @@ int out;
|
||||
*/
|
||||
if ((hlen > len)) {
|
||||
if (!pullupmsg(m, (int)hlen)) {
|
||||
cmn_err(CE_NOTE, "pullupmsg failed\n");
|
||||
cmn_err(CE_NOTE, "pullupmsg failed");
|
||||
frstats[out].fr_pull[1]++;
|
||||
return -1;
|
||||
}
|
||||
@ -818,8 +900,9 @@ int out;
|
||||
qif->qf_off = off;
|
||||
qif->qf_len = len;
|
||||
err = fr_check(ip, iphlen, qif->qf_ill, out, qif, mp);
|
||||
if (err == 2)
|
||||
if (err == 2) {
|
||||
goto fixalign;
|
||||
}
|
||||
/*
|
||||
* Copy back the ip header data if it was changed, we haven't yet
|
||||
* freed the message and we aren't going to drop the packet.
|
||||
@ -828,11 +911,12 @@ int out;
|
||||
*/
|
||||
if (*mp != NULL) {
|
||||
if (*mp == mt) {
|
||||
m->b_wptr += woff;
|
||||
m->b_rptr -= off;
|
||||
#ifndef sparc
|
||||
# if SOLARIS2 >= 8
|
||||
if (sap == IP6_DL_SAP) {
|
||||
ip6->ip6_plen = htons(plen);
|
||||
ip6->ip6_plen = htons(plen - sizeof(*ip6));
|
||||
} else {
|
||||
# endif
|
||||
__ipoff = (u_short)ip->ip_off;
|
||||
@ -847,13 +931,37 @@ int out;
|
||||
#endif
|
||||
} else
|
||||
cmn_err(CE_NOTE,
|
||||
"!IP Filter: *mp %p mt %p %s\n", *mp, mt,
|
||||
"!IP Filter: *mp %p mt %p %s", *mp, mt,
|
||||
"mblk changed, cannot revert ip_len, ip_off");
|
||||
}
|
||||
return err;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Only called for M_IOCACK messages
|
||||
*/
|
||||
void fr_qif_update(qif, mp)
|
||||
qif_t *qif;
|
||||
mblk_t *mp;
|
||||
{
|
||||
struct iocblk *iocp;
|
||||
|
||||
if (!qif || !mp)
|
||||
return;
|
||||
iocp = (struct iocblk *)mp->b_rptr;
|
||||
if (mp->b_cont && (iocp->ioc_cmd == DL_IOC_HDR_INFO)) {
|
||||
mp = mp->b_cont;
|
||||
if (MTYPE(mp) == M_PROTO && mp->b_cont) {
|
||||
mp = mp->b_cont;
|
||||
if (MTYPE(mp) == M_DATA) {
|
||||
qif->qf_hl = mp->b_wptr - mp->b_rptr;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
int fr_qin(q, mb)
|
||||
queue_t *q;
|
||||
mblk_t *mb;
|
||||
@ -863,6 +971,7 @@ mblk_t *mb;
|
||||
|
||||
if (fr_running <= 0) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
@ -871,6 +980,17 @@ mblk_t *mb;
|
||||
mblk_t *m1;
|
||||
|
||||
m1 = copymsg(mb);
|
||||
if (!m1) {
|
||||
frstats[0].fr_drop++;
|
||||
mb->b_next = NULL;
|
||||
mb->b_prev = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
m1->b_next = mb->b_next;
|
||||
mb->b_next = NULL;
|
||||
m1->b_prev = mb->b_prev;
|
||||
mb->b_prev = NULL;
|
||||
freemsg(mb);
|
||||
mb = m1;
|
||||
frstats[0].fr_copy++;
|
||||
@ -881,6 +1001,7 @@ mblk_t *mb;
|
||||
if (fr_running <= 0) {
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
@ -925,17 +1046,21 @@ mblk_t *mb;
|
||||
frstats[0].fr_drop++;
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
|
||||
bcopy((char *)qif, (char *)&qf, sizeof(qf));
|
||||
qif = &qf;
|
||||
type = MTYPE(mb);
|
||||
pnext = qif->qf_rqinfo->qi_putp;
|
||||
type = MTYPE(mb);
|
||||
if (type == M_IOCACK)
|
||||
fr_qif_update(qif, mb);
|
||||
else {
|
||||
bcopy((char *)qif, (char *)&qf, sizeof(qf));
|
||||
|
||||
if (datamsg(type) || (type == M_BREAK))
|
||||
err = fr_precheck(&mb, q, qif, 0);
|
||||
if (datamsg(type) || (type == M_BREAK))
|
||||
err = fr_precheck(&mb, q, &qf, 0);
|
||||
}
|
||||
|
||||
RWLOCK_EXIT(&ipfs_mutex);
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
@ -944,11 +1069,13 @@ mblk_t *mb;
|
||||
if (pnext)
|
||||
return (*pnext)(q, mb);
|
||||
|
||||
cmn_err(CE_WARN, "!IP Filter: inp NULL: qif %x q %x info %x",
|
||||
qif, q, q->q_qinfo);
|
||||
cmn_err(CE_WARN,
|
||||
"!IP Filter: inp NULL: qif %x %s q %x info %x",
|
||||
&qf, qf.qf_name, q, q->q_qinfo);
|
||||
}
|
||||
if (mb) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
}
|
||||
return 0;
|
||||
@ -964,14 +1091,32 @@ mblk_t *mb;
|
||||
|
||||
if (fr_running <= 0) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (mb->b_datap->db_ref > 1) {
|
||||
#if SOLARIS2 >= 6
|
||||
if ((!dohwcksum || mb->b_ick_flag != ICK_VALID) &&
|
||||
(mb->b_datap->db_ref > 1))
|
||||
#else
|
||||
if (mb->b_datap->db_ref > 1)
|
||||
#endif
|
||||
{
|
||||
mblk_t *m1;
|
||||
|
||||
m1 = copymsg(mb);
|
||||
if (!m1) {
|
||||
frstats[1].fr_drop++;
|
||||
mb->b_next = NULL;
|
||||
mb->b_prev = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
m1->b_next = mb->b_next;
|
||||
mb->b_next = NULL;
|
||||
m1->b_prev = mb->b_prev;
|
||||
mb->b_prev = NULL;
|
||||
freemsg(mb);
|
||||
mb = m1;
|
||||
frstats[1].fr_copy++;
|
||||
@ -982,6 +1127,7 @@ mblk_t *mb;
|
||||
if (fr_running <= 0) {
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
@ -998,7 +1144,7 @@ mblk_t *mb;
|
||||
synced = 1;
|
||||
goto again;
|
||||
}
|
||||
/* fr_donotip(0, NULL, q, mb, mb, NULL, 0); */
|
||||
/* fr_donotip(1, NULL, q, mb, mb, NULL, 0); */
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
return (*pnext)(q, mb);
|
||||
}
|
||||
@ -1036,17 +1182,21 @@ mblk_t *mb;
|
||||
frstats[1].fr_drop++;
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
|
||||
bcopy((char *)qif, (char *)&qf, sizeof(qf));
|
||||
qif = &qf;
|
||||
type = MTYPE(mb);
|
||||
pnext = qif->qf_wqinfo->qi_putp;
|
||||
type = MTYPE(mb);
|
||||
if (type == M_IOCACK)
|
||||
fr_qif_update(qif, mb);
|
||||
else {
|
||||
bcopy((char *)qif, (char *)&qf, sizeof(qf));
|
||||
|
||||
if (datamsg(type) || (type == M_BREAK))
|
||||
err = fr_precheck(&mb, q, qif, 1);
|
||||
if (datamsg(type) || (type == M_BREAK))
|
||||
err = fr_precheck(&mb, q, &qf, 1);
|
||||
}
|
||||
|
||||
RWLOCK_EXIT(&ipfs_mutex);
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
@ -1057,10 +1207,11 @@ mblk_t *mb;
|
||||
|
||||
cmn_err(CE_WARN,
|
||||
"!IP Filter: outp NULL: qif %x %s q %x info %x",
|
||||
qif, qif->qf_name, q, q->q_qinfo);
|
||||
&qf, qf.qf_name, q, q->q_qinfo);
|
||||
}
|
||||
if (mb) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
}
|
||||
return 0;
|
||||
@ -1080,6 +1231,7 @@ void *arg;
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
}
|
||||
|
||||
|
||||
static int ipf_ip_qin(q, mb)
|
||||
queue_t *q;
|
||||
mblk_t *mb;
|
||||
@ -1089,6 +1241,7 @@ mblk_t *mb;
|
||||
|
||||
if (fr_running <= 0) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
@ -1100,18 +1253,24 @@ mblk_t *mb;
|
||||
if (fr_running <= 0) {
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
return 0;
|
||||
}
|
||||
ioc = (struct iocblk *)mb->b_rptr;
|
||||
|
||||
switch (ioc->ioc_cmd) {
|
||||
switch (ioc->ioc_cmd)
|
||||
{
|
||||
case DL_IOC_HDR_INFO:
|
||||
fr_qif_update(qif_from_queue(q), mb);
|
||||
break;
|
||||
case I_LINK:
|
||||
case I_UNLINK:
|
||||
case SIOCSIFADDR:
|
||||
case SIOCSIFFLAGS:
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x\n", ioc->ioc_cmd);
|
||||
cmn_err(CE_NOTE, "IP Filter: ipf_ip_qin() M_IOCTL type=0x%x",
|
||||
ioc->ioc_cmd);
|
||||
#endif
|
||||
WRITE_ENTER(&ipfs_mutex);
|
||||
if (synctimeoutid == 0) {
|
||||
@ -1135,7 +1294,7 @@ extern struct streamtab ipinfo;
|
||||
void solipdrvattach()
|
||||
{
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx\n",
|
||||
cmn_err(CE_NOTE, "IP Filter: solipdrvattach() %d ipinfo=0x%lx",
|
||||
ipdrvattcnt, &ipinfo);
|
||||
#endif
|
||||
|
||||
@ -1150,7 +1309,7 @@ void solipdrvattach()
|
||||
int solipdrvdetach()
|
||||
{
|
||||
#ifdef IPFDEBUG
|
||||
cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx\n",
|
||||
cmn_err(CE_NOTE, "IP Filter: solipdrvdetach() %d ipinfo=0x%lx",
|
||||
ipdrvattcnt, &ipinfo);
|
||||
#endif
|
||||
|
||||
@ -1212,7 +1371,7 @@ void solattach()
|
||||
KMALLOC(qif, qif_t *);
|
||||
if (!qif) {
|
||||
cmn_err(CE_WARN,
|
||||
"IP Filter: malloc(%d) for qif_t failed\n",
|
||||
"IP Filter: malloc(%d) for qif_t failed",
|
||||
sizeof(qif_t));
|
||||
RWLOCK_EXIT(&ipfs_mutex);
|
||||
continue;
|
||||
@ -1288,11 +1447,17 @@ void solattach()
|
||||
(hdrsizes[il->ill_type][0] == il->ill_type))
|
||||
qif->qf_hl = hdrsizes[il->ill_type][1];
|
||||
|
||||
if (qif->qf_hl == 0)
|
||||
if (qif->qf_hl == 0 && il->ill_type != IFT_OTHER)
|
||||
cmn_err(CE_WARN,
|
||||
"Unknown layer 2 header size for %s type %d\n",
|
||||
qif->qf_name, il->ill_type);
|
||||
"Unknown layer 2 header size for %s type %d",
|
||||
il->ill_name, il->ill_type);
|
||||
}
|
||||
|
||||
/*
|
||||
* XXX Awful hack for PPP; fix when PPP/snoop fixed.
|
||||
*/
|
||||
if (il->ill_type == IFT_ETHER && !il->ill_bcast_addr_length)
|
||||
qif->qf_hl = 0;
|
||||
#endif
|
||||
strncpy(qif->qf_name, il->ill_name, sizeof(qif->qf_name));
|
||||
qif->qf_name[sizeof(qif->qf_name) - 1] = '\0';
|
||||
@ -1377,6 +1542,7 @@ void solattach()
|
||||
#endif
|
||||
out->q_qinfo = &qif->qf_wqinit;
|
||||
|
||||
ire_walk(ipf_ire_walk, (char *)qif);
|
||||
RWLOCK_EXIT(&ipfs_mutex);
|
||||
cmn_err(CE_CONT, "IP Filter: attach to [%s,%d] - %s\n",
|
||||
qif->qf_name, il->ill_ppa,
|
||||
@ -1634,7 +1800,7 @@ frdest_t *fdp;
|
||||
* data, not the original, if and only if it is already pointing at
|
||||
* the current mblk data.
|
||||
*/
|
||||
if (ip == (ip_t *)qf->qf_m->b_rptr && qf->qf_m != mb)
|
||||
if ((ip == (ip_t *)qf->qf_m->b_rptr) && (qf->qf_m != mb))
|
||||
ip = (ip_t *)mb->b_rptr;
|
||||
|
||||
/*
|
||||
@ -1646,6 +1812,7 @@ frdest_t *fdp;
|
||||
mp = (*mpp)->b_cont;
|
||||
(*mpp)->b_cont = NULL;
|
||||
(*mpp)->b_prev = NULL;
|
||||
(*mpp)->b_next = NULL;
|
||||
freemsg(*mpp);
|
||||
*mpp = mp;
|
||||
}
|
||||
@ -1666,7 +1833,7 @@ frdest_t *fdp;
|
||||
if (!ir)
|
||||
ir = (ire_t *)-1;
|
||||
|
||||
fd.fd_ifp = (struct ifnet *)ir;
|
||||
fd.fd_ifp = (struct ifnet *)ir;
|
||||
fd.fd_ip = ip->ip_dst;
|
||||
fdp = &fd;
|
||||
}
|
||||
@ -1715,6 +1882,7 @@ frdest_t *fdp;
|
||||
if (ifp == NULL)
|
||||
goto bad_fastroute;
|
||||
fr = fin->fin_fr;
|
||||
|
||||
/*
|
||||
* In case we're here due to "to <if>" being used with
|
||||
* "keep state", check that we're going in the correct
|
||||
@ -1722,7 +1890,7 @@ frdest_t *fdp;
|
||||
*/
|
||||
if ((fr != NULL) && (fdp->fd_ifp != NULL) &&
|
||||
(fin->fin_rev != 0) && (fdp == &fr->fr_tif))
|
||||
return -1;
|
||||
return 1;
|
||||
|
||||
fin->fin_ifp = ifp;
|
||||
if (fin->fin_out == 0) {
|
||||
@ -1783,6 +1951,7 @@ frdest_t *fdp;
|
||||
q = WR(ir->ire_rfq);
|
||||
if (q) {
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
mb->b_queue = q;
|
||||
RWLOCK_EXIT(&ipfs_mutex);
|
||||
RWLOCK_EXIT(&ipf_solaris);
|
||||
@ -1804,13 +1973,16 @@ frdest_t *fdp;
|
||||
READ_ENTER(&ipf_solaris);
|
||||
READ_ENTER(&ipfs_mutex);
|
||||
ipl_frouteok[0]++;
|
||||
*mpp = NULL;
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
bad_fastroute:
|
||||
mb->b_prev = NULL;
|
||||
mb->b_next = NULL;
|
||||
freemsg(mb);
|
||||
ipl_frouteok[1]++;
|
||||
*mpp = NULL;
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
@ -15,7 +15,7 @@ first:
|
||||
-mkdir -p results
|
||||
|
||||
# Filtering tests
|
||||
ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14
|
||||
ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14
|
||||
|
||||
# Rule parsing tests
|
||||
ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11
|
||||
@ -28,7 +28,7 @@ ntests: n1 n2 n3 n4 n5 n6 n7
|
||||
f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f14:
|
||||
@/bin/sh ./dotest $@
|
||||
|
||||
f12:
|
||||
f12 f13:
|
||||
@/bin/sh ./hextest $@
|
||||
|
||||
i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11:
|
||||
@ -38,6 +38,6 @@ n1 n2 n3 n4 n5 n6 n7:
|
||||
@/bin/sh ./nattest $@
|
||||
|
||||
clean:
|
||||
/bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f14 results/*
|
||||
/bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f13 f12 f14 results/*
|
||||
/bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11
|
||||
/bin/rm -f n1 n2 n3 n4 n5 n6 n7
|
||||
|
@ -1,4 +1,4 @@
|
||||
pass in on ed0(!) proto tcp from 127.0.0.1/32 to 127.0.0.1/32 port = 23 flags S/SA
|
||||
block in on lo0(!) proto tcp from any to any flags A/0xbf
|
||||
block in on lo0(!) proto tcp from any to any flags A/FSRPAUC
|
||||
pass in on lo0(!) proto tcp from any to any flags /SPA
|
||||
block in on lo0(!) proto tcp from any to any flags 0x80/A
|
||||
block in on lo0(!) proto tcp from any to any flags C/A
|
||||
|
@ -33,6 +33,10 @@
|
||||
45 00 001c 0008 2000 3f 11 0000 01010101 02010101
|
||||
0035003500040000
|
||||
|
||||
# 1.1.1.1,1 -> 2.1.1.1,1 TTL=63 UDP MF FO=0 (short)
|
||||
45 00 0018 0008 2000 3f 11 0000 01010101 02010101
|
||||
00350036
|
||||
|
||||
# 1.1.1.1,53 -> 2.1.1.1,53 TTL=63 UDP FO=1
|
||||
45 00 001c 0008 0001 3f 11 0000 01010101 02010101
|
||||
0000000000000000
|
||||
|
Loading…
Reference in New Issue
Block a user