Commit Graph

241 Commits

Author SHA1 Message Date
Kyle Evans
0690ee732a ipfilter: remove duplicate definition of 'thishost'
thishost is already defined in lib/initparse.c; no need for this one. This
fixes the ipfilter build with -fno-common.

-fno-common will become the default in GCC10/LLVM11.

MFC after:	3 days
2020-03-29 02:26:58 +00:00
Cy Schubert
9658b6b3f4 As with ipf(8), give ippool(8) the ability to load IP pools from multiple
files. This allows for loading, during the same invocation of ippool, of
multiple sources of input using multiple tools to concurrently maintain the
files such as fail2ban, macro preprocessors, and manually.

MFC after:	1 week
2020-02-18 11:26:49 +00:00
Cy Schubert
87b60ffe39 Fix a typo (upto --> up to) and reword to improve word flow.
MFC after:	3 days
2019-12-02 20:39:40 +00:00
Cy Schubert
a97e8d2fe4 Implement the dynamic add (-A) and removal (-R) of ippool pools
from the command line. Prior to this the functionality was mostly there
however since the pool type (-t) was not recognized by the -A and -R
command options -- not recognized by getopt(). Additionally the code to
implement the dynamic add and removal of pools didn't work.

When dynamically adding (-A) a pool a type (-t) to specify if the pool
is a tree or hash pool must  be specified. When dynamically removing (-R)
a pool, omitting -t will cause a search-and-destroy which will remove
both types of pools matching the name given (-m).

PR:		218433
MFC after:	1 week
2019-09-27 00:29:12 +00:00
Cy Schubert
e7257e1499 The no resolve (OPT_NORESOLVE) does nothing. Additionally, it (-R)
conflicts with the command option of the same name (also -R).
Remove the superfluous and confusing non-global non-command -R option.

PR:		218433
MFC after:	1 week
2019-09-27 00:29:09 +00:00
Cy Schubert
80aa6435f0 Sync with source:
Only a role of "ipf" is currentlysupported as the other documented
(and undocumented) roles are #ifdef'd out.

The plan is to complete ippool(8) as it is even in its current state
a powerful feature/tool.

PR:		218433
MFC after:	1 month
2019-09-27 00:29:06 +00:00
Cy Schubert
a263199455 Fix a typo.
MFC after:	3 days
2019-09-27 00:29:03 +00:00
Cy Schubert
4fcb870612 Teach the ippool parser about address families. This is a precursor
to implementing IPv6 support within ippool which requires reworking
radix_ipf.c.

MFC after:	1 month
2019-09-26 03:09:45 +00:00
Cy Schubert
9aa0318d3c Fix a typo.
PR:		238816
MFC after:	1 week
X-MFC with:	r349503
2019-06-28 04:52:24 +00:00
Cy Schubert
76af5effde Document the -B, binary logfile, and the -C config file options.
Reference the ipmon.5 man page and ipmon.conf.

PR:		238816
MFC after:	1 week
2019-06-28 04:28:32 +00:00
Cy Schubert
358e680a67 Return a return code scripts might expect. I missed this while
reviewing and rewriting a patch in PR/238816.

PR:		238816
Reported by:	rgrimes@
Pointy hat to:	cy@
MFC after:	1 week
X-MFC with:	r349450
2019-06-27 03:50:13 +00:00
Cy Schubert
accc4633db Update usage() to refect the current state of ipmon.
PR:		238816
MFC after:	1 week
2019-06-27 02:43:30 +00:00
Cy Schubert
797a7db05a Fix a typo.
PR/238816 initially addressed updates to usage() however it has now
become a shopping list of fixes to ipmon man pages and usage().

PR:		238816
MFC after:	3 days
2019-06-27 02:42:56 +00:00
Cy Schubert
e9a5006bff Kernel module shim sources have no business being in the userland
build directory, especially those for other operating systems.
The kernel module shims for other operating systems are hereby removed.
The kernel module shim for FreeBSD, mlfk_ipl.c, is already in
sys/contrib/ipfilter/netinet. The one here is never used and should
not be in the userland build directory either.

mlfk_rule.c isn't used either however we will keep it in case someone
wishes to use this shim to load rules via a kernel module, handy for
embedded. In that case it should be copied to
sys/contrib/ipfilter/netinet and a Makefile created to employ it.
(Probably a useful documentation project when time permits.)

MFC after:	1 month
2019-02-03 05:26:07 +00:00
Cy Schubert
e559413d6f Remove a redundant ip_compat.h, originally merged from upstream.
MFC after:	1 month
2019-02-03 05:26:01 +00:00
Cy Schubert
0fcd8cab4e ipfilter #ifdef cleanup.
Remove #ifdefs for ancient and irrelevant operating systems from
ipfilter.

When ipfilter was written the UNIX and UNIX-like systems in use
were diverse and plentiful. IRIX, Tru64 (OSF/1) don't exist any
more. OpenBSD removed ipfilter shortly after the first time the
ipfilter license terms changed in the early 2000's. ipfilter on AIX,
HP/UX, and Linux never really caught on. Removal of code for operating
systems that ipfilter will never run on again will simplify the code
making it easier to fix bugs, complete partially implemented features,
and extend ipfilter.

Unsupported previous version FreeBSD code and some older NetBSD code
has also been removed.

What remains is supported FreeBSD, NetBSD, and illumos. FreeBSD and
NetBSD have collaborated exchanging patches, while illumos has expressed
willingness to have their ipfilter updated to 5.1.2, provided their
zone-specific updates to their ipfilter are merged (which are of interest
to FreeBSD to allow control of ipfilters in jails from the global zone).

Reviewed by:	glebius@
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D19006
2019-02-03 05:25:49 +00:00
Cy Schubert
60f4a175c5 Fix a typo.
MFC after:	3 days
2019-01-27 02:31:42 +00:00
Cy Schubert
e719f737b7 Remove redundant ipfilter version of pcap-bpf.h. As of r214535 it was
no longer needed.

MFC after:	1 week
2019-01-16 20:46:39 +00:00
Cy Schubert
636a29ff4f Remove an IRIX-only source file.
MFC after:	1 week
2019-01-16 02:05:42 +00:00
Cy Schubert
480717af29 Remove ipsd (IP Scan Detetor). It is unused and to my knowledge has
never been used on any platform that ipfilter has been on. However
it looks like it could be a useful utility, therefore there are plans
to make it a port one day. It lacks a man page as well.

MFC after:	1 month
2019-01-06 21:24:44 +00:00
Cy Schubert
da7e48c690 TCP_PAWS_IDLE is does not exist in NetBSD and illumos. In FreeBSD
TCP_PAWS_IDLE is defined in netinet/tcp_seq.h, however this header
isn't included explicitly or implicitly at this point therefore
as far ipfilter is concerned TCP_PAWS_IDLE is not defined. Remove
the #ifdef and include netinet/tcp.h unconditionally.

MFC after:	1 week
2018-12-30 04:25:48 +00:00
Cy Schubert
efc4145a6e Remove an ugly Ultrix hack. Ultrix has been AWOL since the last ice
age, more to come.

MFC after:	1 week
2018-12-06 20:15:54 +00:00
Cy Schubert
b1ece51fb8 As part of the general cleanup of the ipfilter code, special cases
are committed separately to document fixing them separately from
the general cleanup. In this case we don't want to hide the utter
brokenness of what is being fixed.

Clean up a discombobulated block of #if's, with one block unreachable.
ip_fil.c is used in ipftest which is used to dry-run test ipfilter
rules in userspace without loading them in the kernel. The call to
(*ifp->if_output) matches that in the FreeBSD kernel.

Further testing and work will be required to make ipftest fully
functional.

MFC after:	1 week
2018-12-04 06:11:04 +00:00
Cy Schubert
11b5e0cd9c loadpoolfile() implements a -R (NORESOLVE) option which is not listed
in usage(). This commit trues up usage() with loadpoolfile().
2017-08-05 06:46:06 +00:00
Cy Schubert
223428af47 As in r315225, discard 3072 bytes of RC4 bytestream instead of 1024.
PR:		217920
Submitted by:	codarren@hackers.mu
Reviewed by:	emaste, cem
Approved by:	so (implicit, in r315225)
MFC after:	1 week
Differential Revision:	D11747
Patterned after:	r315225
2017-07-27 06:26:15 +00:00
Cy Schubert
e7df11b869 Document supported poollist() (ippool -l) options in usage() and in
ippool.8 man page.
2017-07-05 05:50:36 +00:00
Cy Schubert
e5426b9f65 Ansify entry and exit points.
MFC after:	1 month
2017-06-28 19:08:07 +00:00
Cy Schubert
3fe0d81e1f In poolnodecommand() (ippool -a and ippool -r) -m (pool name) is not
optional.
2017-06-28 02:30:32 +00:00
Cy Schubert
f21680fd98 Replace AF_INET6 ifdefs with USE_INET6 to be consistent with the rest
of the ipfilter souce tree.
2017-06-27 04:54:58 +00:00
Cy Schubert
43988e3f50 Replace AF_INET6 ifdefs with USE_INET6 ifdefs. This is more consistent
and guaranteed to build everywhere in ipfilter.

Not all of this commit can be MFCed. Some is original code while others
are not.
2017-06-23 02:42:04 +00:00
Cy Schubert
cd32671786 In poolnodcommand(): TTL (-T) is only valid when adding a node to a
pool (ippool -a) not when removing a node from a pool (ippool -r).
Flag -T as an error in ippool -r.
2017-06-22 12:46:48 +00:00
Cy Schubert
3f296d78cc poolflush() has no positional arguments. 2017-06-22 06:25:34 +00:00
Cy Schubert
3f6a9d3760 Fix -S handling within poolcommand(). Specifying a seed (-S) is only
valid when adding a pool (ippool -A), not when removing a pool
(ippool -R). It is a command line syntax error if specifying a seed (-S)
is specified when emoving a pool (-R).
2017-06-21 12:19:05 +00:00
Cy Schubert
49742409a3 Flag poolnodecommand() (ippool -a and ippool -r) command line syntax
errors.
2017-06-20 12:31:58 +00:00
Cy Schubert
254a06e0b3 poolcommand() (ippool -A and ippool -R) seed takes an argument. 2017-06-19 19:27:37 +00:00
Cy Schubert
eeafb4bc10 Flag poolcommand() (ippool -A and ippool -R) command line syntax errors. 2017-06-19 12:33:22 +00:00
Cy Schubert
ed840c526f Correct example directory location.
Submitted by:	olivier@
MFC after:	3 days
2017-06-15 00:59:02 +00:00
Cy Schubert
2d1353a21d Chase r319848: remove -v option from getopt() call. 2017-06-14 02:42:38 +00:00
Cy Schubert
40ad94e00a -n (do nothing) is not a commmand option. 2017-06-14 02:41:22 +00:00
Cy Schubert
bfff7435ed -v (verbose) is not a command option. (See ippool.1 for a definition
of command options).
2017-06-12 06:08:57 +00:00
Cy Schubert
215b15da57 Flag loadpoolfile() (ippool -f) command line syntax errors. 2017-06-11 04:03:09 +00:00
Cy Schubert
d05afd2252 Identify poolstats() (ippool -s) command line syntax errors. 2017-06-11 04:00:26 +00:00
Cy Schubert
0fc43621ce Identify command line syntax errors in poolflush() (ippool -F). 2017-06-11 03:56:13 +00:00
Cy Schubert
5910b44e7d Remove redundant assignment of infile from optarg in loadpoolfile()
which was previously assigned from optarg in the argument list from
main().
2017-06-10 23:16:00 +00:00
Cy Schubert
2540ef60c7 Disable the -O (output fields) option in poollist() (ippool -l) for
now. The option does not presently work. However, similar functions in
ipfstat (for state) and ipnat (for nat) do work and provide outputs that
can be easily parsed by shell scripts or subsequently loaded into CSV
files.  The intention here is to return to this option to make it work.
I suspect the problem is in printpoolfields.c.
2017-06-10 17:05:14 +00:00
Cy Schubert
a0489e3eeb Flag poollist() (ippool -l) command line syntax errors. 2017-06-10 16:42:39 +00:00
Cy Schubert
0dda2c25d4 Remove NORESOLVE (-R) option from poollist() (ippool -l). It is not
used in poollist().
2017-05-31 03:11:25 +00:00
Cy Schubert
d86be5fa4f Implement ippool command line IPv6 address parse support (for the -i
option).

PR:		218433
2017-05-16 02:48:46 +00:00
Cy Schubert
344add7203 Just like r318173, which was for outputting IPv6 addresses in tree
pools, implement outputting of IPv6 addresses in the ippool debug list
of hash type pools (ippool -l -d -t hash). Currently IPv6 in ippool tree
type pool handling is mostly implemented.
This continues theseries of commits to remediate ippool.

This will be MFCed with a yet to be committed series of fixes to ippool
after it has been fully remediated.

PR:		218433
2017-05-15 03:39:35 +00:00
Cy Schubert
7ee662e8d8 As of r318281, there is no need to put a colon (:) in the message
string.

MFC after:	3 days
X-MFC with:	r318281
2017-05-14 23:45:10 +00:00