Commit Graph

262 Commits

Author SHA1 Message Date
Isabell Long
8e68324104 In ipfw(8), make the text about dynamic rules consistent.
PR:		docs/120539
Approved by:	gabor (mentor)
MFC after:	5 days
2012-07-16 22:15:30 +00:00
Hiroki Sato
8efbd296e0 Make ipfw0 logging pseudo-interface clonable. It can be created automatically
by $firewall_logif rc.conf(5) variable at boot time or manually by ifconfig(8)
after a boot.

Discussed on:	freebsd-ipfw@
2012-07-09 07:16:19 +00:00
Isabell Long
82cecbea69 - Make ipfw's sched rules case insensitive, for user-friendliness.
- Add a note to the ipfw(8) man page about the rules no longer being
case sensitive.
- Fix some typos in the man page.

PR:		docs/164772
Reviewed by:	bz
Approved by:	gabor (doc mentor, src committer)
MFC after:	2 weeks
2012-07-03 08:42:48 +00:00
Alexander V. Chernikov
2bd61de08c Update maximum number of tables available in ipfw to reflect
changes done in r233478.

Approved by:      kib(mentor)
MFC after:        3 days
2012-06-09 20:47:58 +00:00
Joel Dahl
5da4420931 mdoc: use Po and Pc macros instead of parens. Also avoid starting a line
with Ns.
2012-05-12 17:14:55 +00:00
Eitan Adler
50d675f7a9 Remove trailing whitespace per mdoc lint warning
Disussed with:	gavin
No objection from:	doc
Approved by:	joel
MFC after:	3 days
2012-03-29 05:02:12 +00:00
Alexander V. Chernikov
732d27b32d - Permit number of ipfw tables to be changed in runtime.
net.inet.ip.fw.tables_max is now read-write.

- Bump IPFW_TABLES_MAX to 65535
Default number of tables is still 128

- Remove IPFW_TABLES_MAX from ipfw(8) code.

Sponsored by Yandex LLC

Approved by:    kib(mentor)

MFC after:      2 weeks
2012-03-25 20:37:59 +00:00
Joel Dahl
091eeb4841 Remove superfluous paragraph macro. 2012-03-25 09:21:09 +00:00
Alexander V. Chernikov
f8bee51a69 - Add ipfw eXtended tables permitting radix to be used for any kind of keys.
- Add support for IPv6 and interface extended tables
- Make number of tables to be loader tunable in range 0..65534.
- Use IP_FW3 opcode for all new extended table cmds

No ABI changes are introduced. Old userland will see valid tables for
IPv4 tables and no entries otherwise. Flush works for any table.

IP_FW3 socket option is used to encapsulate all new opcodes:
 /* IP_FW3 header/opcodes */
 typedef struct _ip_fw3_opheader {
        uint16_t opcode;        /* Operation opcode */
        uint16_t reserved[3];   /* Align to 64-bit boundary */
 } ip_fw3_opheader;

New opcodes added:
 IP_FW_TABLE_XADD, IP_FW_TABLE_XDEL, IP_FW_TABLE_XGETSIZE, IP_FW_TABLE_XLIST

ipfw(8) table argument parsing behavior is changed:
 'ipfw table 999 add host' now assumes 'host' to be interface name instead of
 hostname.

New tunable:
 net.inet.ip.fw.tables_max controls number of table supported by ipfw in given
 VNET instance. 128 is still the default value.

New syntax:
ipfw add skipto tablearg ip from any to any via table(42) in
ipfw add skipto tablearg ip from any to any via table(4242) out

This is a bit hackish, special interface name '\1' is used to signal interface
table number is passed in p.glob field.

Sponsored by Yandex LLC

Reviewed by:    ae
Approved by:    ae (mentor)

MFC after:      4 weeks
2012-03-12 14:07:57 +00:00
Gavin Atkinson
1748d1e513 Correct capitalization of "Hz" in user-visible text (manpages, printf(),
etc).

MFC after:	3 days
2012-02-28 13:19:34 +00:00
Gleb Smirnoff
600103fc0b Bump .Dd for r231076.
Submitted by:	bz
2012-02-06 11:51:04 +00:00
Gleb Smirnoff
23ccd3d976 Make the 'tcpwin' option of ipfw(8) accept ranges and lists.
Submitted by:	sem
2012-02-06 11:35:29 +00:00
Gleb Smirnoff
0809c540f4 Note that NAT instance argument can be tablearg.
PR:		misc/162265
Submitted by:	Paul Procacci <pprocacci gmail.com>
2011-11-10 12:05:26 +00:00
Bjoern A. Zeeb
8a006adb24 Add support for IPv6 to ipfw fwd:
Distinguish IPv4 and IPv6 addresses and optional port numbers in
user space to set the option for the correct protocol family.
Add support in the kernel for carrying the new IPv6 destination
address and port.
Add support to TCP and UDP for IPv6 and fix UDP IPv4 to not change
the address in the IP header.
Add support for IPv6 forwarding to a non-local destination.
Add a regession test uitilizing VIMAGE to check all 20 possible
combinations I could think of.

Obtained from:	David Dolson at Sandvine Incorporated
		(original version for ipfw fwd IPv6 support)
Sponsored by:	Sandvine Incorporated
PR:		bin/117214
MFC after:	4 weeks
Approved by:	re (kib)
2011-08-20 17:05:11 +00:00
Andrey V. Elsukov
9527ec6e52 Add new rule actions "call" and "return" to ipfw. They make
possible to organize subroutines with rules.

The "call" action saves the current rule number in the internal
stack and rules processing continues from the first rule with
specified number (similar to skipto action). If later a rule with
"return" action is encountered, the processing returns to the first
rule with number of "call" rule saved in the stack plus one or higher.

Submitted by:	Vadim Goncharov
Discussed by:	ipfw@, luigi@
2011-06-29 10:06:58 +00:00
Andrey V. Elsukov
1875bbfe54 Implement "global" mode for ipfw nat. It is similar to natd(8)
"globalport" option for multiple NAT instances.

If ipfw rule contains "global" keyword instead of nat_number, then
for each outgoing packet ipfw_nat looks up translation state in all
configured nat instances. If an entry is found, packet aliased
according to that entry, otherwise packet is passed unchanged.

User can specify "skip_global" option in NAT configuration to exclude
an instance from the lookup in global mode.

PR:		kern/157867
Submitted by:	Alexander V. Chernikov (previous version)
Tested by:	Eugene Grosbein
2011-06-14 13:35:24 +00:00
Andrey V. Elsukov
41b6083752 Add tablearg support for ipfw setfib.
PR:		kern/156410
MFC after:	2 weeks
2011-05-30 05:37:26 +00:00
Sergey Kandaurov
3e71d7d04e mdoc:
- use a proper macro for interface name ipfw0.
- add missing section number for bpf cross reference.
2011-05-17 12:58:19 +00:00
Luigi Rizzo
ae99fd0e07 The first customer of the SO_USER_COOKIE option:
the "sockarg" ipfw option matches packets associated to
a local socket and with a non-zero so_user_cookie value.
The value is made available as tablearg, so it can be used
as a skipto target or pipe number in ipfw/dummynet rules.

Code by Paul Joe, manpage by me.

Submitted by:	Paul Joe
MFC after:	1 week
2010-11-12 13:05:17 +00:00
Ulrich Spörlein
2914feeb7e mdoc: make pages render with mandoc
It's a bit more pedantic regarding .Bl list elements. This has an added
benefit of unbreaking the ipfw(8) manpage, where groff was silently
skipping one list element.
2010-10-21 12:27:13 +00:00
Luigi Rizzo
81ab11744e document logging through bpf 2010-10-13 22:07:57 +00:00
Ulrich Spörlein
0d9deed52c mdoc: drop redundant .Pp and .LP calls
They have no effect when coming in pairs, or before .Bl/.Bd
2010-10-08 12:40:16 +00:00
Rebecca Cran
e7f8dd75b3 Fix incorrect usage of 'assure' and 'insure'.
Approved by: rrs (mentor)
2010-08-28 16:32:01 +00:00
Joel Dahl
c2025a7660 Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages.  Minor corrections by me.

Submitted by:	Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>
2010-08-16 15:18:30 +00:00
Gleb Smirnoff
fa597729aa Document that the "ngtee" action no longer accepts packet, and
thus don't depend on one_pass flag anymore.

This is a POLA violation, but it is quite difficult to restore
the old behavior with new code. Also, the new behavior matches
behavior of the older "tee" action, and this is more intuitive.
2010-07-27 14:31:39 +00:00
Gavin Atkinson
67d438ccb8 Tweak language to make one point potentially clearer for non-native spekers
PR:		bin/121424
Submitted by:	"Julian H. Stacey" <jhs berklix.org>
2010-03-20 14:42:16 +00:00
Luigi Rizzo
34ae843479 more documentation on new dummynet features. 2010-03-05 14:13:58 +00:00
Luigi Rizzo
cc4d3c30ea Bring in the most recent version of ipfw and dummynet, developed
and tested over the past two months in the ipfw3-head branch.  This
also happens to be the same code available in the Linux and Windows
ports of ipfw and dummynet.

The major enhancement is a completely restructured version of
dummynet, with support for different packet scheduling algorithms
(loadable at runtime), faster queue/pipe lookup, and a much cleaner
internal architecture and kernel/userland ABI which simplifies
future extensions.

In addition to the existing schedulers (FIFO and WF2Q+), we include
a Deficit Round Robin (DRR or RR for brevity) scheduler, and a new,
very fast version of WF2Q+ called QFQ.

Some test code is also present (in sys/netinet/ipfw/test) that
lets you build and test schedulers in userland.

Also, we have added a compatibility layer that understands requests
from the RELENG_7 and RELENG_8 versions of the /sbin/ipfw binaries,
and replies correctly (at least, it does its best; sometimes you
just cannot tell who sent the request and how to answer).
The compatibility layer should make it possible to MFC this code in a
relatively short time.

Some minor glitches (e.g. handling of ipfw set enable/disable,
and a workaround for a bug in RELENG_7's /sbin/ipfw) will be
fixed with separate commits.

CREDITS:
This work has been partly supported by the ONELAB2 project, and
mostly developed by Riccardo Panicucci and myself.
The code for the qfq scheduler is mostly from Fabio Checconi,
and Marta Carbone and Francesco Magno have helped with testing,
debugging and some bug fixes.
2010-03-02 17:40:48 +00:00
Luigi Rizzo
472099c4b0 implement a new match option,
lookup {dst-ip|src-ip|dst-port|src-port|uid|jail} N

which searches the specified field in table N and sets tablearg
accordingly.
With dst-ip or src-ip the option replicates two existing options.
When used with other arguments, the option can be useful to
quickly dispatch traffic based on other fields.

Work supported by the Onelab project.

MFC after:	1 week
2009-12-15 09:46:27 +00:00
Luigi Rizzo
2f12516b1f fix the indentation for addr: values
MFC after:	3 days
2009-12-15 09:32:35 +00:00
Christian Brueffer
8fba046b09 Fix setfib(1) section number.
PR:		133765
Submitted by:	Konstantin Zolotukhin <erebus@gorodok.net>
MFC after:	3 days
2009-09-18 14:17:00 +00:00
Oleg Bulyzhin
a6f1444804 - 'burst' description rewritten.
Submitted by:	Ben Kaduk
Approved by:	re (kib)
2009-06-26 19:49:06 +00:00
Maxim Konovalov
067e91e8c2 o Kill grammar nits.
PR:		docs/136061
Submitted by:	Ben Kaduk
MFC after:	1 week
2009-06-26 05:09:00 +00:00
Oleg Bulyzhin
6882bf4d92 - fix dummynet 'fast' mode for WF2Q case.
- fix printing of pipe profile data.
- introduce new pipe parameter: 'burst' - how much data can be sent through
  pipe bypassing bandwidth limit.
2009-06-24 22:57:07 +00:00
Luigi Rizzo
7a459517da Permit the specification of bandwidth values within
"profile" files (bandwidth is mandatory when using a
profile, so it makes sense to have everything in one place).

Update the manpage accordingly.

Submitted by:	Marta Carbone
2009-06-08 14:32:29 +00:00
Tom Rhodes
81bdd4cbcd Kill hard sentence break added in the previous revision. 2009-04-11 08:52:02 +00:00
Luigi Rizzo
4bb7ae9deb Add emulation of delay profiles, which lets you model various
types of MAC overheads such as preambles, link level retransmissions
and more.

Note- this commit changes the userland/kernel ABI for pipes
(but not for ordinary firewall rules) so you need to rebuild
kernel and /sbin/ipfw to use dummynet features.

Please check the manpage for details on the new feature.

The MFC would be trivial but it breaks the ABI, so it will
be postponed until after 7.2 is released.

Interested users are welcome to apply the patch manually
to their RELENG_7 tree.

Work supported by the European Commission, Projects Onelab and
Onelab2 (contract 224263).
2009-04-09 12:46:00 +00:00
Maxim Konovalov
d8ec4cdefb o Grammar. 2009-04-08 17:46:45 +00:00
Luigi Rizzo
de24303241 Various cleanup of text, moving a couple of paragraphs
above to avoid referencing undefined terms (humans are not compilers
but still care about these things).

Change some .Sh to .Ss to better reflect the structure of the text.

No new content.
2009-04-08 15:18:21 +00:00
Tom Rhodes
c4abdf1c01 Remove contractions, reword a sentence to avoid a double negative,
and bump document date for previous change.

OKed by:	piso
2009-04-07 13:51:41 +00:00
Paolo Pisati
0240be035c Improve a bit reass documentation:
-document fragment handling sysctls
-mention some caveats about fragments handling (and to deal with it)
2009-04-05 15:24:27 +00:00
Paolo Pisati
eb2e411915 Implement an ipfw action to reassemble ip packets: reass. 2009-04-01 20:23:47 +00:00
Christian Brueffer
cdd14ccabe Mdoc style, spelling, grammar and wording fixes. This manpage needs more work. 2009-03-19 10:42:07 +00:00
Paolo Pisati
37ce2656ec Add SCTP NAT support.
Submitted by: CAIA (http://caia.swin.edu.au)
2009-02-07 18:49:42 +00:00
Paolo Pisati
a21e097b2e Update the ipfw man page to reflect last change (-q option with nat option).
MFC after:	3 days
2008-12-18 21:46:18 +00:00
Roman Kurakin
e927c2b2e6 * add all keyword for table list & flush actions.
* add tables_max sysctl.
* add default_rule sysctl.

PR:		127058 (partially)
2008-09-27 15:09:00 +00:00
Ivan Voras
0d6ff382c3 Trivial typo fix.
Approved by:	gnn (mentor)
2008-08-27 15:30:09 +00:00
Julian Elischer
2cc8ab2a83 Slight wordsmithing. prompted by danger@ 2008-08-01 23:31:28 +00:00
Julian Elischer
bc20b62b0e Document the use of the tablearg keyword together with the skipto command. 2008-08-01 22:34:01 +00:00
Julian Elischer
c7d1bf0bd9 Note that setfib is not a terminal rule. 2008-07-24 18:39:36 +00:00