Commit Graph

764 Commits

Author SHA1 Message Date
Andrey V. Elsukov
db1102f213 Use IP_FW_NAT44_DESTROY opcode for IP_FW3 socket option to destroy
NAT instance.

The NAT44 group of opcodes for IP_FW3 socket option is modern way
to control NAT instances and this method can be used in future to
switch from numeric to named NAT instances, like was done for ipfw
tables.
The IP_FW_NAT_DEL opcode is the last remnant of old ipfw_ctl control
plane that doesn't support versioned operations. This interface will
be retired soon.

Reviewed by:	melifaro
MFC after:	10 days
Sponsored by:	Yandex LLC
2020-03-24 12:27:02 +00:00
Alexander V. Chernikov
e3bf606c5d Revert r358858 as it breaks some ipfw(8) setups.
Reported by:	O. Hartmann <o.hartmann@walstatt.org>
2020-03-11 08:08:53 +00:00
Alexander V. Chernikov
8149b12da1 Don't assume !IPv6 is IPv4 in ipfw(8) add_src() and add_dst().
Submitted by:	Neel Chauhan <neel AT neelc DOT org>
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D21812
2020-03-10 20:30:21 +00:00
Eugene Grosbein
04777538e7 ipfw nat: add missing bits after r357092 (RFC 6598/Carrier Grade NAT)
Submitted by:	Neel Chauhan <neel AT neelc DOT org>
Reviewed by:	Lutz Donnerhacke
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D23448
2020-02-12 00:46:33 +00:00
Alexander V. Chernikov
75b893375f Add support for RFC 6598/Carrier Grade NAT subnets. to libalias and ipfw.
In libalias, a new flag PKT_ALIAS_UNREGISTERED_RFC6598 is added.
 This is like PKT_ALIAS_UNREGISTERED_ONLY, but also is RFC 6598 aware.
Also, we add a new NAT option to ipfw called unreg_cgn, which is like
 unreg_only, but also is RFC 6598-aware.  The reason for the new
 flags/options is to avoid breaking existing networks, especially those
 which rely on RFC 6598 as an external address.

Submitted by:	Neel Chauhan <neel AT neelc DOT org>
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D22877
2020-01-24 20:35:41 +00:00
Xin LI
f00c55e25a Use strlcat().
MFC after:	2 weeks
2019-11-30 05:57:54 +00:00
Andrey V. Elsukov
51b1593065 Explicitly initialize the memory buffer to store O_ICMP6TYPE opcode.
By default next_cmd() initializes only first u32 of opcode. O_ICMP6TYPE
opcode has array of bit masks to store corresponding ICMPv6 types.
An opcode that precedes O_ICMP6TYPE, e.g. O_IP6_DST, can have variable
length and during opcode filling it can modify memory that will be used
by O_ICMP6TYPE opcode. Without explicit initialization this leads to
creation of wrong opcode.

Reported by:	Boris N. Lytochkin
Obtained from:	Yandex LLC
MFC after:	3 days
2019-10-15 09:50:02 +00:00
Kyle Evans
c144616b7d ipfw: fix jail option after r348215
r348215 changed jail_getid(3) to validate passed-in jids as active jails
(as the function is documented to return -1 if the jail does not exist).
This broke the jail option (in some cases?) as the jail historically hasn't
needed to exist at the time of rule parsing; jids will get stored and later
applied.

Fix this caller to attempt to parse *av as a number first and just use it
as-is to match historical behavior. jail_getid(3) must still be used in
order for name arguments to work, but it's strictly a fallback in case we
weren't given a number.

Reported and tested by:	Ari Suutari <ari stonepile fi>
Reviewed by:	ae
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D21128
2019-08-05 00:08:25 +00:00
Andrey V. Elsukov
55507128b9 Restore ipfw(8)'s compact output support broken after r331668.
Also modify it a bit. Now -c option omits only 'from any to any' part
and works for different protocols (not just for ip).

Reported by:	Dmitry Selivanov <dseliv at gmail>
MFC after:	1 week
2019-06-25 09:08:24 +00:00
Andrey V. Elsukov
978f2d1728 Add "tcpmss" opcode to match the TCP MSS value.
With this opcode it is possible to match TCP packets with specified
MSS option, whose value corresponds to configured in opcode value.
It is allowed to specify single value, range of values, or array of
specific values or ranges. E.g.

 # ipfw add deny log tcp from any to any tcpmss 0-500

Reviewed by:	melifaro,bcr
Obtained from:	Yandex LLC
MFC after:	1 week
Sponsored by:	Yandex LLC
2019-06-21 10:54:51 +00:00
Andrey V. Elsukov
09899450ed Remove unused token that was added in r348235.
MFC after:	2 weeks
2019-05-27 06:34:36 +00:00
Andrey V. Elsukov
05ab1ef64e Add missing and or-flush options to "ipfw table <NAME> create"
command to simplify firewall reloading.

The `missing` option suppresses EEXIST error code, but does check that
existing table has the same parameters as new one. The `or-flush` option
implies `missing` option and additionally does flush for table if it
is already exist.

Submitted by:	lev
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D18339
2019-05-24 11:06:24 +00:00
Andrey V. Elsukov
761618de05 Handle HAVE_PROTO flag and print "proto" keyword for O_IP4 and O_IP6
opcodes when it is needed.
This should fix the problem, when printed by `ipfw show` rule could not
be added due to missing "proto" keyword.

MFC after:	2 weeks
2019-04-29 09:52:53 +00:00
Benedict Reuschling
da343996fa Typo fix in ipfw.8: amd -> and
There is an (obvious) typo in the following sentence:

"Please note, that keep-state amd limit imply implicit check-state for ..."

Replace the "amd" with "and", bump .Dd.

PR:			237438
Submitted by:		michael@galassi.us
MFC after:		3 days
2019-04-21 18:27:13 +00:00
Andrey V. Elsukov
9883abca1f Remove extra spaces.
MFC after:	1 month
2019-03-19 11:16:42 +00:00
Andrey V. Elsukov
d18c1f26a4 Reapply r345274 with build fixes for 32-bit architectures.
Update NAT64LSN implementation:

  o most of data structures and relations were modified to be able support
    large number of translation states. Now each supported protocol can
    use full ports range. Ports groups now are belongs to IPv4 alias
    addresses, not hosts. Each ports group can keep several states chunks.
    This is controlled with new `states_chunks` config option. States
    chunks allow to have several translation states for single alias address
    and port, but for different destination addresses.
  o by default all hash tables now use jenkins hash.
  o ConcurrencyKit and epoch(9) is used to make NAT64LSN lockless on fast path.
  o one NAT64LSN instance now can be used to handle several IPv6 prefixes,
    special prefix "::" value should be used for this purpose when instance
    is created.
  o due to modified internal data structures relations, the socket opcode
    that does states listing was changed.

Obtained from:	Yandex LLC
MFC after:	1 month
Sponsored by:	Yandex LLC
2019-03-19 10:57:03 +00:00
Andrey V. Elsukov
d6369c2d18 Revert r345274. It appears that not all 32-bit architectures have
necessary CK primitives.
2019-03-18 14:00:19 +00:00
Andrey V. Elsukov
d7a1cf06f3 Update NAT64LSN implementation:
o most of data structures and relations were modified to be able support
  large number of translation states. Now each supported protocol can
  use full ports range. Ports groups now are belongs to IPv4 alias
  addresses, not hosts. Each ports group can keep several states chunks.
  This is controlled with new `states_chunks` config option. States
  chunks allow to have several translation states for single alias address
  and port, but for different destination addresses.
o by default all hash tables now use jenkins hash.
o ConcurrencyKit and epoch(9) is used to make NAT64LSN lockless on fast path.
o one NAT64LSN instance now can be used to handle several IPv6 prefixes,
  special prefix "::" value should be used for this purpose when instance
  is created.
o due to modified internal data structures relations, the socket opcode
  that does states listing was changed.

Obtained from:	Yandex LLC
MFC after:	1 month
Sponsored by:	Yandex LLC
2019-03-18 12:59:08 +00:00
Andrey V. Elsukov
5c04f73e07 Add NAT64 CLAT implementation as defined in RFC6877.
CLAT is customer-side translator that algorithmically translates 1:1
private IPv4 addresses to global IPv6 addresses, and vice versa.
It is implemented as part of ipfw_nat64 kernel module. When module
is loaded or compiled into the kernel, it registers "nat64clat" external
action. External action named instance can be created using `create`
command and then used in ipfw rules. The create command accepts two
IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted,
IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used.

  # ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX
  # ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out
  # ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in

Obtained from:	Yandex LLC
Submitted by:	Boris N. Lytochkin
MFC after:	1 month
Relnotes:	yes
Sponsored by:	Yandex LLC
2019-03-18 11:44:53 +00:00
Andrey V. Elsukov
002cae78da Add SPDX-License-Identifier and update year in copyright.
MFC after:	1 month
2019-03-18 10:50:32 +00:00
Andrey V. Elsukov
b11efc1eb6 Modify struct nat64_config.
Add second IPv6 prefix to generic config structure and rename another
fields to conform to RFC6877. Now it contains two prefixes and length:
PLAT is provider-side translator that translates N:1 global IPv6 addresses
to global IPv4 addresses. CLAT is customer-side translator (XLAT) that
algorithmically translates 1:1 IPv4 addresses to global IPv6 addresses.
Use PLAT prefix in stateless (nat64stl) and stateful (nat64lsn)
translators.

Modify nat64_extract_ip4() and nat64_embed_ip4() functions to accept
prefix length and use plat_plen to specify prefix length.

Retire net.inet.ip.fw.nat64_allow_private sysctl variable.
Add NAT64_ALLOW_PRIVATE flag and use "allow_private" config option to
configure this ability separately for each NAT64 instance.

Obtained from:	Yandex LLC
MFC after:	1 month
Sponsored by:	Yandex LLC
2019-03-18 10:39:14 +00:00
Guangyuan Yang
65847dc90a Fix typos and caps for ipfw(8) man page.
MFC after:	3 days
PR:		236030
Submitted by:	olgeni
2019-03-01 19:06:13 +00:00
Tom Rhodes
bdf56516d2 Grammar tweaks in ipfw manual page. 2019-02-28 20:43:03 +00:00
Bryan Drewery
10e3bebf9e Fix build of r343877
MFC after:	2 weeks
X-MFC-with:	r343877
Pointyhat to:	bdrewery
2019-02-07 21:41:27 +00:00
Bryan Drewery
2b3d664738 ipfw table list: Fix showing header outside of 'all'.
Properly pass down is_all to table_show_list().  This restores the behavior
before r272840 so that only 'ipfw table all list' shows the headers.

MFC after:	2 weeks
Relnotes:	yes
2019-02-07 21:05:44 +00:00
Andrey V. Elsukov
a5178bca19 Allow use underscores and dots in service names without escaping.
PR:		234237
MFC after:	1 week
2018-12-21 10:41:45 +00:00
Andrey V. Elsukov
a895c1c28a Rework how protocol number is tracked in rule. Save it when O_PROTO
opcode will be printed. This should solve the problem, when protocol
name is not printed in `ipfw -N show`.

Reported by:	Claudio Eichenberger <cei at yourshop.com>
MFC after:	1 week
2018-12-10 16:23:11 +00:00
Andrey V. Elsukov
5f9c94c592 Use correct size for IPv4 address in gethostbyaddr().
When u_long is 8 bytes, it returns EINVAL and 'ipfw -N show' doesn't work.

Reported by:	Claudio Eichenberger <cei at yourshop.com>
MFC after:	1 week
2018-12-10 15:42:13 +00:00
Andrey V. Elsukov
d66f9c86fa Add ability to request listing and deleting only for dynamic states.
This can be useful, when net.inet.ip.fw.dyn_keep_states is enabled, but
after rules reloading some state must be deleted. Added new flag '-D'
for such purpose.

Retire '-e' flag, since there can not be expired states in the meaning
that this flag historically had.

Also add "verbose" mode for listing of dynamic states, it can be enabled
with '-v' flag and adds additional information to states list. This can
be useful for debugging.

Obtained from:	Yandex LLC
MFC after:	2 months
Sponsored by:	Yandex LLC
2018-12-04 16:12:43 +00:00
Eugene Grosbein
3b78397008 Small language fix after r340978.
MFC after:	3 days
2018-11-26 16:10:20 +00:00
Eugene Grosbein
3a498c2e8a ipfw.8: add new section to EXAMPLES:
SELECTIVE MIRRORING
     If your network has network traffic analyzer connected to your host
     directly via dedicated interface or remotely via RSPAN vlan, you can
     selectively mirror some ethernet layer2 frames to the analyzer.
     ...
2018-11-26 16:02:17 +00:00
Guangyuan Yang
e9e747efe2 Fix a minor typo in ipfw(8) manual page.
PR:		230747
Submitted by:	f.toscan@hotmail.it
MFC after:	1 week
2018-11-23 03:42:05 +00:00
Guangyuan Yang
14b520eaa2 Fix incorrect DSCP value range from 0..64 to 0..63.
PR:		232786
Submitted by:	Sergey Akhmatov <sergey@akhmatov.ru>
Reviewed by:	AllanJude
MFC after:	1 week
2018-11-21 00:22:31 +00:00
Andrey V. Elsukov
5786c6b9f9 Make multiline APPLY_MASK() macro to be function-like.
Reported by:	cem
MFC after:	1 week
2018-11-20 18:38:28 +00:00
Eugene Grosbein
d95e8d6474 Fix part of the SYNOPSIS documenting LIST OF RULES AND PREPROCESSING
that is still referred as last section of the SYNOPSIS later
but was erroneously situated in the section IN-KERNEL NAT.

MFC after:	1 month
2018-11-13 13:57:15 +00:00
Andrey V. Elsukov
b2b5660688 Add ability to use dynamic external prefix in ipfw_nptv6 module.
Now an interface name can be specified for nptv6 instance instead of
ext_prefix. The module will track if_addr_ext events and when suitable
IPv6 address will be added to specified interface, it will be configured
as external prefix. When address disappears instance becomes unusable,
i.e. it doesn't match any packets.

Reviewed by:	0mp (manpages)
Tested by:	Dries Michiels <driesm dot michiels gmail com>
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D17765
2018-11-12 11:20:59 +00:00
Eugene Grosbein
6ff080c445 ipfw.8: fix small syntax error in an example
MFC after:	3 days
2018-11-08 13:17:38 +00:00
Andrey V. Elsukov
8f47ad010c Do not print "ip6" keyword in print_icmp6types() for O_ICMP6TYPE opcode.
It produces incompatibility when rules listing is used again to
restore saved ruleset, because "ip6" keyword produces separate opcode.
The kernel already has the check and only IPv6 packets will be checked
for matching.

PR:		232939
MFC after:	3 days
2018-11-06 07:41:32 +00:00
Eugene Grosbein
5a2b0b0daa ipfw(8): clarify layer2 processing abilities
Make it clear that ipfw action set for layer2 frames it a bit limited.

PR:			59835
Reviewed by:		yuripv
MFC after:		1 month
Differential Revision:	https://reviews.freebsd.org/D17719
2018-11-04 06:35:48 +00:00
Andrey V. Elsukov
880d3c76b5 Do not use bzero() for the O_ICMP6TYPE opcode.
The buffer is already zeroed in compile_rule() function, and also it
may contain configured F_NOT flag in o.len field. This fixes the filling
for "not icmp6types" opcode.

PR:		232939
MFC after:	3 days
2018-11-03 20:05:50 +00:00
Andrey V. Elsukov
427dc1f755 Use correct format specificator to print setdscp action.
PR:		232642
MFC after:	3 days
2018-10-25 18:06:23 +00:00
Andrey V. Elsukov
aa2715612c Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add ability
to switch the output method in run-time. Also document some sysctl
variables that can by changed for NAT64 module.

NAT64 had compile time option IPFIREWALL_NAT64_DIRECT_OUTPUT to use
if_output directly from nat64 module. By default is used netisr based
output method. Now both methods can be used, but they require different
handling by rules.

Obtained from:	Yandex LLC
MFC after:	3 weeks
Sponsored by:	Yandex LLC
Differential Revision:	https://reviews.freebsd.org/D16647
2018-10-21 16:29:12 +00:00
Andrey V. Elsukov
094d6f8d75 Add IPFW_RULE_JUSTOPTS flag, that is used by ipfw(8) to mark rule,
that was added using "new rule format". And then, when the kernel
returns rule with this flag, ipfw(8) can correctly show it.

Reported by:	lev
MFC after:	3 weeks
Sponsored by:	Yandex LLC
Differential Revision:	https://reviews.freebsd.org/D17373
2018-10-21 15:10:59 +00:00
Guangyuan Yang
c049e7c448 Add description, parameters, options, sysctl and examples of using AQMs to ipfw man page. CoDel, PIE, FQ-CoDel and FQ-PIE AQM for Dummynet exist in FreeBSD 11 and 10.3.
Submitted by:	ralsaadi@swin.edu.au
Reviewed by:	AllanJude
Approved by:	re (gjb)
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D12507
2018-09-27 18:14:01 +00:00
Andrey V. Elsukov
c5bf4b1bc6 Add "src-ip" or "dst-ip" keyword to the output, when we are printing the
rest of rule options.

Reported by:	lev
Approved by:	re (gjb)
MFC after:	1 week
2018-09-26 15:37:48 +00:00
Patrick Kelsey
249cc75fd1 Extended pf(4) ioctl interface and pfctl(8) to allow bandwidths of
2^32 bps or greater to be used.  Prior to this, bandwidth parameters
would simply wrap at the 2^32 boundary.  The computations in the HFSC
scheduler and token bucket regulator have been modified to operate
correctly up to at least 100 Gbps.  No other algorithms have been
examined or modified for correct operation above 2^32 bps (some may
have existing computation resolution or overflow issues at rates below
that threshold).  pfctl(8) will now limit non-HFSC bandwidth
parameters to 2^32 - 1 before passing them to the kernel.

The extensions to the pf(4) ioctl interface have been made in a
backwards-compatible way by versioning affected data structures,
supporting all versions in the kernel, and implementing macros that
will cause existing code that consumes that interface to use version 0
without source modifications.  If version 0 consumers of the interface
are used against a new kernel that has had bandwidth parameters of
2^32 or greater configured by updated tools, such bandwidth parameters
will be reported as 2^32 - 1 bps by those old consumers.

All in-tree consumers of the pf(4) interface have been updated.  To
update out-of-tree consumers to the latest version of the interface,
define PFIOC_USE_LATEST ahead of any includes and use the code of
pfctl(8) as a guide for the ioctls of interest.

PR:	211730
Reviewed by:	jmallett, kp, loos
MFC after:	2 weeks
Relnotes:	yes
Sponsored by:	RG Nets
Differential Revision:	https://reviews.freebsd.org/D16782
2018-08-22 19:38:48 +00:00
Andrey V. Elsukov
f4d5e7d8b5 Restore the behaviour changed in r337536, when bad ipfw delete command
returns error.

Now -q option only makes it quiet. And when -f flag is specified, the
command will ignore errors and continue executing with next batched
command.

MFC after:	2 weeks
2018-08-10 14:10:22 +00:00
Andrey V. Elsukov
e327ad3377 If -q flag is specified, do not complain when we are trying to delete
nonexistent NAT instance or nonexistent rule.

This allows execute batched `delete` commands and do not fail when
found nonexistent rule.

Obtained from:	Yandex LLC
MFC after:	2 weeks
Sponsored by:	Yandex LLC
2018-08-09 12:46:30 +00:00
Andrey V. Elsukov
f7c4fdee1a Add "record-state", "set-limit" and "defer-action" rule options to ipfw.
"record-state" is similar to "keep-state", but it doesn't produce implicit
O_PROBE_STATE opcode in a rule. "set-limit" is like "limit", but it has the
same feature as "record-state", it is single opcode without implicit
O_PROBE_STATE opcode. "defer-action" is targeted to be used with dynamic
states. When rule with this opcode is matched, the rule's action will
not be executed, instead dynamic state will be created. And when this
state will be matched by "check-state", then rule action will be executed.
This allows create a more complicated rulesets.

Submitted by:	lev
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D1776
2018-07-09 11:35:18 +00:00
Jamie Gritton
de68a3200a Allow jail names (not just IDs) to be specified for: cpuset(1), ipfw(8),
sockstat(1), ugidfw(8)
These are the last of the jail-aware userland utilities that didn't work
 with names.

PR:		229266
MFC after:	3 days
Differential Revision:	D16047
2018-07-03 23:47:20 +00:00