Commit Graph

92 Commits

Author SHA1 Message Date
Cy Schubert
c47db49ba4 ipfilter: Support only jails in VNET
Jails without VNET have complete access to the ipfilter rules, NAT,
pools and logs. This is insecure. Only allow jails to manipulate
ipfilter rules, NAT tables and ippools if the jail has its own VNET.
Otherwise a jail can affect the global system.

This patch brings ipfilter in line with ipfw's support of VNET jails and
non-support of non-VNET jails.

MFC after:	1 week
2022-07-07 07:53:45 -07:00
Gordon Bergling
d7958fe1bc ipnat(5): Fix a double word in the manual page
- s/be be/be/

MFC after:	3 days
2022-04-09 09:28:43 +02:00
Gordon Bergling
8a3568b584 ipf(5): Fix a typo in the manual page
- s/accomodate/accommodate/

MFC after:	3 days
2022-04-02 14:50:45 +02:00
Cy Schubert
93c1048a13 ipfilter: Reliably print the interface name
When printing the interface name from the ipstate_t struct the interface
name in is_ifp may not always be avaiable when reading it from kmem
(tested on FreeBSD and NetBSD). However the is_ifname (the interface
name character string) is almost always available -- it is not available
when the source of the packet is a process running on the firewall
itself. Rather than print both interface name strings, print only the
one.

MFC after:	1 week
2022-03-03 06:43:12 -08:00
Cy Schubert
ec793543fe ipfilter: Obtain the interface name more efficiently
Rather than use a kmem read to determine the interface name used by a
nat_t structure through a pointer, nat_ipfs->netif->if_xname, obtain it
directly from nat_ifnames in the nat_t structure itself using the new
FORMAT_IF macro.

MFC after:	1 week
2022-03-03 06:43:11 -08:00
Cy Schubert
915395a280 ipfilter: Introduce the new FORMAT_IF macro
Interface names stored in the ipstate_t and ipnat_t structures can be
NULL. This occurs when an application, such as named, is running on the
firewall machine itself. For example an application, i.e. named, running
on the firewall itself will cause a state table display and NAT mapping
display to show a null ingress interface and its egress interface. This
is perfectly valid but confusing to human eyes. Rather than print
nothing, print "(null)".

MFC after:	1 week
2022-03-03 06:43:11 -08:00
Cy Schubert
9291d079d5 ipfilter: Print protocol when listing NAT table mappings
NAT table mappings list only the source and destination IP, the source
and destinaion port numbers, and their mappings. But the protocol is not
listed. Now that Facebook and Google use QUIC, seeing port 443 in in a
list of active NAT sessions could mean 443/tcp or 443/udp. This patch
adds the protocol to the listing to aid in determining whether HTTPS is
TCP or QUIC in a NAT mapping listing. This also helps differentiatinete
between other protocols such as ICMP, ESP, and AH in ipnat list of active
sessions.

MFC after:	1 week
2022-02-28 12:11:39 -08:00
Cy Schubert
08ab34a06a ipfilter: Restore ipfsync
ipfsync is a WIP sync daemon designed to be used in a failover scenario.
It was removed by 5ee61c7daa. This commit
restores its three files. ipfsync is in my work queue.

MFC after:	10 days
X-MFC with:	5ee61c7daa
2022-01-07 21:46:53 -08:00
Cy Schubert
ad07e93fe1 ipfilter: Fix manpage typos
Reported by:	jrtc27
Fixes:		2582ae5740
MFC after:	1 month
2022-01-04 07:11:00 -08:00
Cy Schubert
cc3e5b372e ipfilter userland: Fix typos
Reported by:	netchild
Fixes:		2582ae5740
MFC after:	1 month
2022-01-04 03:08:51 -08:00
Cy Schubert
a3522837b0 ipfilter userland: Fix branch mismerge
The work to ANSIfy and adjust returns to style(9) resulted in a mismerge
of a stash when ipfilter was moved from contrib to sbin. An older file
replaced WIP at the time, resulting in a regression.

The majority of this work was done in 2018 saved as git stashes within
a git-svn tree and migrated to the git tree. The regression occurred
when the various stashes were sequentially merged to create individual
commits, following the ipfilter move to netpfil and sbin.

Reported by:	jrtc27
Fixes:		2582ae5740
Pointy hat to:	cy
MFC after:	1 month
2022-01-03 19:39:24 -08:00
Cy Schubert
44bc301921 ipfilter userland: Style(9) requires a space after return
Reported by:    jrtc27
Fixes:          2582ae5740
MFC after:      1 month
2022-01-03 19:37:25 -08:00
Cy Schubert
d86f022e79 ipfilter: Fix typos
Reported by:	jrtc27
Fixes:		2582ae5740
MFC after:	1 month
2022-01-03 18:45:10 -08:00
Cy Schubert
5e13b104a4 ipfilter userland: Fix whitespace errors
Replace leading spaces with a tabs on affected lines.

MFC after:	1 month
2022-01-03 18:06:44 -08:00
Cy Schubert
27fc223414 ipfilter userland: Remove trailing whitespace
MFC after:	1 month
2022-01-03 18:06:44 -08:00
Cy Schubert
2582ae5740 ipfilter: Adjust userland returns to conform to style(9)
Adjust ipfilter's userland return statements to conform to style(9).

MFC after:	1 month
2022-01-03 18:06:43 -08:00
Cy Schubert
9be9c1c084 ipfilter: INLINE --> inline
Replace the INLINE macro with inline. Some ancient compilers supported
__inline__ instead of inline. The INLINE hack compensated for it.
Ancient compilers are history.

Reported by:	glebius
MFC after:	1 month
2022-01-03 18:06:42 -08:00
Cy Schubert
efeb8bffe3 ipflter: ANSIfy userland function declarations
Convert ipfilter userland function declarations from K&R to ANSI. This
syncs our function declarations with NetBSD hg commit 75edcd7552a0
(apply our changes). Though not copied from NetBSD, this change was
partially inspired by NetBSD's work and inspired by style(9).

Reviewed by:		glebius (for #network)
MFC after:		1 month
Differential Revision:	https://reviews.freebsd.org/D33595
2022-01-03 18:06:42 -08:00
Cy Schubert
d740faa30a ipfilter userland: Revert the ipmon part of a6fb9bbea7
a6fb9bbea7 caused incorrect formatting of ipmon log output.

Fixes:		a6fb9bbea7
MFC after:	immediately
2021-12-27 01:10:52 -08:00
Cy Schubert
7cb2d7c413 ipfilter userland: Path fixup no longer required
Since the move of ipfilter from contrib to sbin adjusting the source path
is no longer required.

Fixes:		41edb306f0
MFC after:	1 month
2021-12-27 00:40:18 -08:00
Cy Schubert
41edb306f0 ipfilter: Move userland bits to sbin
Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sbin/ipf. Now that I'm
planning on implementing MSS clamping as in iptables it makes more
sense to move ipfilter to sbin.

This is the second of three commits of the ipfilter move.

Suggested by glebius on two occaions.

Suggested by and discussed with:	glebius
Reviewed by:				glebius, kp (for #network)
MFC after:				1 month
Differential Revision:		https://reviews.freebsd.org/D33510
2021-12-20 06:16:33 -08:00
Cy Schubert
3b9b51fe46 ipfilter: Move kernel bits to netpfil
Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sys/netpil. Now that I'm
planning on implementing MSS clamping as in iptables it makes more
sense to move ipfilter to netpfil.

This is the first of three commits the ipfilter move.

Suggested by glebius on two occaions.

Suggested by and discussed with:	glebius
Reviewed by:				glebius, kp (for #network)
MFC after:				1 month
Differential Revision:		https://reviews.freebsd.org/D33510
2021-12-20 06:16:33 -08:00
Baptiste Daroussin
cbc83e378a ncurses: chase dependency changes in the source tree
Differential Revision:	https://reviews.freebsd.org/D32098
2021-10-04 11:38:24 +02:00
Cy Schubert
015cb6cde4 Create a link to the ipmon.conf.5 man page as documented in ipmon.5.
Add its corresponding optional removal entry.

PR:		238816
MFC after:	1 week
2019-06-27 12:37:44 +00:00
Cy Schubert
74bc7fc0b4 Add the ipmon.5 man page.
PR/238816 initially addressed updates to usage() however the PR has
morphed into a shopping list of updates to usage() and man pages.

PR:		238816 (I added to the list during discussion)
MFC after:	1 week
2019-06-27 02:43:26 +00:00
Bryan Drewery
ae9f7248f9 rescue ipf: Remove hacks and link in libipf directly.
Sponsored by:	Dell EMC Isilon
2017-11-10 07:52:58 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Cy Schubert
48fa9d448d Disconnect ipftest and ipresend from the build until it can be verified
that they still work. These utilities have become out of sync with the
code in the kernel and need work to bring them back into shape.
Most people test on real systems or VMs on real networks.

Suggested by:	glebius
2017-03-14 02:10:37 +00:00
Cy Schubert
92044f3e36 Revert r315218 so that it may be committed together with r315219. 2017-03-14 02:06:12 +00:00
Cy Schubert
f0a7513344 Disconnect ipftest and ipresend from the build until it can be verified
that they still work. These utilities have become out of sync with the
code in the kernel and need work to bring them back into shape.
Most people test on real systems or VMs on real networks.

Sugested by:	glebius
2017-03-14 01:00:09 +00:00
Enji Cooper
22289a8c3d sbin: normalize paths using SRCTOP-relative paths or :H when possible
This simplifies make logic/output

MFC after:	1 month
Sponsored by:	Dell EMC Isilon
2017-03-04 11:33:01 +00:00
Glen Barber
52259a98ad MFH
Sponsored by:	The FreeBSD Foundation
2016-03-02 16:14:46 +00:00
Bryan Drewery
bd18fd57db DIRDEPS_BUILD: Regenerate without local dependencies.
These are no longer needed after the recent 'beforebuild: depend' changes
and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports
skipping 'make depend'.

Sponsored by:	EMC / Isilon Storage Division
2016-02-24 17:20:11 +00:00
Glen Barber
7de1daeb93 Create packages for atm, ccdconfig, devd, ipf, ipfw,
iscsi, natd, nandfs, pf, quotacheck, and routed.

Add ping6 and rtsol to the runtime package.

Sponsored by:	The FreeBSD Foundation
2016-02-09 19:30:31 +00:00
Bryan Drewery
7aab86d59d For INTERNALLIB always add in the corresponding _DP_ and use LIBADD in
the real build file.

This lessens the need to define DPADD_<lib> and LDADD_<lib> to just very
special cases.

Sponsored by:	EMC / Isilon Storage Division
2015-12-04 03:17:17 +00:00
Bryan Drewery
b748535cc4 Don't add LIBADD=ipf to libipf itself.
This had no real impact since libipf is a static INTERNALLIB.  It does conflict
with an assertion I am adding for LIBADD though.

Sponsored by:	EMC / Isilon Storage Division
2015-12-01 22:39:19 +00:00
Bryan Drewery
cf990407e1 Update dependencies after r291406 added libelf to libkvm.
Unfortunately filemon/meta mode tracks all indirect dependencies here
since ld(1) is reading libelf when linking in libkvm.  Churn would be
reduced if this was able to be limited to direct dependencies.

Sponsored by:	EMC / Isilon Storage Division
2015-12-01 05:18:48 +00:00
Bryan Drewery
277fbb92d5 Remove redundant DPSRCS which were already in SRCS.
DPSRCS already contains all of SRCS.

MFC after:	1 week
Sponsored by:	EMC / Isilon Storage Division
2015-11-25 20:38:07 +00:00
Bryan Drewery
10b83bb0e9 META_MODE: For some reason meta mode cannot generate the intermediate tab.c
files.  Split up all of the targets to be more clear on how they are generated
to fix the problem.

MFC after:	2 weeks
Sponsored by:	EMC / Isilon Storage Division
2015-10-02 07:00:43 +00:00
Bryan Drewery
6a8077f3d5 Add SUBDIR_PARALLEL.
MFC after:	2 weeks
Sponsored by:	EMC / Isilon Storage Division
2015-09-26 01:28:50 +00:00
Bryan Drewery
a98533d3e8 Remove disconnected directories.
These were added disconnected in 2005 in r145524.

Sponsored by:	EMC / Isilon Storage Division
2015-09-26 01:24:35 +00:00
Bryan Drewery
42c4cf86d4 Update META_MODE dependencies. 2015-09-17 05:06:34 +00:00
Simon J. Gerraty
ccfb965433 Add META_MODE support.
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision:       D2796
Reviewed by: brooks imp
2015-06-13 19:20:56 +00:00
Simon J. Gerraty
44d314f704 dirdeps.mk now sets DEP_RELDIR 2015-06-08 23:35:17 +00:00
Simon J. Gerraty
98e0ffaefb Merge sync of head 2015-05-27 01:19:58 +00:00
Baptiste Daroussin
13eb765f2d Convert sbin/ to LIBADD
Reduce overlinking
2014-11-25 11:23:12 +00:00
Simon J. Gerraty
9268022b74 Merge from head@274682 2014-11-19 01:07:58 +00:00
Bryan Drewery
5608fd23c2 Revert r267233 for now. PIE support needs to be reworked.
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
   build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
   where it never would work anyhow, such as csu or loader. This suggests
   there may be better ways of adding support to the tree. Many of these
   cases can be fixed such that -fPIE will work but there is really no
   reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
   really building libraries but have been using bsd.prog.mk because the code
   is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
   been needed.

We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.

Reported by:	kib
2014-08-19 15:04:32 +00:00
Simon J. Gerraty
ee7b0571c2 Merge head from 7/28 2014-08-19 06:50:54 +00:00
Cy Schubert
e722d6f29a Honour WITH and WITHOUT_INET6_SUPPORT.
Approved by:	glebius (mentor)
MFC after:	3 days
2014-08-05 13:01:21 +00:00