Commit Graph

258 Commits

Author SHA1 Message Date
Luigi Rizzo
a0e26ba089 Add a note that net.inet.ip.fw.autoinc_step is ipfw2-specific 2003-07-22 07:41:24 +00:00
Maxim Konovalov
6fa74f7d88 o Initialize do_pipe before command parsing.
PR:		bin/54649
Submitted by:	Andy Gilligan <andy@evo6.org>
MFC after:	3 days
2003-07-21 09:56:05 +00:00
Luigi Rizzo
3004afca6e Userland side of:
Allow set 31 to be used for rules other than 65535.
Set 31 is still special because rules belonging to it are not deleted
by the "ipfw flush" command, but must be deleted explicitly with
"ipfw delete set 31" or by individual rule numbers.

This implement a flexible form of "persistent rules" which you might
want to have available even after an "ipfw flush".
Note that this change does not violate POLA, because you could not
use set 31 in a ruleset before this change.

Suggested by: Paul Richards
2003-07-15 23:08:44 +00:00
Luigi Rizzo
bbc39c8391 Make sure that comments are printed at the end of a rule.
Reported by:  Patrick Tracanelli <eksffa@freebsdbrasil.com.br>
2003-07-15 10:23:43 +00:00
Luigi Rizzo
f3a126d3d8 Fix one typo in help() string, remove whitespace at end of line and
other minor whitespace changes.

Replace u_char with uint8_t in a few places.
2003-07-14 18:57:41 +00:00
Luigi Rizzo
26bf4d78c2 ccept of empty lines when reading from a file (this fixes a bug
introduced in the latest commits).

Also:

* update the 'ipfw -h' output;

* allow rules of the form "100 add allow ..." i.e. with the index first.
  (requested by Paul Richards). This was an undocumented ipfw1 behaviour,
  and it is left undocumented.

and minor code cleanups.
2003-07-14 08:39:49 +00:00
Luigi Rizzo
1b43a426de Add a '-T' flag to print the timestamp as numeric value instead
of converting it with ctime(). This is a lot more convenient for
postprocessing.

Submitted by: "Jacob S. Barrett" <jbarrett@amduat.net>
2003-07-12 08:35:25 +00:00
Luigi Rizzo
7d3f835703 Document the existence of comments in ipfw rules,
the new flags handled when reading from a file,
and clarify that only numeric values are allowed for icmptypes.

MFC after: 3 days
2003-07-12 07:01:48 +00:00
Luigi Rizzo
62ff38ae06 In random order:
* make the code compile with WARNS=5 (at least on i386), mostly
  by adding 'const' specifier and replacing "void *" with "char *"
  in places where pointer arithmetic was used.
  This also spotted a few places where invalid tests (e.g. uint < 0)
  were used.

* support ranges in "list" and "show" commands. Now you can say

        ipfw show 100-1000 4000-8000

  which is very convenient when you have large rulesets.

* implement comments in ipfw commands. These are implemented in the
  kernel as O_NOP commands (which always match) whose body contains
  the comment string. In userland, a comment is a C++-style comment:

        ipfw add allow ip from me to any // i can talk to everybody

  The choice of '//' versus '#' is somewhat arbitrary, but because
  the preprocessor/readfile part of ipfw used to strip away '#',
  I did not want to change this behaviour.

  If a rule only contains a comment

        ipfw add 1000 // this rule is just a comment

  then it is stored as a 'count' rule (this is also to remind
  the user that scanning through a rule is expensive).

* improve handling of flags (still to be completed).
  ipfw_main() was written thinking of 'one rule per ipfw invocation',
  and so flags are set and never cleared. With readfile/preprocessor
  support, this changes and certain flags should be reset on each
  line. For the time being, only fix handling of '-a' which
  differentiates the "list" and "show" commands.

* rework the preprocessor support -- ipfw_main() already had most
  of the parsing code, so i have moved in there the only missing
  bit (stripping away '#' and comments) and removed the parsing
  from ipfw_readfile().
  Also, add some more options (such as -c, -N, -S) to the readfile
  section.

MFC after: 3 days
2003-07-12 06:53:16 +00:00
Daniel Harris
a10c9747dc Correct to match reality regarding interface names.
PR:		51006
Submitted by:	"Dmitry Pryanishnikov" <dmitry@atlantis.dp.ua>
mdoc clue by:	"Simon L. Nielsen" <simon@nitro.dk>
MFC after:	10 days
2003-07-08 13:24:42 +00:00
Luigi Rizzo
4d233f6b0d * introduce a section on SYNTAX to document the handling
spaces and comma-separated lists of arguments;

* reword the description of address specifications, to include
  previous and current changes for address sets and lists;

* document the new '-n' flag.

* update the section on differences between ipfw1 and ipfw2
  (this is becoming boring!)

MFC after: 3 days
2003-07-08 08:07:03 +00:00
Luigi Rizzo
571f8c1b7a A bunch of changes (mostly syntactic sugar, all backward compatible):
* Make the addr-set size optional (defaults to /24)
    You can now write 1.2.3.0/24{56-80} or  1.2.3.0{56-80}
    Also make the parser more strict.

  * Support a new format for the list of addresses:
        1.2.3.4,5.6.7.8/30,9.10.11.12/22,12.12.12.13, ...
    which exploits the new capabilities of O_IP_SRC_MASK/O_IP_DST_MASK

  * Allow spaces after commas to make lists of addresses more readable.
        1.2.3.4, 5.6.7.8/30, 9.10.11.12/22, 12.12.12.13, ...

  * ipfw will now accept full commands as a single argument and strip
    extra leading/trailing whitespace as below:
        ipfw "-q add allow ip from 1.2.3.4 to 5.6.7.8, 9.10.11.23 "
    This should help in moving the body of ipfw into a library
    that user programs can invoke.

  * Cleanup some comments and data structures.

  * Do not print rule counters for dynamic rules with ipfw -d list
    (PR 51182)

  * Improve 'ipfw -h' output (PR 46785)

  * Add a '-n' flag to test the syntax of commands without actually
    calling [gs]etsockopt() (PR 44238)

  * Support the '-n' flag also with the preprocessors;

Manpage commit to follow.

MFC after: 3 days
2003-07-08 07:52:47 +00:00
Luigi Rizzo
c3e5b9f154 Implement the 'ipsec' option to match packets coming out of an ipsec tunnel.
Should work with both regular and fast ipsec (mutually exclusive).
See manpage for more details.

Submitted by: Ari Suutari (ari.suutari@syncrontech.com)
Revised by: sam
MFC after: 1 week
2003-07-04 21:42:32 +00:00
Luigi Rizzo
2bb3712f4e remove extra whitespace and blank lines 2003-06-27 17:18:14 +00:00
Luigi Rizzo
9d2d07e07d remove unused file (RELENG_5 and above use ipfw2, the old ipfw1
has been unused and unmaintained for a long time).
2003-06-24 07:10:13 +00:00
Luigi Rizzo
29c1402aa2 Split some long lines to fit 80 columns (the code in RELENG_4
was already correct).
2003-06-23 22:32:14 +00:00
Luigi Rizzo
9ef3f16d08 syntactic sugar: support range notation such as
1.2.3.4/24{5,6,7,10-20,60-90}
for set of ip addresses.
Previously you needed to specify every address in the range, which
was unconvenient and lead to very long lines.
Internally the set is still stored in the same way, just the
input and output routines are modified.

Manpage update still missing.

Perhaps a similar preprocessing step would be useful for port ranges.

MFC after: 3 days
2003-06-23 08:20:28 +00:00
Maxim Konovalov
064d54a248 o Fix sets of rules usage example.
PR:		docs/53625
Submitted by:	Kostyuk Oleg <cub@cub.org.ua>
MFC after:	1 week
2003-06-23 07:48:32 +00:00
Luigi Rizzo
44c884e134 Add support for multiple values and ranges for the "iplen", "ipttl",
"ipid" options. This feature has been requested by several users.
On passing, fix some minor bugs in the parser.  This change is fully
backward compatible so if you have an old /sbin/ipfw and a new
kernel you are not in trouble (but you need to update /sbin/ipfw
if you want to use the new features).

Document the changes in the manpage.

Now you can write things like

	ipfw add skipto 1000 iplen 0-500

which some people were asking to give preferential treatment to
short packets.

The 'MFC after' is just set as a reminder, because I still need
to merge the Alpha/Sparc64 fixes for ipfw2 (which unfortunately
change the size of certain kernel structures; not that it matters
a lot since ipfw2 is entirely optional and not the default...)

PR: bin/48015

MFC after: 1 week
2003-06-22 17:33:19 +00:00
Maxim Konovalov
c82b8dcedd o Pass a correct argument to printf(3).
PR:		bin/51750
Submitted by:	Vasil Dimov <vd@datamax.bg>
MFC after:	2 weeks
2003-06-16 09:44:53 +00:00
Bernd Walter
330462a315 Change handling to support strong alignment architectures such as alpha and
sparc64.

PR:		alpha/50658
Submitted by:	rizzo
Tested on:	alpha
2003-06-04 01:17:37 +00:00
Crist J. Clark
010dabb047 Add a 'verrevpath' option that verifies the interface that a packet
comes in on is the same interface that we would route out of to get to
the packet's source address. Essentially automates an anti-spoofing
check using the information in the routing table.

Experimental. The usage and rule format for the feature may still be
subject to change.
2003-03-15 01:13:00 +00:00
Maxim Konovalov
45f6135194 o Partially revert rev. 1.103, fix 'ipfw show': dynamically adjust a
width of fields for packets and bytes counters.

PR:		bin/47196
Reviewed by:	-audit
Not objected by: luigi, des

o Use %llu instead of deprecated %qu convert specification for ipfw
packets and bytes counters.

Noted by:	des
MFC after:	1 month
2003-03-13 10:51:53 +00:00
Ruslan Ermilov
8b5381e069 /modules is gone long ago, use the safe equivalents. 2003-03-03 22:46:36 +00:00
Christian Brueffer
16b3d3546d Correct examples for stateful inspection
PR:		47817
Submitted by:	Simon L.Nielsen <simon@nitro.dk>
Reviewed by:	ceri, luigi
2003-02-04 01:33:25 +00:00
Matthew Dillon
6690be9efa It turns out that we do not need to add a new ioctl to unbreak a
default-to-deny firewall.  Simply turning off IPFW via a preexisting
sysctl does the job.  To make it more apparent (since nobody picked up
on this in a week's worth of flames), the boolean sysctl's have been
integrated into the /sbin/ipfw command set in an obvious and straightforward
manner.  For example, you can now do 'ipfw disable firewall' or
'ipfw enable firewall'.  This is far easier to remember then the
net.inet.ip.fw.enable sysctl.

Reviewed by:	imp
MFC after:	3 days
2003-01-12 03:31:10 +00:00
Giorgos Keramidas
c41a3921ef Fix a reference to the order of SYNOPSIS lines.
Submitted by:	Olivier Cherrier <Olivier.Cherrier@cediti.be>
		on freebsd-net
MFC after:	3 days
2003-01-05 00:09:23 +00:00
Jens Schweikhardt
9d5abbddbf Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.
2003-01-01 18:49:04 +00:00
Kelly Yancey
ca6e3cb0e4 Make preprocessor support more generic by passing all command-line options
after -p except for the last (the ruleset file to process) to the
preprocessor for interpretation.  This allows command-line options besides
-U and -D to be passed to cpp(1) and m4(1) as well as making it easier to
use other preprocessors.

Sponsored By:	NTT Multimedia Communications Labs
MFC after:	1 week
2002-12-23 20:08:21 +00:00
Giorgos Keramidas
3d2209ae92 Align timestamps when -t is used in ipfw and ipfw2.
PR:		kern/44843
Approved by:	re (jhb)
2002-11-26 22:53:14 +00:00
Luigi Rizzo
12b5dc6a39 Fix a kernel panic with rules of the type
prob 0.5 pipe NN ....

due to the generation of an invalid ipfw instruction sequence.
No ABI change, but you need to upgrade /sbin/ipfw to generate the
correct code.

Approved by: re
2002-11-26 19:58:12 +00:00
Luigi Rizzo
99652d0eb2 Update documentation to match the behaviour of ipfw with respect
to net.inet.ip.fw.one_pass.
Add to notes to explain the exact behaviour of "prob xxx" and "log"
options.

Virtually approved by: re (mentioned in rev.1.19 of ip_fw2.c)
2002-11-26 19:51:40 +00:00
Maxim Konovalov
a54587ad70 Kill EOL whitespaces, style(9) fix. 2002-11-06 15:09:34 +00:00
Maxim Konovalov
d6abaeebeb Fix UID/GID options parsing.
PR:		bin/42579
Submitted by:	Belousov Oleg <oleg@belousov.com>
Approved by:	luigi
MFC after:	2 weeks
2002-11-06 14:57:18 +00:00
Luigi Rizzo
4d5fe224c6 Misc fixes from Chris Pepper, plus additional explainations on
dummynet operation.

MFC after: 3 days
2002-10-28 07:03:56 +00:00
Maxime Henrion
7c697970f4 Fix ipfw2 panics on 64-bit platforms.
Quoting luigi:

In order to make the userland code fully 64-bit clean it may
be necessary to commit other changes that may or may not cause
a minor change in the ABI.

Reviewed by:	luigi
2002-10-24 18:04:44 +00:00
Sean Chittenden
927a76bb5e Increase the max dummynet hash size from 1024 to 65536. Default is still
1024.

Silence on:	-net, -ipfw 4weeks+
Reviewed by:	dd
Approved by:	knu (mentor)
MFC after:	3 weeks
2002-10-12 07:45:23 +00:00
Maxim Konovalov
3ec6f79c1e Do not dump core on 'ipfw add unreach': handling null strings in
fill_reject_code(). Please note ipfw/ipfw2.c is not affected.

PR:		bin/42304
Submitted by:	Andy@wantpackets.com
MFC after:	1 day
2002-09-25 11:22:36 +00:00
Maxim Konovalov
8bca894718 o Fix a typo.
o Remove EOL spaces.

Submitted by:	Harold Gutch <logix@foobar.franken.de> (typo patch)
Approved by:	luigi
MFC after:	3 days
2002-09-22 11:30:51 +00:00
Luigi Rizzo
4f531a5368 Store the port number in "fwd" rules in host format, same as ipfw1
has always done.

Technically, this is the wrong format, but it reduces the diffs in
-stable. Someday, when we get rid of ipfw1, I will put the port number
in the proper format both in kernel and userland.

MFC after: 3 days
(with re@ permission)
2002-09-12 00:45:32 +00:00
Marc Fonvieille
eea54e1396 Typo: s/o packet/on packet/
PR:		docs/42543
Submitted by:	Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
2002-09-08 09:01:08 +00:00
Tom Rhodes
ce66ddb763 s/filesystem/file system/g as discussed on -developers 2002-08-21 18:11:48 +00:00
Luigi Rizzo
f0ac20f7d2 Whoops, the manpage lied... ipfw2 has always accepted addr:mask
specifications.
2002-08-21 05:57:41 +00:00
Luigi Rizzo
5a155b405e One more (hopefully the last one) step in cleaning up the syntax,
following Julian's good suggestion: since you can specify any match
pattern as an option, rules now have the following format:

	[<proto> from <src> to <dst>] [options]

i.e. the first part is now entirely optional (and left there just
for compatibility with ipfw1 rulesets).

Add a "-c" flag to show/list rules in the compact form
(i.e. without the "ip from any to any" part) when possible.
The default is to include it so that scripts processing ipfw's
canonical output will still work.
Note that as part of this cleanup (and to remove ambiguity), MAC
fields now can only be specified in the options part.

Update the manpage to reflect the syntax.

Clarify the behaviour when a match is attempted on fields which
are not present in the packet, e.g. port numbers on non TCP/UDP
packets, and the "not" operator is specified. E.g.

	ipfw add allow not src-port 80

will match also ICMP packets because they do not have port numbers, so
"src-port 80" will fail and "not src-port 80" will succeed. For such
cases it is advised to insert further options to prevent undesired results
(e.g. in the case above, "ipfw add allow proto tcp not src-port 80").

We definitely need to rewrite the parser using lex and yacc!
2002-08-19 12:36:54 +00:00
Luigi Rizzo
e706181ba6 Major cleanup of the parser and printing routines in an attempt to
render the syntax less ambiguous.

Now rules can be in one of these two forms

	<action> <protocol> from <src> to <dst> [options]
	<action> MAC dst-mac src-mac mac-type [options]

however you can now specify MAC and IP header fields as options e.g.

	ipfw add allow all from any to any mac-type arp
	ipfw add allow all from any to any { dst-ip me or src-ip me }

which makes complex expressions a lot easier to write and parse.
The "all from any to any" part is there just for backward compatibility.

Manpage updated accordingly.
2002-08-19 04:52:15 +00:00
Luigi Rizzo
654399a477 Complete list of differences between ipfw1 and ipfw2. 2002-08-16 14:27:22 +00:00
Luigi Rizzo
99e5e64504 sys/netinet/ip_fw2.c:
Implement the M_SKIP_FIREWALL bit in m_flags to avoid loops
    for firewall-generated packets (the constant has to go in sys/mbuf.h).

    Better comments on keepalive generation, and enforce dyn_rst_lifetime
    and dyn_fin_lifetime to be less than dyn_keepalive_period.

    Enforce limits (up to 64k) on the number of dynamic buckets, and
    retry allocation with smaller sizes.

    Raise default number of dynamic rules to 4096.

    Improved handling of set of rules -- now you can atomically
    enable/disable multiple sets, move rules from one set to another,
    and swap sets.

sbin/ipfw/ipfw2.c:

    userland support for "noerror" pipe attribute.

    userland support for sets of rules.

    minor improvements on rule parsing and printing.

sbin/ipfw/ipfw.8:

    more documentation on ipfw2 extensions, differences from ipfw1
    (so we can use the same manpage for both), stateful rules,
    and some additional examples.
    Feedback and more examples needed here.
2002-08-16 10:31:47 +00:00
Luigi Rizzo
8ed2d7497b Fix one parsing bug introduced by last commit, and correct parsing
and printing of or-blocks in address, ports and options lists.
2002-08-10 15:10:15 +00:00
Luigi Rizzo
ac4ed01f56 Major revision of the ipfw manpage, trying to make it up-to-date
with ipfw2 extensions and give examples of use of the new features.

This is just a preliminary commit, where i simply added the basic
syntax for the extensions, and clean up the page (e.g. by listing
things in alphabetical rather than random order).
I would appreciate feedback and possible corrections/extensions
by interested parties.

Still missing are a more detailed description of stateful rules
(with keepalives), interaction with of stateful rules and natd (don't do
that!), examples of use with the recently introduced rule sets.

There is an issue related to the MFC: RELENG_4 still has ipfw as a
default, and ipfw2 is optional. We have two options here: MFC this
page as ipfw(8) adding a large number of "SORRY NOT IN IPFW" notes,
or create a new ipfw2(8) manpage just for -stable users.  I am all
for the first approach, but of course am listening to your comments.
2002-08-10 15:04:40 +00:00
Luigi Rizzo
43405724ec One bugfix and one new feature.
The bugfix (ipfw2.c) makes the handling of port numbers with
a dash in the name, e.g. ftp-data, consistent with old ipfw:
use \\ before the - to consider it as part of the name and not
a range separator.

The new feature (all this description will go in the manpage):

each rule now belongs to one of 32 different sets, which can
be optionally specified in the following form:

	ipfw add 100 set 23 allow ip from any to any

If "set N" is not specified, the rule belongs to set 0.

Individual sets can be disabled, enabled, and deleted with the commands:

	ipfw disable set N
	ipfw enable set N
	ipfw delete set N

Enabling/disabling of a set is atomic. Rules belonging to a disabled
set are skipped during packet matching, and they are not listed
unless you use the '-S' flag in the show/list commands.
Note that dynamic rules, once created, are always active until
they expire or their parent rule is deleted.
Set 31 is reserved for the default rule and cannot be disabled.

All sets are enabled by default. The enable/disable status of the sets
can be shown with the command

	ipfw show sets

Hopefully, this feature will make life easier to those who want to
have atomic ruleset addition/deletion/tests. Examples:

To add a set of rules atomically:

	ipfw disable set 18
	ipfw add ... set 18 ...		# repeat as needed
	ipfw enable set 18

To delete a set of rules atomically

	ipfw disable set 18
	ipfw delete set 18
	ipfw enable set 18

To test a ruleset and disable it and regain control if something
goes wrong:

	ipfw disable set 18
	ipfw add ... set 18 ...         # repeat as needed
	ipfw enable set 18 ; echo "done "; sleep 30 && ipfw disable set 18

    here if everything goes well, you press control-C before
    the "sleep" terminates, and your ruleset will be left
    active. Otherwise, e.g. if you cannot access your box,
    the ruleset will be disabled after the sleep terminates.

I think there is only one more thing that one might want, namely
a command to assign all rules in set X to set Y, so one can
test a ruleset using the above mechanisms, and once it is
considered acceptable, make it part of an existing ruleset.
2002-08-10 04:37:32 +00:00