Commit Graph

21 Commits

Author SHA1 Message Date
Mark Johnston
56707bee4b ipfw(8): Fix most warnings with the default WARNS level.
- Add missing const and static qualifiers.
- Avoid shadowing the global "co" by renaming it to "g_co".
- Avoid mixing signedness in loop bound checks.
- Leave -Wcast-align warnings disabled for now.

Reviewed by:	ae, melifaro
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D25456
2020-07-13 17:51:04 +00:00
Mark Johnston
27b3db9709 ipfw(8): In fill_ip6(), use a single statement for both "me" and "me6".
Submitted by:	Neel Chauhan <neel AT neelc DOT org>
Reviewed by:	rgrimes, Lutz Donnerhacke
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D24403
2020-06-24 15:05:42 +00:00
Andrey V. Elsukov
51b1593065 Explicitly initialize the memory buffer to store O_ICMP6TYPE opcode.
By default next_cmd() initializes only first u32 of opcode. O_ICMP6TYPE
opcode has array of bit masks to store corresponding ICMPv6 types.
An opcode that precedes O_ICMP6TYPE, e.g. O_IP6_DST, can have variable
length and during opcode filling it can modify memory that will be used
by O_ICMP6TYPE opcode. Without explicit initialization this leads to
creation of wrong opcode.

Reported by:	Boris N. Lytochkin
Obtained from:	Yandex LLC
MFC after:	3 days
2019-10-15 09:50:02 +00:00
Andrey V. Elsukov
5786c6b9f9 Make multiline APPLY_MASK() macro to be function-like.
Reported by:	cem
MFC after:	1 week
2018-11-20 18:38:28 +00:00
Andrey V. Elsukov
8f47ad010c Do not print "ip6" keyword in print_icmp6types() for O_ICMP6TYPE opcode.
It produces incompatibility when rules listing is used again to
restore saved ruleset, because "ip6" keyword produces separate opcode.
The kernel already has the check and only IPv6 packets will be checked
for matching.

PR:		232939
MFC after:	3 days
2018-11-06 07:41:32 +00:00
Andrey V. Elsukov
880d3c76b5 Do not use bzero() for the O_ICMP6TYPE opcode.
The buffer is already zeroed in compile_rule() function, and also it
may contain configured F_NOT flag in o.len field. This fixes the filling
for "not icmp6types" opcode.

PR:		232939
MFC after:	3 days
2018-11-03 20:05:50 +00:00
Andrey V. Elsukov
0f71e509e5 Fix indenting in ipv6.c file, use tabs instead of mixing tabs and spaces.
MFC after:	1 week
2018-04-12 20:05:26 +00:00
Andrey V. Elsukov
bd32e33552 Remove printing of "not" keyword from print_ip6() function.
After r331668 handling of F_NOT flag done in one place by
print_instruction() function. Also remove unused argument from
print_ip[6]() functions.

MFC after:	1 week
2018-04-12 19:44:04 +00:00
Pedro F. Giffuni
33d72c30f1 Revert r327005 - SPDX tags for license similar to BSD-2-Clause.
After consultation with SPDX experts and their matching guidelines[1],
the licensing doesn't exactly match the BSD-2-Clause. It yet remains to be
determined if they are equivalent or if there is a recognized license that
matches but it is safer to just revert the tags.

Let this also be a reminder that on FreeBSD, SPDX tags are only advisory
and have no legal value (but IANAL).

Pointyhat to:	pfg
Thanks to:	Rodney Grimes, Gary O'Neall

[1] https://spdx.org/spdx-license-list/matching-guidelines
2017-12-20 20:25:28 +00:00
Pedro F. Giffuni
d17aef79bb SPDX: These are fundamentally BSD-2-Clause.
They just omit the introductory line and numbering.
2017-12-19 22:40:16 +00:00
Marius Strobl
247cea8f9c In fill_ip6(), the value of the pointer av changes before it is
free(3)ed. Thus, introduce a new variable to track the original
value.

Submitted by:		Tom Rix
Differential Revision:	https://reviews.freebsd.org/D9962
2017-04-23 21:17:59 +00:00
Andrey V. Elsukov
757b5d8792 Add missing support of named lookup tables to the IPv6 code.
PR:		214419
MFC after:	1 week
Sponsored by:	Yandex LLC
2016-11-15 07:13:16 +00:00
Andrey V. Elsukov
23b93085c2 Add support for non-contiguous IPv6 masks in ipfw(8) rules.
For example fe::640:0:0/ffff::ffff:ffff:0:0 will match
addresses fe:*:*:*:0:640:*:*

Submitted by:	Eugene Mamchits <mamchits at yandex-team dot ru>
Obtained from:	Yandex LLC
MFC after:	2 weeks
Sponsored by:	Yandex LLC
2016-10-18 15:14:46 +00:00
Pedro F. Giffuni
b68ac8007d sbin: minor spelling fixes.
No functional change.
2016-04-30 19:04:59 +00:00
Andrey V. Elsukov
7b34dbe450 Fix output formatting of O_UNREACH6 opcode.
Obtained from:	Yandex LLC
2016-04-14 18:22:08 +00:00
Alexander V. Chernikov
912430f6f0 Merge buffer-printing changes from from projects/ipfw as preparation
for branch merge.

Requested by:	luigi
2014-08-23 17:37:18 +00:00
Alexander V. Chernikov
579ed7bd05 Implement buffer size checking in ipfw(8) add cmd.
PR:		bin/65961
Submitted by:	Eugene Grosbein <eugen@grosbein.pp.ru>
MFC after:	2 weeks
2013-03-03 14:05:03 +00:00
Alexander V. Chernikov
26dd50684e Whitespace fixes
MFC after:	2 weeks
2012-09-24 17:34:30 +00:00
Alexander V. Chernikov
7e00325dff Permit table to be used as IPv6 address.
Reported by:	Serhiy Popov <sergiuspso@ukr.net>
MFC after:	2 weeks
2012-09-24 17:31:08 +00:00
Gleb Smirnoff
5221106c04 Whitespace fixes.
Checked with:	md5, diff -w
2011-04-18 21:18:22 +00:00
Luigi Rizzo
ead75a59f1 Put nat and ipv6 support in their own files.
Usual moving of code with no changes from ipfw2.c to the
newly created files, and addition of prototypes to ipfw2.h

I have added forward declarations for ipfw_insn_* in ipfw2.h
to avoid a global dependency on ip_fw.h
2009-01-27 12:01:30 +00:00