Commit Graph

341 Commits

Author SHA1 Message Date
Ruslan Ermilov
a5b0d9050a [mdoc] add missing space before a punctuation type argument. 2005-12-13 17:07:52 +00:00
Gleb Smirnoff
40b1ae9e00 Add a new feature for optimizining ipfw rulesets - substitution of the
action argument with the value obtained from table lookup. The feature
is now applicable only to "pipe", "queue", "divert", "tee", "netgraph"
and "ngtee" rules.

An example usage:

  ipfw pipe 1000 config bw 1000Kbyte/s
  ipfw pipe 4000 config bw 4000Kbyte/s
  ipfw table 1 add x.x.x.x 1000
  ipfw table 1 add x.x.x.y 4000
  ipfw pipe tablearg ip from table(1) to any

In the example above the rule will throw different packets to different pipes.

TODO:
  - Support "skipto" action, but without searching all rules.
  - Improve parser, so that it warns about bad rules. These are:
    - "tablearg" argument to action, but no "table" in the rule. All
      traffic will be blocked.
    - "tablearg" argument to action, but "table" searches for entry with
      a specific value. All traffic will be blocked.
    - "tablearg" argument to action, and two "table" looks - for src and
      for dst. The last lookup will match.
2005-12-13 12:16:03 +00:00
Gleb Smirnoff
02d48226cc Cleanup _FreeBSD_version. 2005-12-09 13:03:30 +00:00
Hajimu UMEMOTO
36c263cca9 We couldn't specify the rule for filtering tunnel traffic since an
IPv6 support was committed:

- Stop treating `ip' and `ipv6' as special in `proto' option as they
  conflict with /etc/protocols.

- Disuse `ipv4' in `proto' option as it is corresponding to `ipv6'.

- When protocol is specified as numeric, treat it as it is even it is
  41 (ipv6).

- Allow zero for protocol as it is valid number of `ip'.

Still, we cannot specify an IPv6 over an IPv4 tunnel like before such
as:

	pass ipv6 from any to any

But, now, you can specify it like:

	pass ip4 from any to any proto ipv6

PR:		kern/89472
Reported by:	Ga l Roualland <gael.roualland__at__dial.oleane.com>
MFC after:	1 week
2005-11-29 15:25:09 +00:00
Gleb Smirnoff
e36ffd3b15 Catch up with ip_dummynet.h rev. 1.38 and fix build. 2005-11-29 12:01:26 +00:00
Gleb Smirnoff
b090e4ce1f Garbage-collect now unused struct _ipfw_insn_pipe and flush_pipe_ptrs(),
thus removing a few XXXes.
  Document the ABI breakage in UPDATING.
2005-11-29 08:59:41 +00:00
Ruslan Ermilov
4e9e907d63 -mdoc sweep. 2005-11-18 10:36:29 +00:00
Christian S.J. Peron
cd5f2f95b6 Restore the documentation about uid, gid or prison based rules requiring
that debug.mpsafenet be set to 0. It is still possible for dead locks to
occur while these filtering options are used due to the layering violation
inherent in their implementation.

Discussed:	-current, rwatson, glebius
2005-10-23 16:15:02 +00:00
Max Laier
13f5260916 Redirect bridge(4) to if_bridge(4) and rename sysctl accordingly.
Reminded by:	ru
2005-09-28 08:18:55 +00:00
Bjoern A. Zeeb
9066356ba1 * Add dynamic sysctl for net.inet6.ip6.fw.
* Correct handling of IPv6 Extension Headers.
* Add unreach6 code.
* Add logging for IPv6.

Submitted by:	sysctl handling derived from patch from ume needed for ip6fw
Obtained from:	is_icmp6_query and send_reject6 derived from similar
		functions of netinet6,ip6fw
Reviewed by:	ume, gnn; silence on ipfw@
Test setup provided by: CK Software GmbH
MFC after:	6 days
2005-08-13 11:02:34 +00:00
Colin Percival
e5610d524c Bump document date. Remove EOL whitespace introduced in previous
commit.  Start new line at sentence break in previous commit.

Approved by:	re (implicit, fixing a commit made 5 minutes ago)
2005-07-01 10:04:33 +00:00
Colin Percival
4beacf6666 Document some limitations of uid/gid rules.
Approved by:	re (rwatson)
MFC after:	3 days
2005-07-01 09:51:10 +00:00
Ruslan Ermilov
55c82bf0d4 Markup fixes.
Approved by:	re (blanket)
2005-06-14 11:24:56 +00:00
Max Laier
b730879ffa add_proto() now fills proto for us so stop to 'guess' the protocol from the
command and rather trust the value add_proto filled in.  While here, fix an
oversight in the pretty printing of ip6/4 options.
2005-06-07 14:11:17 +00:00
Brian Feldman
5278d40bcc Better explain, then actually implement the IPFW ALTQ-rule first-match
policy.  It may be used to provide more detailed classification of
traffic without actually having to decide its fate at the time of
classification.

MFC after:	1 week
2005-06-04 19:04:31 +00:00
Max Laier
57cd6d263b Add support for IPv4 only rules to IPFW2 now that it supports IPv6 as well.
This is the last requirement before we can retire ip6fw.

Reviewed by:	dwhite, brooks(earlier version)
Submitted by:	dwhite (manpage)
Silence from:	-ipfw
2005-06-03 01:10:28 +00:00
Max Laier
ffa4a5867a Unbreak handling of "ip[v]6" protocol and option flag. No more segfaults
and not every protocol is IPv6.
2005-05-21 03:27:33 +00:00
Gleb Smirnoff
0c0e9713a6 'ngtee' also depends on net.inet.ip.fw.one_pass. 2005-05-11 12:58:15 +00:00
Gleb Smirnoff
0af8180f8c IPFW version 2 is the only option now in HEAD. Do not confuse
users of future releases with instructions about building IPFW2
on RELENG_4.
2005-05-04 13:14:57 +00:00
Brooks Davis
d360073b23 Fix a the previous commit. I wanted to remove the if and always run the
body not remove both.

Reported by:	ceri
Pointy hat:	brooks
2005-04-26 20:22:31 +00:00
Brooks Davis
38aede1cce Don't force IPv6 proto to be printed numericaly.
Noticed by:	ceri
2005-04-26 20:00:07 +00:00
Brooks Davis
8195404bed Add IPv6 support to IPFW and Dummynet.
Submitted by:	Mariano Tortoriello and Raffaele De Lorenzo (via luigi)
2005-04-18 18:35:05 +00:00
Brooks Davis
776c10059d Be more specific when complaining about bit masks. 2005-04-05 22:26:02 +00:00
Andre Oppermann
099dd0430b Bring back the full packet destination manipulation for 'ipfw fwd'
with the kernel compile time option:

 options IPFIREWALL_FORWARD_EXTENDED

This option has to be specified in addition to IPFIRWALL_FORWARD.

With this option even packets targeted for an IP address local
to the host can be redirected.  All restrictions to ensure proper
behaviour for locally generated packets are turned off.  Firewall
rules have to be carefully crafted to make sure that things like
PMTU discovery do not break.

Document the two kernel options.

PR:		kern/71910
PR:		kern/73129
MFC after:	1 week
2005-02-22 17:40:40 +00:00
Ruslan Ermilov
0227791b40 Expand *n't contractions. 2005-02-13 22:25:33 +00:00
Gleb Smirnoff
dc490fa2e9 Sort SEE ALSO.
Submitted by:	ru
2005-02-07 08:51:34 +00:00
Gleb Smirnoff
1676543619 Document how interaction with ng_ipfw node is configured. 2005-02-05 18:29:03 +00:00
Gleb Smirnoff
670742a102 Add a ng_ipfw node, implementing a quick and simple interface between
ipfw(4) and netgraph(4) facilities.

Reviewed by:	andre, brooks, julian
2005-02-05 12:06:33 +00:00
Gleb Smirnoff
bd528823ec Don't print extra " via ", if we have already printed one. While here,
slightly style brackets.

PR:		misc/75297
MFC after:	1 week
2005-01-18 15:13:20 +00:00
Ruslan Ermilov
6087df9e8b Sort sections. 2005-01-18 10:09:38 +00:00
Ruslan Ermilov
5b1eeb71f2 Markup nits. 2005-01-15 11:21:24 +00:00
Brooks Davis
0175018610 Deprecate unmaintainable uses of strncmp to implement abbreviations.
This commit replaces those with two new functions that simplify the code
and produce warnings that the syntax is deprecated.  A small number of
sensible abbreviations may be explicitly added based on user feedback.

There were previously three types of strncmp use in ipfw:
 - Most commonly, strncmp(av, "string", sizeof(av)) was used to allow av
   to match string or any shortened form of it.  I have replaced this
   with a new function _substrcmp(av, "string") which returns 0 if av
   is a substring of "string", but emits a warning if av is not exactly
   "string".

 - The next type was two instances of strncmp(av, "by", 2) which allowed
   the abbreviation of bytes to "by", "byt", etc.  Unfortunately, it
   also supported "bykHUygh&*g&*7*ui".  I added a second new function
   _substrcmp2(av, "by", "bytes") which acts like the strncmp did, but
   complains if the user doesn't spell out the word "bytes".

 - There is also one correct use of strncmp to match "table(" which might
   have another token after it without a space.

Since I changed all the lines anyway, I also fixed the treatment of
strncmp's return as a boolean in many cases.  I also modified a few
strcmp cases as well to be fully consistent.
2005-01-15 01:46:41 +00:00
Ruslan Ermilov
214144704b Scheduled mdoc(7) sweep. 2005-01-10 16:17:34 +00:00
Brooks Davis
610055c9e2 Write some bit mask limits in hex rather than decimal so they look less
magic.
2005-01-07 01:21:23 +00:00
Christian S.J. Peron
02a85ee096 Update the IPFW man page to reflect reality. mpsafenet=0 is no longer
required when using ucred based rules.

Pointed out by:	seanc (thanks!)
MFC after:	1 month
2004-12-10 02:38:21 +00:00
Brooks Davis
448d1e830b Remove a duplicate line from an apparent merge error in rev 1.63. 2004-11-25 01:09:41 +00:00
Ceri Davies
20f13585ef Be more clear that "bridged" is a synonym for "layer2".
PR:		docs/44400
Submitted by:	Constantin Stefanov <cstef at mail dot ru>
2004-11-03 21:51:34 +00:00
Andre Oppermann
24fc79b0a4 Refuse to unload the ipdivert module unless the 'force' flag is given to kldunload.
Reflect the fact that IPDIVERT is a loadable module in the divert(4) and ipfw(8)
man pages.
2004-10-22 19:12:01 +00:00
Christian S.J. Peron
93962a3a50 Add a note to the man page warning users about possible lock order
reversals+system lock ups if they are using ucred based rules
while running with debug.mpsafenet=1.

I am working on merging a shared locking mechanism into ipfw which
should take care of this problem, but it still requires a bit more
testing and review.
2004-10-09 20:07:33 +00:00
Brian Feldman
26dc327082 Reference altq(4) instead of pf.conf(5).
Tip of the hat to:	mlaier
2004-10-08 03:31:09 +00:00
Brian Feldman
17db1a040f Commit forgotten documentation for "diverted" rules. 2004-10-08 03:24:10 +00:00
Brian Feldman
a5559720e1 Remove blindly-copied extra include path. 2004-10-03 06:32:37 +00:00
Brian Feldman
c99ee9e042 Add support to IPFW for matching by TCP data length. 2004-10-03 00:47:15 +00:00
Brian Feldman
391a0e3306 Add the documentation for IPFW's diverted(-loopback|-output) matches. 2004-10-03 00:35:52 +00:00
Brian Feldman
6daf7ebd28 Add support to IPFW for classification based on "diverted" status
(that is, input via a divert socket).
2004-10-03 00:26:35 +00:00
Brian Feldman
5599f1b52b Remove accidentally-added O_DIVERTED section. 2004-10-03 00:24:42 +00:00
Brian Feldman
974dfe3084 Add to IPFW the ability to do ALTQ classification/tagging. 2004-10-03 00:17:46 +00:00
Christian S.J. Peron
d413c2e405 Since "d" is an array of 32 bit values, it is more
correct to change the cast from unsigned int to uint32_t.

Pointed out by:	luigi
2004-09-21 22:12:43 +00:00
Ruslan Ermilov
bf899c64f3 Prepare for 5.x soon becoming -STABLE.
Pointed out by:	-current users
2004-09-19 14:30:59 +00:00
Andre Oppermann
7c0102f575 Make 'ipfw tee' behave as inteded and designed. A tee'd packet is copied
and sent to the DIVERT socket while the original packet continues with the
next rule.  Unlike a normally diverted packet no IP reassembly attemts are
made on tee'd packets and they are passed upwards totally unmodified.

Note: This will not be MFC'd to 4.x because of major infrastucture changes.

PR:		kern/64240 (and many others collapsed into that one)
2004-09-13 16:46:05 +00:00