freebsd-dev/contrib/ipfilter
2000-08-13 05:00:44 +00:00
..
BSD Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
etc Remove files not in the v3_3_8 import. 2000-02-10 05:09:52 +00:00
FreeBSD Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
FreeBSD-2.2 Import of ipfilter 3.3.3 in anticipation of its revival. 1999-11-08 20:51:23 +00:00
FreeBSD-3 Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
FreeBSD-4.0 Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
FWTK Remove files not in the v3_3_8 import. 2000-02-10 05:09:52 +00:00
iplang resolve conflicts 2000-08-13 05:00:44 +00:00
ipsd Remove files not in the v3_3_8 import. 2000-02-10 05:09:52 +00:00
ipsend This commit was generated by cvs2svn to compensate for changes in r64588, 2000-08-13 04:58:02 +00:00
l4check Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
man fix conflicts 2000-07-19 13:56:18 +00:00
perl Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
rules Remove files not in the v3_3_8 import. 2000-02-10 05:09:52 +00:00
samples Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
test Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
BNF Import of ipfilter 3.3.8 2000-02-09 20:46:45 +00:00
bsdinstall
BugReport
common.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
facpri.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
facpri.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
FAQ.FreeBSD
fil.c resolve conflicts 2000-08-13 05:00:44 +00:00
fils.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
HISTORY Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
IMPORTANT Import trimmed version of ipfilter 3.2.7. 1998-06-20 18:29:38 +00:00
inet_addr.c Import of ipfilter 3.3.3 in anticipation of its revival. 1999-11-08 20:51:23 +00:00
INST.FreeBSD-2.2 Import trimmed version of ipfilter 3.2.7. 1998-06-20 18:29:38 +00:00
INSTALL.FreeBSD Import of ipfilter 3.3.3 in anticipation of its revival. 1999-11-08 20:51:23 +00:00
INSTALL.xBSD actually commit merged diffs to the trunk 2000-07-19 23:10:29 +00:00
ip_auth.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_auth.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_compat.h Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_fil.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_fil.h fix conflicts 2000-07-19 13:56:18 +00:00
ip_frag.c Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
ip_frag.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_ftp_pxy.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_lfil.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_log.c resolve conflicts 2000-08-13 05:00:44 +00:00
ip_nat.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_nat.h Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
ip_proxy.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_proxy.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_raudio_pxy.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ip_rcmd_pxy.c Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
ip_sfil.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_state.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ip_state.h Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
ipf.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ipf.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
IPF.KANJI Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipfs.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_ef.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_hx.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_pc.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_sn.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_td.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipft_tx.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipl.h Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ipmon.c resolve conflicts 2000-08-13 05:00:44 +00:00
ipnat.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
ipt.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
ipt.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
kmem.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
kmem.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
LICENCE Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
Makefile Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
misc.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
mkfilters Import of ipfilter 3.3.3 in anticipation of its revival. 1999-11-08 20:51:23 +00:00
ml_ipl.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
mlf_ipl.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
mlfk_ipl.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
mli_ipl.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
mln_ipl.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
mls_ipl.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
NAT.FreeBSD
natparse.c Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
opt_inet6.h Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
opt.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
parse.c Import v3.4.8 into -current 2000-07-19 13:52:47 +00:00
pcap.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
README Import trimmed version of ipfilter 3.2.7. 1998-06-20 18:29:38 +00:00
relay.c Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
snoop.h Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
solaris.c Import base ipfilter 3.4.9 into contrib dir. 2000-08-13 04:58:02 +00:00
todo Import IP Filter 3.4.4 into FreeBSD-current 2000-05-24 02:14:22 +00:00
UPGRADE_NOTICE Import of ipfilter 3.3.3 in anticipation of its revival. 1999-11-08 20:51:23 +00:00
Y2K Import trimmed version of ipfilter 3.2.7. 1998-06-20 18:29:38 +00:00

IP Filter - What's this about ?
============================

  The idea behind this package is allow those who use Unix workstations as
routers (a common occurance in Universities it appears) to apply packet
filtering to packets going in and out of them.  This package has been
tested on all versions of SunOS 4.1 and Solaris 2.4/2.5, running on Sparcs.
It is also quite possible for this small kernel extension to be installed
and used effectively on Sun workstations which don't route IP, just for
added security.  It can also be integrated with the multicast patches.
It has also been tested successfully on all of the modern free BSDs as
well as BSDI, and SGI's IRIX 6.2.

   The filter keeps a rule list for both inbound and outbound sides of
the IP packet queue and a check is made as early as possible, aiming to
stop the packet before it even gets as far as being checked for source
route options.  In the file "BNF", a set of rules for constructing filter
rules understood by this package is given.  The files in the directory
"rules", "example.1" ... "example.sr" show example rules you might apply.

   In practise, I've successfully isolated a workstation from all
machines except the NFS file servers on its local subnets (yeah, ok, so
this doesn't really increase security, because of NFS, but you get the
drift on how it can be applied and used).  I've also successfully
setup and maintained my own firewalls using it with TIS's Firewall Toolkit,
including using it on an mbone router.

   When using it with multicast IP, the calls to fr_check() should be
before the packet is unwrapped and after it is encapsulated.  So the
filter routines will see the packet as a UDP packet, protocol XYZ.
Whether this is better or worse than having it filter on class D addresses
is debateable, but the idea behind this package is to be able to
discriminate between packets as they are on the 'wire', before they
get routed anywhere, etc.

   It is worth noting, that it is possible, using a small MTU and
generating tiny fragmented IP packets to generate a TCP packet which
doesn't contain enough information to filter on the "flags".  Filtering
on these types of packets is possible, but under the more general case
of the packets being "short".  ICMP and UDP packets which are too small
(they don't contain a complete header) are dropped and logged, no questions
asked.  When filtering on fragmented packets, the last fragment will get
through for TCP/UDP/ICMP packets.

Bugs/Problems
-------------
If you have a problem with IP Filter on your operating system, please email
a copy of the file "BugReport" with the details of your setup as required
and email to darrenr@pobox.com.

Some general notes.
-------------------
   To add/delete a rule from memory, access to the device in /dev is needed,
allowing non-root maintenaince.  The filter list in kernel memory is built
from the kernel's heap.  Each packet coming *in* or *out* is checked against
the appropriate list, rejects dropped, others passed through.  Thus this will
work on an individual host, not just gateways.  Presently there is only one
list for all interfaces, the changes required to make it a per-interface list
require more .o replacements for the kernel.  When checking a packet, the
packet is compared to the entire list from top to bottom, the last matching
line being effective.


What does what ?
----------------
if_fil.o  (Loadable kernel module)
	- additional kernel routines to check an access list as to whether
	  or not to drop or pass a packet.  It currently defaults to pass
	  on all packets.

ipfstat
	- digs through your kernel (need to check #define VMUNIX in fils.c)
	  and /dev/kmem for the access filter list and mini stats table.
	  Obviously needs to be run priviledged if required.

ipf
	- reads the files passed as parameters as input files containing new
	  filter rules to add/delete to the kernel list.  The lines are
	  inserted in order; the first line is inserted first, and ends up
	  first on the list.  Subsequent invocations append to the list
	  unless specified otherwise.

ipftest
	- test the ruleset given by filename.  Reads in the ruleset and then
	  waits for stdin.

	  See the man pages (ipf.1, ipftest.1, ipfstat.8) for more detailed
	  information on what the above do.

mkfilters
	- suggests a set of filter rules to employ and suggests how to add
	  routes to back these up.

BNF
	- BNF rule set for the filter rules

Darren Reed
darrenr@pobox.com