d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6cece43912
freebsd-skq/sys/netinet/ip_fw.c

705 lines
15 KiB
C
Raw Normal View History

IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
/*
* Copyright (c) 1993 Daniel Boulet
* Copyright (c) 1994 Ugen J.S.Antsilevich
*
* Redistribution and use in source forms, with and without modification,
* are permitted provided that this entire comment appears intact.
*
* Redistribution in binary form may occur without any restrictions.
* Obviously, it would be nice if you gave credit where credit is due
* but requiring it would be too onerous.
*
* This software is provided ``AS IS'' without any warranties of any kind.
Added $Id$.
1995-07-23 05:36:31 +00:00
*
Fix wrong logic, certain rules never matched.
1996-02-26 15:28:15 +00:00
* $Id: ip_fw.c,v 1.32 1996/02/24 13:38:26 phk Exp $
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
*/
/*
* Implement IP packet firewall
*/
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
#include <sys/queue.h>
#if 0 /* XXX -current, but not -stable */
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
#include <sys/kernel.h>
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
#include <sys/sysctl.h>
#endif
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
#include <net/if.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
#include <netinet/tcp.h>
#include <netinet/udp.h>
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
#include <netinet/ip_icmp.h>
#include <netinet/ip_fw.h>
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
static int fw_debug = 1;
#ifdef IPFIREWALL_VERBOSE
static int fw_verbose = 1;
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
#else
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
static int fw_verbose = 0;
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
#endif
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
LIST_HEAD (ip_fw_head, ip_fw_chain) ip_fw_chain;
Define TRUE and FALSE.
1995-07-04 05:29:30 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
#ifdef SYSCTL_NODE
SYSCTL_NODE(net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
SYSCTL_INT(net_inet_ip_fw, OID_AUTO, debug, CTLFLAG_RW, &fw_debug, 0, "");
SYSCTL_INT(net_inet_ip_fw, OID_AUTO, verbose, CTLFLAG_RW, &fw_verbose, 0, "");
Define TRUE and FALSE.
1995-07-04 05:29:30 +00:00
#endif
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
#define dprintf(a) if (!fw_debug); else printf a
Fix -Wformat warnings from LINT kernel.
1995-05-11 19:26:53 +00:00
#define print_ip(a) printf("%ld.%ld.%ld.%ld",(ntohl(a.s_addr)>>24)&0xFF,\
(ntohl(a.s_addr)>>16)&0xFF,\
(ntohl(a.s_addr)>>8)&0xFF,\
(ntohl(a.s_addr))&0xFF);
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
#define dprint_ip(a) if (!fw_debug); else print_ip(a)
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
static int add_entry __P((struct ip_fw_head *chainptr, struct ip_fw *frwl));
static int del_entry __P((struct ip_fw_head *chainptr, struct ip_fw *frwl));
Completed function declarations and/or added prototypes.
1995-12-02 19:38:06 +00:00
static struct ip_fw *
check_ipfw_struct __P(( struct mbuf *m));
static int ipopts_match __P((struct ip *ip, struct ip_fw *f));
static int port_match __P((u_short *portptr, int nports, u_short port,
int range_flag));
static int tcpflg_match __P((struct tcphdr *tcp, struct ip_fw *f));
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
static void ipfw_report __P((char *txt, int rule, struct ip *ip));
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
static int (*old_chk_ptr)(struct mbuf *, struct ip *,struct ifnet *, int dir);
static int (*old_ctl_ptr)(int,struct mbuf **);
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
/*
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
* Returns 1 if the port is matched by the vector, 0 otherwise
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
*/
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static inline int
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
port_match(portptr, nports, port, range_flag)
u_short *portptr;
int nports;
u_short port;
int range_flag;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
{
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if (!nports)
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return 1;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if (range_flag) {
if (portptr[0] <= port && port <= portptr[1]) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return 1;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
nports -= 2;
portptr += 2;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
while (nports-- > 0) {
if (*portptr++ == port) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return 1;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return 0;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static int
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
tcpflg_match(tcp, f)
struct tcphdr *tcp;
struct ip_fw *f;
{
u_char flg_set, flg_clr;
flg_set = tcp->th_flags & f->fw_tcpf;
flg_clr = tcp->th_flags & f->fw_tcpnf;
if (flg_set != f->fw_tcpf)
return 0;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if (flg_clr)
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
return 0;
return 1;
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static int
Well..finally..this is the first part..it should take care of matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come...
1995-10-01 21:52:50 +00:00
ipopts_match(ip, f)
struct ip *ip;
struct ip_fw *f;
{
register u_char *cp;
int opt, optlen, cnt;
u_char opts, nopts, nopts_sve;
cp = (u_char *)(ip + 1);
cnt = (ip->ip_hl << 2) - sizeof (struct ip);
opts = f->fw_ipopt;
nopts = nopts_sve = f->fw_ipnopt;
Support all the tcpflag options in firewall. Add reading options from file, now ipfw <filename> will read commands string after string from file , form of strings same as command line interface.
1995-10-23 03:58:06 +00:00
Well..finally..this is the first part..it should take care of matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come...
1995-10-01 21:52:50 +00:00
for (; cnt > 0; cnt -= optlen, cp += optlen) {
opt = cp[IPOPT_OPTVAL];
if (opt == IPOPT_EOL)
break;
if (opt == IPOPT_NOP)
optlen = 1;
else {
optlen = cp[IPOPT_OLEN];
if (optlen <= 0 || optlen > cnt) {
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
return 0; /*XXX*/
Well..finally..this is the first part..it should take care of matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come...
1995-10-01 21:52:50 +00:00
}
}
switch (opt) {
default:
break;
case IPOPT_LSRR:
opts &= ~IP_FW_IPOPT_LSRR;
nopts &= ~IP_FW_IPOPT_LSRR;
break;
case IPOPT_SSRR:
opts &= ~IP_FW_IPOPT_SSRR;
nopts &= ~IP_FW_IPOPT_SSRR;
break;
case IPOPT_RR:
opts &= ~IP_FW_IPOPT_RR;
nopts &= ~IP_FW_IPOPT_RR;
break;
case IPOPT_TS:
opts &= ~IP_FW_IPOPT_TS;
nopts &= ~IP_FW_IPOPT_TS;
break;
}
if (opts == nopts)
break;
}
if (opts == 0 && nopts == nopts_sve)
return 1;
else
return 0;
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
static void
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
ipfw_report(char *txt, int rule, struct ip *ip)
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
{
struct tcphdr *tcp = (struct tcphdr *) ((u_long *) ip + ip->ip_hl);
struct udphdr *udp = (struct udphdr *) ((u_long *) ip + ip->ip_hl);
struct icmp *icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl);
if (!fw_verbose)
return;
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
printf("ipfw: %d %s ",rule, txt);
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
switch (ip->ip_p) {
case IPPROTO_TCP:
printf("TCP ");
print_ip(ip->ip_src);
printf(":%d ", ntohs(tcp->th_sport));
print_ip(ip->ip_dst);
printf(":%d", ntohs(tcp->th_dport));
break;
case IPPROTO_UDP:
printf("UDP ");
print_ip(ip->ip_src);
printf(":%d ", ntohs(udp->uh_sport));
print_ip(ip->ip_dst);
printf(":%d", ntohs(udp->uh_dport));
break;
case IPPROTO_ICMP:
printf("ICMP:%u ", icmp->icmp_type);
print_ip(ip->ip_src);
printf(" ");
print_ip(ip->ip_dst);
break;
default:
printf("P:%d ", ip->ip_p);
print_ip(ip->ip_src);
printf(" ");
print_ip(ip->ip_dst);
break;
}
if ((ip->ip_off & IP_OFFMASK))
printf(" Fragment = %d",ip->ip_off & IP_OFFMASK);
printf("\n");
}
Well..finally..this is the first part..it should take care of matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come...
1995-10-01 21:52:50 +00:00
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
/*
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
* Returns 1 if it should be accepted, 0 otherwise.
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
*/
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
int
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
ip_fw_chk(m, ip, rif, dir)
Fixed panic that occurs on certain firewall rejected packets that was caused by dtom() being used on an mbuf cluster. The fix involves passing around the mbuf pointer. Submitted by: Bill Fenner
1995-07-09 14:29:46 +00:00
struct mbuf *m;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct ip *ip;
struct ifnet *rif;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
int dir;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
{
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
struct ip_fw_chain *chain;
register struct ip_fw *f = NULL;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct tcphdr *tcp = (struct tcphdr *) ((u_long *) ip + ip->ip_hl);
struct udphdr *udp = (struct udphdr *) ((u_long *) ip + ip->ip_hl);
struct icmp *icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl);
struct ifaddr *ia = NULL, *ia_p;
struct in_addr src, dst, ia_i;
u_short src_port = 0, dst_port = 0;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
u_short f_prt = 0, prt, len = 0;
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
/*
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
* ... else if non-zero, highly unusual and interesting, but
* we're not going to pass it...
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
*/
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
if ((ip->ip_off & IP_OFFMASK) == 1) {
ipfw_report("Refuse", -1, ip);
m_freem(m);
return 0;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
src = ip->ip_src;
dst = ip->ip_dst;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
/*
* If we got interface from which packet came-store pointer to it's
* first adress
*/
if (rif != NULL)
ia = rif->if_addrlist;
Add match by interface from which packet arrived (via) Handle right fragmented packets. Remove checking option from kernel..
1994-12-12 17:20:55 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/*
* Determine the protocol and extract some useful stuff
*/
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
switch (ip->ip_p) {
case IPPROTO_TCP:
src_port = ntohs(tcp->th_sport);
dst_port = ntohs(tcp->th_dport);
prt = IP_FW_F_TCP;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
len = sizeof (*tcp);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
break;
case IPPROTO_UDP:
src_port = ntohs(udp->uh_sport);
dst_port = ntohs(udp->uh_dport);
prt = IP_FW_F_UDP;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
len = sizeof (*udp);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
break;
case IPPROTO_ICMP:
prt = IP_FW_F_ICMP;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
len = sizeof (*icmp);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
break;
default:
prt = IP_FW_F_ALL;
break;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
Allow "via" to be specified ever as IP adress or as interface name/unit...
1995-02-24 14:33:54 +00:00
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
/* XXX Check that we have sufficient header for TCP analysis */
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
/*
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
* Go down the chain, looking for enlightment
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
*/
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
for (chain=ip_fw_chain.lh_first; chain; chain = chain->chain.le_next) {
f = chain->rule;
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
/* Check direction inbound */
if (!dir && !(f->fw_flg & IP_FW_F_IN))
continue;
/* Check direction outbound */
if (dir && !(f->fw_flg & IP_FW_F_OUT))
continue;
/* Fragments */
if ((f->fw_flg & IP_FW_F_FRAG) && !(ip->ip_off & IP_OFFMASK))
continue;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If src-addr doesn't match, not this rule. */
if ((src.s_addr & f->fw_smsk.s_addr) != f->fw_src.s_addr)
continue;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If dest-addr doesn't match, not this rule. */
if ((dst.s_addr & f->fw_dmsk.s_addr) != f->fw_dst.s_addr)
continue;
Add match by interface from which packet arrived (via) Handle right fragmented packets. Remove checking option from kernel..
1994-12-12 17:20:55 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If a i/f name was specified, and we don't know */
if ((f->fw_flg & IP_FW_F_IFNAME) && !rif)
continue;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If a i/f name was specified, check it */
if ((f->fw_flg & IP_FW_F_IFNAME) && f->fw_via_name[0]) {
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* Not same unit, don't match */
if (rif->if_unit != f->fw_via_unit)
continue;
Added: ICMP reply,TCP SYN check,logging..
1994-11-28 12:35:14 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* Not same name */
if (strncmp(rif->if_name, f->fw_via_name, FW_IFNLEN))
continue;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Allow "via" to be specified ever as IP adress or as interface name/unit...
1995-02-24 14:33:54 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If a i/f addr was specified, check it */
Fix wrong logic, certain rules never matched.
1996-02-26 15:28:15 +00:00
if (!(f->fw_flg & IP_FW_F_IFNAME) && f->fw_via_ip.s_addr) {
I overlooked this one.
1996-02-23 20:11:37 +00:00
int match = 0;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
for (ia_p = ia; ia_p != NULL; ia_p = ia_p->ifa_next) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if ((ia_p->ifa_addr == NULL))
continue;
if (ia_p->ifa_addr->sa_family != AF_INET)
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
continue;
ia_i.s_addr =
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
((struct sockaddr_in *)
(ia_p->ifa_addr))->sin_addr.s_addr;
if (ia_i.s_addr != f->fw_via_ip.s_addr)
continue;
I overlooked this one.
1996-02-23 20:11:37 +00:00
match = 1;
break;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
I overlooked this one.
1996-02-23 20:11:37 +00:00
if (!match)
continue;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/*
* Check IP options
*/
if (f->fw_ipopt != f->fw_ipnopt)
if (!ipopts_match(ip, f))
continue;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
/*
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
* Check protocol
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
*/
f_prt = f->fw_flg & IP_FW_F_KIND;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If wildcard, match */
if (f_prt == IP_FW_F_ALL)
goto got_match;
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* If different, dont match */
if (prt != f_prt)
continue;
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* ICMP, done */
if (prt == IP_FW_F_ICMP)
goto got_match;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
/* Fragments can't match past this point */
if (ip->ip_off & IP_OFFMASK)
continue;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/* TCP, a little more checking */
if (prt == IP_FW_F_TCP &&
(f->fw_tcpf != f->fw_tcpnf) &&
(!tcpflg_match(tcp, f)))
continue;
if (!port_match(&f->fw_pts[0], f->fw_nsp,
src_port, f->fw_flg & IP_FW_F_SRNG))
continue;
if (!port_match(&f->fw_pts[f->fw_nsp], f->fw_ndp,
dst_port, f->fw_flg & IP_FW_F_DRNG))
continue;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
got_match:
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
f->fw_pcnt++;
f->fw_bcnt+=ip->ip_len;
if (f->fw_flg & IP_FW_F_PRN) {
if (f->fw_flg & IP_FW_F_ACCEPT)
ipfw_report("Accept", f->fw_number, ip);
else if (f->fw_flg & IP_FW_F_COUNT)
ipfw_report("Count", f->fw_number, ip);
else
ipfw_report("Deny", f->fw_number, ip);
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if (f->fw_flg & IP_FW_F_ACCEPT)
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
return 1;
if (f->fw_flg & IP_FW_F_COUNT)
continue;
break;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
}
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
/*
* Don't icmp outgoing packets at all
*/
if (f != NULL && !dir) {
/*
* Do not ICMP reply to icmp packets....:) or to packets
* rejected by entry without the special ICMP reply flag.
*/
if ((f_prt != IP_FW_F_ICMP) && (f->fw_flg & IP_FW_F_ICMPRPL)) {
if (f_prt == IP_FW_F_ALL)
icmp_error(m, ICMP_UNREACH,
ICMP_UNREACH_HOST, 0L, 0);
else
icmp_error(m, ICMP_UNREACH,
ICMP_UNREACH_PORT, 0L, 0);
return 0;
}
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
m_freem(m);
return 0;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
static int
add_entry(chainptr, frwl)
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
struct ip_fw_head *chainptr;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct ip_fw *frwl;
{
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
struct ip_fw *ftmp = 0;
struct ip_fw_chain *fwc = 0, *fcp, *fcpl = 0;
u_short nbr = 0;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
int s;
s = splnet();
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
fwc = malloc(sizeof *fwc, M_IPFW, M_DONTWAIT);
ftmp = malloc(sizeof *ftmp, M_IPFW, M_DONTWAIT);
if (!fwc || !ftmp) {
dprintf(("ip_fw_ctl: malloc said no\n"));
if (fwc) free(fwc, M_IPFW);
if (ftmp) free(ftmp, M_IPFW);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
splx(s);
return (ENOSPC);
}
bcopy(frwl, ftmp, sizeof(struct ip_fw));
ftmp->fw_pcnt = 0L;
ftmp->fw_bcnt = 0L;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
fwc->rule = ftmp;
if (!chainptr->lh_first) {
LIST_INSERT_HEAD(chainptr, fwc, chain);
} else if (ftmp->fw_number == (u_short)-1) {
if (fwc) free(fwc, M_IPFW);
if (ftmp) free(ftmp, M_IPFW);
splx(s);
return (EINVAL);
} else {
nbr=0;
for (fcp = chainptr->lh_first; fcp; fcp = fcp->chain.le_next)
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
if (fcp->rule->fw_number == (u_short)-1 ||
( ftmp->fw_number &&
fcp->rule->fw_number > ftmp->fw_number)) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if (!ftmp->fw_number)
ftmp->fw_number = nbr + 100;
if (fcpl) {
LIST_INSERT_AFTER(fcpl, fwc, chain);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
} else {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
LIST_INSERT_HEAD(chainptr, fwc, chain);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
break;
} else {
nbr=fcp->rule->fw_number;
fcpl = fcp;
Latest changes from Uben. Submitted by: uben
1994-10-31 23:58:04 +00:00
}
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
splx(s);
return (0);
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
static int
del_entry(chainptr, frwl)
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
struct ip_fw_head *chainptr;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct ip_fw *frwl;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
{
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
struct ip_fw_chain *fcp;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
int s;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
s = splnet();
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
fcp = chainptr->lh_first;
if (fcp->rule->fw_number == (u_short)-1)
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (EINVAL);
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
for (; fcp; fcp = fcp->chain.le_next) {
if (fcp->rule->fw_number == frwl->fw_number) {
LIST_REMOVE(fcp, chain);
splx(s);
free(fcp->rule, M_IPFW);
free(fcp, M_IPFW);
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
return 0;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
}
2 11th-hour fixes from Ugen (not Uben, sorry!) J.S.Antsilevich. I think it's time for Ugen to get a freefall account, just so I can direct mail at him directly and let him drop off patches for us here. Ugen? Done! Submitted by: ugen
1994-11-07 10:01:32 +00:00
splx(s);
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return (EINVAL);
Add clear one accounting entry control. Structure fields changed to seem more standart.
1994-12-13 15:57:34 +00:00
}
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static struct ip_fw *
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
check_ipfw_struct(m)
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct mbuf *m;
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
{
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
struct ip_fw *frwl;
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if (m->m_len != sizeof(struct ip_fw)) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: len=%d, want %d\n", m->m_len,
sizeof(struct ip_fw)));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
frwl = mtod(m, struct ip_fw *);
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if ((frwl->fw_flg & ~IP_FW_F_MASK) != 0) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: undefined flag bits set (flags=%x)\n",
frwl->fw_flg));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
The new firewall functionality: Filter on the direction (in/out). Filter on fragment/not fragment.
1996-02-24 00:17:35 +00:00
/* If neither In nor Out, then both */
if (!(frwl->fw_flg & (IP_FW_F_IN | IP_FW_F_OUT)))
frwl->fw_flg |= IP_FW_F_IN | IP_FW_F_OUT;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if ((frwl->fw_flg & IP_FW_F_SRNG) && frwl->fw_nsp < 2) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: src range set but n_src_p=%d\n",
frwl->fw_nsp));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
if ((frwl->fw_flg & IP_FW_F_DRNG) && frwl->fw_ndp < 2) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: dst range set but n_dst_p=%d\n",
frwl->fw_ndp));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
if (frwl->fw_nsp + frwl->fw_ndp > IP_FW_MAX_PORTS) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: too many ports (%d+%d)\n",
frwl->fw_nsp, frwl->fw_ndp));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
#if 0
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if ((frwl->fw_flg & IP_FW_F_KIND) == IP_FW_F_ICMP) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: request for unsupported ICMP frwling\n"));
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (NULL);
}
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
#endif
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return frwl;
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
int
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
ip_fw_ctl(stage, mm)
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
int stage;
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
struct mbuf **mm;
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
{
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
int error;
struct mbuf *m;
if (stage == IP_FW_GET) {
struct ip_fw_chain *fcp = ip_fw_chain.lh_first;
*mm = m = m_get(M_WAIT, MT_SOOPTS);
for (; fcp; fcp = fcp->chain.le_next) {
memcpy(m->m_data, fcp->rule, sizeof *(fcp->rule));
m->m_len = sizeof *(fcp->rule);
m->m_next = m_get(M_WAIT, MT_SOOPTS);
m = m->m_next;
m->m_len = 0;
}
return (0);
}
m = *mm;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
if (stage == IP_FW_FLUSH) {
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
while (ip_fw_chain.lh_first != NULL &&
ip_fw_chain.lh_first->rule->fw_number != (u_short)-1) {
struct ip_fw_chain *fcp = ip_fw_chain.lh_first;
LIST_REMOVE(ip_fw_chain.lh_first, chain);
free(fcp->rule, M_IPFW);
free(fcp, M_IPFW);
}
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
if (m) (void)m_free(m);
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
return (0);
}
if (stage == IP_FW_ZERO) {
struct ip_fw_chain *fcp;
for (fcp = ip_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next)
fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0;
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
if (m) (void)m_free(m);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (0);
}
if (m == NULL) {
printf("ip_fw_ctl: NULL mbuf ptr\n");
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
return (EINVAL);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if (stage == IP_FW_ADD || stage == IP_FW_DEL) {
struct ip_fw *frwl = check_ipfw_struct(m);
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
if (!frwl) {
if (m) (void)m_free(m);
Ugen J.S.Antsilevich's latest, happiest, IP firewall code. Poul: Please take this into BETA. It's non-intrusive, and a rather substantial improvement over what was there before.
1994-11-16 10:17:11 +00:00
return (EINVAL);
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
}
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
if (stage == IP_FW_ADD)
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
error = add_entry(&ip_fw_chain, frwl);
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
else
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
error = del_entry(&ip_fw_chain, frwl);
if (m) (void)m_free(m);
return error;
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
dprintf(("ip_fw_ctl: unknown request %d\n", stage));
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
if (m) (void)m_free(m);
This is the end result of about a dozen passes through this code to fix incorrect indents, a variety of poor coding practices such as comparing pointers to constants ('0'), poor code structuring, etc, etc. This brings the code up to the minimum standards for inclusion in FreeBSD.
1995-07-04 05:39:03 +00:00
return (EINVAL);
IP Firewall code from Daniel Boulet and J.S.Antsilevich Submitted by: danny ugen
1994-10-28 15:09:49 +00:00
}
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
void
ip_fw_init(void)
{
struct ip_fw deny;
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
ip_fw_chk_ptr = ip_fw_chk;
ip_fw_ctl_ptr = ip_fw_ctl;
Big sweep over the IPFIREWALL and IPACCT code. Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same.
1996-02-23 15:47:58 +00:00
LIST_INIT(&ip_fw_chain);
bzero(&deny, sizeof deny);
deny.fw_flg = IP_FW_F_ALL;
deny.fw_number = (u_short)-1;
add_entry(&ip_fw_chain, &deny);
printf("IP firewall initialized\n");
}
Make getsockopt() capable of handling more than one mbuf worth of data. Use this to read rules out of ipfw. Add the lkm code to ipfw.c
1996-02-24 13:38:28 +00:00
#ifdef ACTUALLY_LKM_NOT_KERNEL
#include <sys/exec.h>
#include <sys/sysent.h>
#include <sys/lkm.h>
MOD_MISC(ipfw);
static int
ipfw_load(struct lkm_table *lkmtp, int cmd)
{
int s=splnet();
struct ip_fw deny;
old_chk_ptr = ip_fw_chk_ptr;
old_ctl_ptr = ip_fw_ctl_ptr;
ip_fw_chk_ptr = ip_fw_chk;
ip_fw_ctl_ptr = ip_fw_ctl;
LIST_INIT(&ip_fw_chain);
bzero(&deny, sizeof deny);
deny.fw_flg = IP_FW_F_ALL;
deny.fw_number = (u_short)-1;
add_entry(&ip_fw_chain, &deny);
splx(s);
printf("IP firewall loaded\n");
return 0;
}
static int
ipfw_unload(struct lkm_table *lkmtp, int cmd)
{
int s=splnet();
ip_fw_chk_ptr = old_chk_ptr;
ip_fw_ctl_ptr = old_ctl_ptr;
while (ip_fw_chain.lh_first != NULL) {
struct ip_fw_chain *fcp = ip_fw_chain.lh_first;
LIST_REMOVE(ip_fw_chain.lh_first, chain);
free(fcp->rule, M_IPFW);
free(fcp, M_IPFW);
}
splx(s);
printf("IP firewall unloaded\n");
return 0;
}
int
ipfw_mod(struct lkm_table *lkmtp, int cmd, int ver)
{
DISPATCH(lkmtp, cmd, ver, ipfw_load, ipfw_unload, lkm_nullcmd);
}
#endif
Reference in New Issue Copy Permalink