Commit Graph

67 Commits

Author SHA1 Message Date
imp
167db52912 compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.
1997-03-29 03:33:12 +00:00
bde
20c91658b4 Force null termination after 2 errant strncpy()s. 1997-03-05 12:08:44 +00:00
peter
4968036f61 Revert $FreeBSD$ to $Id$ 1997-02-22 14:40:44 +00:00
danny
9da4914e72 Add '-q' quiet flag for flush/add/zero commands; add 'show' command as
synonym for '-a list'; stop SEGV when specifying 'via' with no interface;
change 2 instances of strcpy() to strncpy().

This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
jkh
6c16e85bae Adjust spelling of `fw_flg' so this thing compiles again. 1997-01-17 07:01:21 +00:00
adam
752ba4d26f implement "not" keyword for inverting the address logic 1997-01-16 21:04:29 +00:00
jkh
808a36ef65 Make the long-awaited change from $Id$ to $FreeBSD$
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore.  This update would have been
insane otherwise.
1997-01-14 07:20:47 +00:00
mpp
853fbca176 Minor mdoc/style fixes. 1996-12-23 02:03:15 +00:00
wollman
d3ecee07b3 Fix up programs which expect <net/if.h> to include <sys/time.h> to instead
do it themselves.  (Some of these programs actually depended on this
beyond compiling the definition of struct ifinfo!)  Also fix up some
other #include messes while we're at it.
1996-12-10 17:11:53 +00:00
jdp
babb356b2c Fix a spelling error.
2.2 Candidate.
1996-11-05 22:27:33 +00:00
alex
9b6c3e888d Issue a warning if the user specifies an invalid interface in a rule.
The rule is still added to the chain since the interface may get
created later on after loading an LKM.
1996-10-17 01:05:03 +00:00
alex
51148e7d1f Note that -N is only effective when ipfw is displaying chain entries. 1996-09-15 00:08:30 +00:00
nate
927b7037cd Because 'ipfw flush' is such a dangerous command (given that most
firewalls are remote, and this command will kill the network connection
to them), prompt the user for confirmation of this command.

Also, add the '-f' flag which ignores the need for confirmation the
command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0)
assume '-f'.

If anyone is using ipfw flush in scripts it shouldn't affect them, but you
may want to change the script to use a 'ipfw -f flush'.

Reviewed by:	alex
1996-08-31 17:58:23 +00:00
mpp
b4aab8b6f6 Use the .Fx macro where appropriate. 1996-08-23 00:57:08 +00:00
pst
ec444da95f Completely rewrite handling of protocol field for firewalls, things are
now completely consistent across all IP protocols and should be quite a
bit faster.

Use getprotoname() extensively, performed minor cleanups of admin utility.
The admin utility could use a good kick in the pants.

Basicly, these were the minimal changes I could make to the code
to get it up to tollerable shape.  There will be some future commits
to clean up the basic architecture of the firewall code, and if
I'm feeling ambitious, I may pull in changes like NAT from Linux
and make the firewall hooks comletely generic so that a user can
either load the ipfw module or the ipfilter module (cf Darren Reed).

Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
pst
bb31080cd1 Fix tcp/udp port ranges 1996-08-13 00:41:05 +00:00
alex
98e74c519a Filter by IP protocol.
Submitted by: fenner (with modifications by me)

Bring in the interface unit wildcard flag fix from rev 1.15.4.8.
1996-08-05 02:38:51 +00:00
julian
9277e63302 Adding changes to ipfw and the kernel to support ip packet diversion..
This stuff should not be too destructive if the IPDIVERT is not compiled in..
 be aware that this changes the size of the ip_fw struct
so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
alex
911873413d Correct definition of 'established' keyword. 1996-07-02 00:29:22 +00:00
alex
edea64b844 Formatting fixes for 'in' and 'out' while listing.
Prevent ALL protocol from being used with port specifications.

Allow 'via' keyword at any point in the options list.  Disallow
multiple 'via' specifications.
1996-06-29 01:28:19 +00:00
alex
153deea5fa Fix port specification syntax.
Submitted by:	nate
1996-06-29 01:21:07 +00:00
alex
3a18399d4f Fix address mask calculation when using ':' syntax. Allow a mask
of /0 to have the desired effect.  Normalize IP addresses that
won't match a given mask (i.e. 1.2.3.4/24 becomes 1.2.3.0/24).
Submitted by R. Bezuidenhout <rbezuide@mikom.csir.co.za>

Code formatting and "frag" display fixes.
1996-06-23 20:47:51 +00:00
alex
26ad2004f9 Set the program name before trying to use it.
Found by: Aage Robekk <aagero@aage.priv.no>
1996-06-18 01:46:34 +00:00
alex
46fc3f9b35 Fix a typo in the view accounting records example. 1996-06-15 23:01:44 +00:00
alex
595f5f5875 Bring the man page more into line with reality. 1996-06-15 01:38:51 +00:00
alex
9a01ae8a2a Big sweep over ipfw, picking up where Poul left off:
- Filter based on ICMP types.
  - Accept interface wildcards (e.g. ppp*).
  - Resolve service names with the -N option.
  - Accept host names in 'from' and 'to' specifications
  - Display chain entry time stamps with the -t option.
  - Added URG to tcpflags.
  - Print usage if an unknown tcpflag is used.
  - Ability to zero individual accounting entries.
  - Clarify usage of port ranges.
  - Misc code cleanup.

Closes PRs: 1193, 1220, and 1266.
1996-06-09 23:46:22 +00:00
phk
453e44c083 Some cosmetics and some better error-checking.
Reviewed by:	phk
Submitted by:	"Daniel O'Callaghan" <danny@panda.hilink.com.au>
Submitted by:	Archie Cobbs <archie@whistle.com>
1996-05-11 20:31:55 +00:00
phk
1ed2b37fd0 recognize "allow", "accept" and "pass"
add new feature for "established"
1996-04-03 13:49:10 +00:00
phk
e9ce06f14d A couple of bug-fixes.
Reviewed by:	phk
Submitted by:	"Frank ten Wolde" <franky@pinewood.nl>
1996-04-02 11:43:28 +00:00
phk
bd3794521a Update to match kernel code. 1996-02-24 13:39:46 +00:00
phk
4bcbc91c0c A new ipfw program that can set and control the new features.
An almost correct usage is printed.
1996-02-24 00:20:56 +00:00
phk
d2379a0d6e Update -current ipfw program as well.
I hope it all compiles...
1996-02-23 15:52:28 +00:00
phk
028a23209c Document that the firewall will no longer reorder the rules. 1996-02-13 15:20:20 +00:00
mpp
0d925cfda3 Fix a bunch of spelling errors. 1996-01-29 23:52:43 +00:00
peter
c3f352d4ad This commit was generated by cvs2svn to compensate for changes in r13122,
which included commits to RCS files with non-trunk default branches.
1995-12-30 19:02:48 +00:00
peter
ab124e78b0 recording cvs-1.6 file death 1995-12-30 19:02:48 +00:00
nate
6123290e32 Convert manpage to -mandoc macros.
Submitted by:	Gary Palmer <gary@palmer.demon.co.uk>

Minor cleanup by me in the English.
1995-10-26 05:36:24 +00:00
ugen
1074db22b1 Support all the tcpflag options in firewall.
Add reading options from file, now ipfw <filename> will
read commands string after string from file , form of strings
same as command line interface.
1995-10-23 03:58:06 +00:00
ugen
9c1ca355a5 Support IP Option smatching in grammar and listing.
TcpSyn option removed and will be shortly repoaced by support of all
TCP Flags including syn and ack...
1995-10-01 21:54:05 +00:00
gpalmer
41fc38f808 Correct minor nit - to filter out SYN packets, the keyword is
`syn' not `tcpsyn' (which matches `tcp' which blocks all tcp
packets)
1995-08-31 21:12:05 +00:00
gpalmer
f4d751c609 Add $Id$ 1995-08-22 00:38:02 +00:00
rgrimes
f3a2b348da Remove trailing whitespace. 1995-05-30 06:12:45 +00:00
ugen
9c02dc08f0 make pass work also as the first keyword
(while addf skipped)
Reviewed by:
Submitted by:
Obtained from:
1995-03-30 12:18:10 +00:00
ugen
9448c15a5d Update manpage..BTW,if somebody wit good English
would go through it and fix it would be a really good idea.
1995-03-03 12:59:47 +00:00
ugen
08f16d8685 Oops..remove some debugging leftover.. 1995-03-03 12:47:23 +00:00
ugen
eae8a60e05 Ok..so everybody picking on me that ipfw syntacs
is a pain in ...wel.. trying to fix this
 * from/to/via position indepenndant syntax
 * "any" for 0/0 host address
 * addf/addb default keyword in case you skip it..
 * pass = accept new action, seems to be somewhat better
   in particular cases
 * on = via (as on ed0 instead of via ed0,loook at
   reject tcp on ed0 from hacker )
1995-03-03 12:28:34 +00:00
ugen
9c085a7dcf Fixed manpage..ldeny,lreject and log options are there
and others not..
Submitted by:	torstenb@FreeBSD.ORG
1995-02-27 10:52:22 +00:00
ugen
710cfa1891 Change utility to accept interface name
along with IP as "via" argument
1995-02-24 14:32:45 +00:00
jkh
bf0d9579bb ipfirewall.4 is obviously not here anymore! Adjust the Makefile. 1995-02-18 16:36:23 +00:00
ugen
825b23f4ea Finally document "via" feature.. 1995-02-17 15:44:08 +00:00