Fixed the following bugs:
- the buffer was reprinted endlessly when msg.bufx == 0 and (for a
different reason) when msg.bufx == 1.
- the last byte of the buffer wasn't printed except in the the infinite
loop cases.
- the comment about walking the buffer didn't match the (correct) code.
- minor -Wall and style bugs.
Not fixed:
- excessive newline processing which hid the non-printing of the last
byte of the buffer.
for gcc >= 2.5 and no-ops for gcc >= 2.6. Converted to use __dead2
or __pure2 where it wasn't already done, except in math.h where use
of __pure was mostly wrong.
it stopped us from removing or setting loopback address
on lo0:
also make use of the fact the athe sockaddre_at struct now has a "netrange"
field.
CVS ----------------------------------------------------------------------
the file access time update on reads and can be useful in reducing
filesystem overhead in cases where the access time is not important (like
Usenet news spools).
firewalls are remote, and this command will kill the network connection
to them), prompt the user for confirmation of this command.
Also, add the '-f' flag which ignores the need for confirmation the
command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0)
assume '-f'.
If anyone is using ipfw flush in scripts it shouldn't affect them, but you
may want to change the script to use a 'ipfw -f flush'.
Reviewed by: alex
hostname/IP twice on same line in /etc/exports' fix from dumping core
due to bogus /etc/exports entries.
Submitted by: Toshihiro Kanda <candy@fct.kgc.co.jp>
Turn this behavior off using '-Q'. This makes '-v' useless other than as
an ICMP-sniffer, which tcpdump is better at anyway.
Print out another couple of ICMP messages, and fix the printing of the
original packet (mostly byte order problems).
now completely consistent across all IP protocols and should be quite a
bit faster.
Use getprotoname() extensively, performed minor cleanups of admin utility.
The admin utility could use a good kick in the pants.
Basicly, these were the minimal changes I could make to the code
to get it up to tollerable shape. There will be some future commits
to clean up the basic architecture of the firewall code, and if
I'm feeling ambitious, I may pull in changes like NAT from Linux
and make the firewall hooks comletely generic so that a user can
either load the ipfw module or the ipfilter module (cf Darren Reed).
Discussed with: fenner & alex
Submitted by: archie@whistle.com
This patch allows true interface routing to be controlled
from the command line..
you can now do:
route add default -interface ppp0
even if you have no clue what the address at the other end is..
this is part of a set of changes that allow true "unnumbered links"
such as netcom run between their sites..
In practice you should assign the address from one of your ethernet
interfaces to the local side of the P2P link so that IP doesn't
say that the packet comes from 255.255.255.255, but
there is no need whatsoever to assign an address of any kind
to the remote end of the link.. useful for frame relay links etc also.
Note, this is not really a security risk, because the buffer in question
is a static variable in the data segment and not on the stack, and hence
cannot subert the flow of execution in any way. About the worst case was
that if you pinged a long hostname, ping could coredump.
Pointed out on: bugtraq (listserv@netspace.org)
the obsolete() function to convert dump-style args to getopt-style
args doesn't check to see that 'f' really has an argument following
the option string in argv[1].
Submitted-By: jmacd
