FreeBSD source tree https://cgit-dev.freebsd.org/src-test2/atom?h=release%2F5.1.0_cvs 2003-06-04T16:00:27Z 2003-06-04T16:00:27Z cvs2svn cvs2svn@FreeBSD.org 2003-06-04T16:00:27Z urn:sha1:1c0442969cd576514acfce932c0a0798593c7af7 'RELENG_5_1_0_RELEASE'. This commit was manufactured to restore the state of the 5.1-RELEASE image. Releases prior to 5.3-RELEASE are omitting the secure/ and crypto/ subdirs. 2003-04-20T18:38:59Z David E. O'Brien obrien@FreeBSD.org 2003-04-20T18:38:59Z urn:sha1:bfd738788bb9691c3caa1551e5f75248add9e434 2003-01-01T18:49:04Z Jens Schweikhardt schweikh@FreeBSD.org 2003-01-01T18:49:04Z urn:sha1:9d5abbddbf03791c777fed86500976ea3dd19245 especially in troff files. 2002-09-28T00:25:32Z Peter Wemm peter@FreeBSD.org 2002-09-28T00:25:32Z urn:sha1:224af215a6fe8d5e5e2c91cc97c48bdd67c991c7 2002-07-23T00:16:19Z Ruslan Ermilov ru@FreeBSD.org 2002-07-23T00:16:19Z urn:sha1:61a875d706aa6542436c2b262b873763d3dbc5a9 IP datagram embedded into ICMP error message. Spotted by: tcpdump 3.7.1 (-vvv) MFC after: 3 days 2002-07-18T05:18:41Z Luigi Rizzo luigi@FreeBSD.org 2002-07-18T05:18:41Z urn:sha1:90780c4b05797fbae755c68f9027162d9d684e9d Make indentation of new parts consistent with the style used for this file. 2002-07-08T22:57:35Z Luigi Rizzo luigi@FreeBSD.org 2002-07-08T22:57:35Z urn:sha1:b3063f064c9d76bde782bb8a603d2d73c9323641 no punch_fw was used. Fix another couple of bugs which prevented rules from being installed properly. On passing, use IPFW2 instead of NEW_IPFW to compile the new code, and slightly simplify the instruction generation code. 2002-07-01T11:19:40Z Brian Somers brian@FreeBSD.org 2002-07-01T11:19:40Z urn:sha1:27cc91fbf84cc6c1cef81df859125f42292a2b69 2002-06-27T23:02:18Z Luigi Rizzo luigi@FreeBSD.org 2002-06-27T23:02:18Z urn:sha1:9758b77ff1a539a7f4abaf2cd9768fcbfb50bca4 This code makes use of variable-size kernel representation of rules (exactly the same concept of BPF instructions, as used in the BSDI's firewall), which makes firewall operation a lot faster, and the code more readable and easier to extend and debug. The interface with the rest of the system is unchanged, as witnessed by this commit. The only extra kernel files that I am touching are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In userland I only had to touch those programs which manipulate the internal representation of firewall rules). The code is almost entirely new (and I believe I have written the vast majority of those sections which were taken from the former ip_fw.c), so rather than modifying the old ip_fw.c I decided to create a new file, sys/netinet/ip_fw2.c . Same for the user interface, which is in sbin/ipfw/ipfw2.c (it still compiles to /sbin/ipfw). The old files are still there, and will be removed in due time. I have not renamed the header file because it would have required touching a one-line change to a number of kernel files. In terms of user interface, the new "ipfw" is supposed to accepts the old syntax for ipfw rules (and produce the same output with "ipfw show". Only a couple of the old options (out of some 30 of them) has not been implemented, but they will be soon. On the other hand, the new code has some very powerful extensions. First, you can put "or" connectives between match fields (and soon also between options), and write things like ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any This should make rulesets slightly more compact (and lines longer!), by condensing 2 or more of the old rules into single ones. Also, as an example of how easy the rules can be extended, I have implemented an 'address set' match pattern, where you can specify an IP address in a format like this: 10.20.30.0/26{18,44,33,22,9} which will match the set of hosts listed in braces belonging to the subnet 10.20.30.0/26 . The match is done using a bitmap, so it is essentially a constant time operation requiring a handful of CPU instructions (and a very small amount of memmory -- for a full /24 subnet, the instruction only consumes 40 bytes). Again, in this commit I have focused on functionality and tried to minimize changes to the other parts of the system. Some performance improvement can be achieved with minor changes to the interface of ip_fw_chk_t. This will be done later when this code is settled. The code is meant to compile unmodified on RELENG_4 (once the PACKET_TAG_* changes have been merged), for this reason you will see #ifdef __FreeBSD_version in a couple of places. This should minimize errors when (hopefully soon) it will be time to do the MFC. 2002-05-30T20:53:45Z Garrett Wollman wollman@FreeBSD.org 2002-05-30T20:53:45Z urn:sha1:c7c5d95d56c455a19bc97e739de7920b5eaad08e