aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet/ip_fw.h
Commit message (Collapse)AuthorAgeFilesLines
* The purpose of this commit is to bring the net/ and netinet/ sourcesLuigi Rizzo2002-07-091-3/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | more in sync with what is in -current, so that mainteinance and bugfix of the two trees is not a nightmare. THERE IS NO FUNCTIONAL OR EXTERNAL API CHANGE IN THIS COMMIT You should not need to recompile any userland code. In (some) more detail, this commit does the following: * remove a number of static variables from the ip stack that were used to support DIVERT, IPFIREWALL_FORWARD and stateful rules/ dynamic pipes. These are replaced with packet annotations, much in the same (ugly for someone, but it is extremely fast and easy to extend) way used for ages to support dummynet annotations. On passing, fix a bug in the handling of divert for fragmented packets. * as part of the removal of static variables, change the (internal) interface of ip_fw_chk() to use a single structure to hold arguments. Adapt clients of the above (ip_input, ip_output, bridge, ether_output, ether_demux) to use the new interface. * remove some unused variables. * remove some of the __P() macros from some of the files involved Because of the NO FUNCTIONAL CHANGE you don't get the following features which are in -current: * ipfw on layer-2 packets. All the hooks and the code are there, but the controlling variable net.link.ether.ipfw: 0 is readonly because i am only 99% confident on how the old ipfw handles these frames. Just edit if_ethersubr.c to make the variable RW if you want this feature. I might commit this in due time if there is interest. these frames. Just edit if_ethersubr.c to make it RW if you want this feature. I might commit this in due time if there is interest. * ipfw2, the new, faster and more flexible firewall code. The code has hooks to make use of ipfw2, and I will make patches available to use it (it is basically 3 files, netinet/ip_fw2.[ch], sbin/ipfw/ipfw2.c, plus one-line changes in conf/options, conf/files and sbin/ipfw/Makefile, plus libalias patches). Notes: svn path=/stable/4/; revision=99646
* Mega-MFC for ipfw/bridge/dummynet features and fixes added over theLuigi Rizzo2001-11-031-34/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | past couple of months: * merge of ipfw rule descriptor and chain pointer. No functional change, but the internal data structures and code are way more readable; * BillF code to make ipfw/dummynet/bridge KLD'able. NOTA BENE: this still has some rough edges, which are mostly due to bugs in kldload() rather than in this code. * add a new type of dynamic rule that lets you limit the number of simultaneous connections matching certain criteria (with the usual aggregation based on port/address masks) * fix spl*() protection in same parts of the code; This code also includes some minor bugfixes and code cleanup that I will port to CURRENT as soon as i have a chance. I have tested the code as much as i could, but there is really a million combinations so I might have missed some corner case. Please report if you have problem building things. The only thing known not to work is bridge.ko -- it does forward correctly, but packets directed to the bridge itself are only received from one interface (i suspect some missing initialization), and there are some other issues at unloading time. Please use the statically compiled code for the time being. NOTE ON KLD: It appears that kldload/unload is unable to handle the case of (erroneously) loading/unloading a module which is already compiled in. What happens is that load fails, but the module is listed as loaded, and then the system panics if you attempt an unloading of the module. This problem need fixing in the module loading/unloading code, which is not in my area of competence. Notes: svn path=/stable/4/; revision=85927
* MFC: Sync the formatting of this file with -current.Josef Karthauser2001-10-291-149/+156
| | | | | | | (No functionality changes). Notes: svn path=/stable/4/; revision=85688
* MFC: The ipfw src/dst "me" keyword support.Poul-Henning Kamp2001-02-201-1/+4
| | | | Notes: svn path=/stable/4/; revision=72767
* Convert to the use of <sys/queue.h> macros.Luigi Rizzo2001-02-091-2/+2
| | | | | | | | | | | | In the process, change a couple of variable and field names so we do not use the same exact name for types, variable and fields and hopefully can understand which is which. On passing, simplify the logic in a few places. This commit has no functional changes. Notes: svn path=/stable/4/; revision=72266
* Another sweep at the bridge/ipfw/dummynet code, thanks to the bugLuigi Rizzo2001-02-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reports received over the last days. Among other things, this commit should avoid some of the problems with ARP replies being copied to the wrong interface. In detail (and modulo errors) bridge.c: + comment out some verbose debugging messages; + improve handling of configurations with multiple interface clusters. Do not permit leaks of packets from one cluster to another. + simplify the structure of bdg_forward() net/if_ethersubr.c: + minor simplifications related to the change of interface in bdg_forward(); netinet/if_ether.c + minor simplifications in the arp error handling code. netinet/ip_fw.c netinet/ip_fw.h + #define and use a symbolic constant for the return value from ip_fw_chk netinet/ip_input.c netinet/ip_output.c + same as above, plus improve error handling in case the firewall decides to change the mbuf pointer. Notes: svn path=/stable/4/; revision=72116
* o MFC of ECN flag handling fixes in IPFW, respectively:Robert Watson2001-01-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revision Changes Path 1.98 +3 -4 src/sbin/ipfw/ipfw.c 1.151 +14 -6 src/sys/netinet/ip_fw.c 1.54 +3 -3 src/sys/netinet/ip_fw.h Prior commit message: o IPFW incorrectly handled filtering in the presence of previously reserved and now allocated TCP flags in incoming packets. This patch stops overloading those bits in the IP firewall rules, and moves colliding flags to a seperate field, ipflg. The IPFW userland management tool, ipfw(8), is updated to reflect this change. New TCP flags related to ECN are now included in tcp.h for reference, although we don't currently implement TCP+ECN. o To use this fix without completely rebuilding, it is sufficient to copy ip_fw.h and tcp.h into your appropriate include directory, then rebuild the ipfw kernel module, and ipfw tool, and install both. Note that a mismatch between module and userland tool will result in incorrect installation of firewall rules that may have unexpected effects. This bug does not appear to affect ipfilter. Reviewed by: security-officer, billf, jedgar Reported by: Aragon Gouveia <aragon@phat.za.net> Notes: svn path=/stable/4/; revision=70860
* o Backport the fw_ipflg ipfw rule flag from -CURRENT so that it isRobert Watson2001-01-091-0/+5
| | | | | | | | | | | | | available for the recently committed TCP flags fix. I have only backported the variable, and not all of the current use in -CURRENT, so that will need to be seperately MFC'd, if desirable. o This change modifies the ipfw configuration ABI meaning that you need to keep your userland ip_fw.h, ipfw tool, and kernel code in synch. Notes: svn path=/stable/4/; revision=70850
* MFC: remove obsolete comment.Archie Cobbs2000-08-221-1/+0
| | | | Notes: svn path=/stable/4/; revision=64903
* MFCBill Fumerola2000-07-281-1/+11
| | | | | | | | | | | | | | ipfw.c: r1.84,1.88: tcpoptions support (dan, ras@e-gerbil.net) r1.86: reorder output of 'prob' to match the input method (billf) ip_fw.c: r1.138: tcpoptions support (dan, ras@e-gerbil.net) ip_fw.h: r1.50(partial): complete WF2Q+ merge, comment only (luigi) r1.51: tcpoptions support (dan, ras@e-gerbil.net) Notes: svn path=/stable/4/; revision=63984
* MFC: Bring WF2Q+ support in dummynet. Read the ipfw(8) manpage forLuigi Rizzo2000-06-111-1/+2
| | | | | | | | documentation. Except for recompiling ipfw, old ipfw configurations involving dummynet pipes work unmodified. Notes: svn path=/stable/4/; revision=61561
* Support for stateful (dynamic) ipfw rules. They are veryLuigi Rizzo2000-02-101-4/+35
| | | | | | | | | | | similar to ipfilter's keep-state. Look at the updated ipfw(8) manpage for details. Approved-by: jordan Notes: svn path=/head/; revision=57113
* Add ipfw hooks for the new dummynet features.Luigi Rizzo2000-01-081-1/+4
| | | | | | | | | | Support masks on TCP/UDP ports. Minor cleanup of ip_fw_chk() to avoid repeated calls to PULLUP_TO at each rule. Notes: svn path=/head/; revision=55599
* Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL"Peter Wemm1999-12-291-2/+2
| | | | | | | | | is an application space macro and the applications are supposed to be free to use it as they please (but cannot). This is consistant with the other BSD's who made this change quite some time ago. More commits to come. Notes: svn path=/head/; revision=55205
* Miscellaneous fixes/cleanups relating to ipfw and divert(4):Archie Cobbs1999-12-061-0/+3
| | | | | | | | | | | | | | | | - Implement 'ipfw tee' (finally) - Divert packets by calling new function divert_packet() directly instead of going through protosw[]. - Replace kludgey global variable 'ip_divert_port' with a function parameter to divert_packet() - Replace kludgey global variable 'frag_divert_port' with a function parameter to ip_reass() - style(9) fixes Reviewed by: julian, green Notes: svn path=/head/; revision=54175
* $Id$ -> $FreeBSD$Peter Wemm1999-08-281-1/+1
| | | | Notes: svn path=/head/; revision=50477
* Correction: uid -> gid (comment)Brian Feldman1999-08-271-2/+2
| | | | Notes: svn path=/head/; revision=50474
* Implement probabilistic rule match in ipfw. Each rule can be associatedLuigi Rizzo1999-08-111-2/+20
| | | | | | | | | | | | | | | | | | | | | | | | with a match probability to achieve non-deterministic behaviour of the firewall. This can be extremely useful for testing purposes such as simulating random packet drop without having to use dummynet (which already does the same thing), and simulating multipath effects and the associated out-of-order delivery (this time in conjunction with dummynet). The overhead on normal rules is just one comparison with 0. Since it would have been trivial to implement this by just adding a field to the ip_fw structure, I decided to do it in a backward-compatible way (i.e. struct ip_fw is unchanged, and as a consequence you don't need to recompile ipfw if you don't want to use this feature), since this was also useful for -STABLE. When, at some point, someone decides to change struct ip_fw, please add a length field and a version number at the beginning, so userland apps can keep working even if they are out of sync with the kernel. Notes: svn path=/head/; revision=49630
* Make ipfw's logging more dynamic. Now, log will use the default limitBrian Feldman1999-08-011-1/+3
| | | | | | | | | | | | | | | | _or_ you may specify "log logamount number" to set logging specifically the rule. In addition, "ipfw resetlog" has been added, which will reset the logging counters on any/all rule(s). ipfw resetlog does not affect the packet/byte counters (as ipfw reset does), and is the only "set" command that can be run at securelevel >= 3. This should address complaints about not being able to set logging amounts, not being able to restart logging at a high securelevel, and not being able to just reset logging without resetting all of the counters in a rule. Notes: svn path=/head/; revision=49350
* Correct a really gross comment format.Brian Feldman1999-07-281-5/+7
| | | | Notes: svn path=/head/; revision=49193
* This is the much-awaited cleaned up version of IPFW [ug]id support.Brian Feldman1999-06-191-2/+8
| | | | | | | All relevant changes have been made (including ipfw.8). Notes: svn path=/head/; revision=48023
* Tidy up some stray / unused stuff in the IPFW package and friends.Peter Wemm1999-04-201-9/+1
| | | | | | | | | | | - unifdef -DCOMPAT_IPFW (this was on by default already) - remove traces of in-kernel ip_nat package, it was never committed. - Make IPFW and DUMMYNET initialize themselves rather than depend on compiled-in hooks in ip_init(). This means they initialize the same way both in-kernel and as kld modules. (IPFW initializes now :-) Notes: svn path=/head/; revision=45869
* Last bits (i think) of dummynet for -current.Luigi Rizzo1998-12-141-3/+8
| | | | Notes: svn path=/head/; revision=41793
* Widen and change the layout of the IPFW structures flag element.Poul-Henning Kamp1998-09-021-29/+29
| | | | | | | | | This will allow us to add dummynet to 3.0 Recompile /sbin/ipfw AND your kernel. Notes: svn path=/head/; revision=38760
* Yow! Completely change the way socket options are handled, eliminatingGarrett Wollman1998-08-231-1/+18
| | | | | | | | | another specialized mbuf type in the process. Also clean up some of the cruft surrounding IPFW, multicast routing, RSVP, and other ill-explored corners. Notes: svn path=/head/; revision=38482
* Support for IPFW based transparent forwarding.Julian Elischer1998-07-061-1/+4
| | | | | | | | | | | | | | | | | Any packet that can be matched by a ipfw rule can be redirected transparently to another port or machine. Redirection to another port mostly makes sense with tcp, where a session can be set up between a proxy and an unsuspecting client. Redirection to another machine requires that the other machine also be expecting to receive the forwarded packets, as their headers will not have been modified. /sbin/ipfw must be recompiled!!! Reviewed by: Peter Wemm <peter@freebsd.org> Submitted by: Chrisy Luke <chrisy@flix.net> Notes: svn path=/head/; revision=37409
* Added #include of <sys/queue.h> so that this file is more "self"-sufficent.Bruce Evans1998-02-031-1/+3
| | | | Notes: svn path=/head/; revision=33058
* Bump up packet and byte counters to 64-bit unsigned ints. As aAlexander Langer1998-01-081-5/+8
| | | | | | | | | | | | | | | | consequence, ipfw's list command now adjusts its output at runtime based on the largest packet/byte counter values. NOTE: o The ipfw struct has changed requiring a recompile of both kernel and userland ipfw utility. o This probably should not be brought into 2.2. PR: 3738 Notes: svn path=/head/; revision=32330
* Removed unused #includes.Bruce Evans1997-10-281-3/+1
| | | | Notes: svn path=/head/; revision=30813
* Fixed gratuitous ANSIisms.Bruce Evans1997-09-161-2/+2
| | | | Notes: svn path=/head/; revision=29506
* Support interface names up to 15 characters in length. In order toAlexander Langer1997-08-081-3/+5
| | | | | | | | | | | | | | | accommodate the expanded name, the ICMP types bitmap has been reduced from 256 bits to 32. A recompile of kernel and user level ipfw is required. To be merged into 2.2 after a brief period in -current. PR: bin/4209 Reviewed by: Archie Cobbs <archie@whistle.com> Notes: svn path=/head/; revision=27981
* Submitted by: Whistle Communications (archie Cobbs)Julian Elischer1997-06-021-45/+96
| | | | | | | | | | | | | | | | | | these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description. Notes: svn path=/head/; revision=26359
* Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are notPeter Wemm1997-02-221-1/+1
| | | | | | | ready for it yet. Notes: svn path=/head/; revision=22975
* implement "not" keyword for inverting the address logicAdam David1997-01-161-0/+2
| | | | Notes: svn path=/head/; revision=21785
* Make the long-awaited change from $Id$ to $FreeBSD$Jordan K. Hubbard1997-01-141-1/+1
| | | | | | | | | | | This will make a number of things easier in the future, as well as (finally!) avoiding the Id-smashing problem which has plagued developers for so long. Boy, I'm glad we're not using sup anymore. This update would have been insane otherwise. Notes: svn path=/head/; revision=21673
* Add hooks for an IP NAT module, much like the firewall stuff...Søren Schmidt1996-08-211-12/+1
| | | | | | | | Move the sockopt definitions for the firewall code from ip_fw.h to in.h where it belongs. Notes: svn path=/head/; revision=17758
* Completely rewrite handling of protocol field for firewalls, things arePaul Traina1996-08-131-8/+2
| | | | | | | | | | now completely consistent across all IP protocols and should be quite a bit faster. Discussed with: fenner & alex Notes: svn path=/head/; revision=17587
* Adding changes to ipfw and the kernel to support ip packet diversion..Julian Elischer1996-07-101-5/+10
| | | | | | | | | This stuff should not be too destructive if the IPDIVERT is not compiled in.. be aware that this changes the size of the ip_fw struct so ipfw needs to be recompiled to use it.. more changes coming to clean this up. Notes: svn path=/head/; revision=17072
* Big sweep over ipfw, picking up where Poul left off:Alexander Langer1996-06-091-17/+24
| | | | | | | | | | | | | | | | | | | | | | - Log ICMP type during verbose output. - Added IPFIREWALL_VERBOSE_LIMIT option to prevent denial of service attacks via syslog flooding. - Filter based on ICMP type. - Timestamp chain entries when they are matched. - Interfaces can now be matched with a wildcard specification (i.e. will match any interface unit for a given name). - Prevent the firewall chain from being manipulated when securelevel is greater than 2. - Fixed bug that allowed the default policy to be deleted. - Ability to zero individual accounting entries. - Remove definitions of old_chk_ptr and old_ctl_ptr when compiling ipfw as a lkm. - Remove some redundant code shared between ip_fw_init and ipfw_load. Closes PRs: 1192, 1219, and 1267. Notes: svn path=/head/; revision=16266
* Correct spelling error in commentGary Palmer1996-06-021-2/+2
| | | | Notes: svn path=/head/; revision=16065
* Add feature for tcp "established".Poul-Henning Kamp1996-04-031-7/+2
| | | | | | | | Change interface between netinet and ip_fw to be more general, and thus hopefully also support other ip filtering implementations. Notes: svn path=/head/; revision=15026
* Make getsockopt() capable of handling more than one mbuf worth of data.Poul-Henning Kamp1996-02-241-11/+3
| | | | | | | | Use this to read rules out of ipfw. Add the lkm code to ipfw.c Notes: svn path=/head/; revision=14232
* The new firewall functionality:Poul-Henning Kamp1996-02-241-9/+15
| | | | | | | | Filter on the direction (in/out). Filter on fragment/not fragment. Notes: svn path=/head/; revision=14230
* Big sweep over the IPFIREWALL and IPACCT code.Poul-Henning Kamp1996-02-231-64/+36
| | | | | | | | | | | | | | | | | Close the ip-fragment hole. Waste less memory. Rewrite to contemporary more readable style. Kill separate IPACCT facility, use "accept" rules in IPFIREWALL. Filter incoming >and< outgoing packets. Replace "policy" by sticky "deny all" rule. Rules have numbers used for ordering and deletion. Remove "rerorder" code entirely. Count packet & bytecount matches for rules. Code in -current & -stable is now the same. Notes: svn path=/head/; revision=14209
* Well..finally..this is the first part..it should take care ofUgen J.S. Antsilevich1995-10-011-3/+23
| | | | | | | | | | | matching IP options..Check and test this - i made only a couple of rough tests and this could be buggy.. Ipaccounting can't use IP Options (and i don't see any need to cound packets with specific options either..) More to come... Notes: svn path=/head/; revision=11119
* Added $Id$.David Greenman1995-07-231-0/+2
| | | | Notes: svn path=/head/; revision=9661
* Fixed panic that occurs on certain firewall rejected packets that wasDavid Greenman1995-07-091-2/+2
| | | | | | | | | | caused by dtom() being used on an mbuf cluster. The fix involves passing around the mbuf pointer. Submitted by: Bill Fenner Notes: svn path=/head/; revision=9460
* Remove trailing whitespace.Rodney W. Grimes1995-05-301-3/+3
| | | | Notes: svn path=/head/; revision=8876
* Allow "via" to be specified ever as IP adress orUgen J.S. Antsilevich1995-02-241-2/+24
| | | | | | | as interface name/unit... Notes: svn path=/head/; revision=6690
* Actual firewall change.Ugen J.S. Antsilevich1995-01-121-11/+28
| | | | | | | | | | 1) Firewall is not subdivided on forwarding / blocking chains anymore.Actually only one chain left-it was the blocking one. 2) LKM support.ip_fwdef.c is function pointers definition and goes into kernel along with all INET stuff. Notes: svn path=/head/; revision=5543
generated by cgit v1.3 (git 2.53.0) at 2026-08-03 22:27:39 +0000