src/sys/netinet/ip_fw.h, branch releng/13.2FreeBSD source treehttps://cgit-dev.freebsd.org/src/atom?h=releng%2F13.22022-07-14T13:04:22Zipfw: add support radix tables and table lookup for MAC addresses2022-07-14T13:04:22ZArseny Smalyuksmalukav@gmail.com2022-06-04T16:12:29Zurn:sha1:c31f8b7bd8955bc79ecfe3e543f95aca4485675b
By analogy with IP address matching, add a way to use ipfw radix
tables for MAC matching. This is implemented using new ipfw table
with mac:radix type. Also there are src-mac and dst-mac lookup
commands added.
Usage example:
ipfw table 1 create type mac
ipfw table 1 add 11:22:33:44:55:66/48
ipfw add skipto tablearg src-mac 'table(1)'
ipfw add deny src-mac 'table(1, 100)'
ipfw add deny lookup dst-mac 1
Note: sysctl net.link.ether.ipfw=1 should be set to enable ipfw
filtering on L2.
Reviewed by: melifaro
Obtained from: Yandex LLC
Relnotes: yes
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D35103
(cherry picked from commit 81cac3906eb9c14f81e03b7bcb6893b8d30e5432)
Allow setting alias port ranges in libalias and ipfw.2021-02-17T18:13:54ZNeel Chauhannc@FreeBSD.org2021-02-02T21:24:17Zurn:sha1:46539a7bf0ecb2f624245da69334a66598da6664
This will allow a system to be a true RFC 6598 NAT444 setup, where each
network segment (e.g. user, subnet) can have their own dedicated port
aliasing ranges.
Reviewed by: donner, kp
Approved by: 0mp (mentor), donner, kp
Differential Revision: https://reviews.freebsd.org/D23450
(cherry picked from commit a08cdb6cfb1c84b80b5337d46c574b55d0e15c63)
Require uint32_t alignment for ipfw_insn2021-01-19T21:23:25ZAlex Richardsonarichardson@FreeBSD.org2021-01-19T11:32:33Zurn:sha1:a81c165bce14257a5fee298214db181e3147ea19
There are many casts of this struct to uint32_t, so we also need to ensure
that it is sufficiently aligned to safely perform this cast on architectures
that don't allow unaligned accesses. This fixes lots of -Wcast-align warnings.
Reviewed By: ae
Differential Revision: https://reviews.freebsd.org/D27879
net: clean up empty lines in .c and .h files2020-09-01T21:19:14ZMateusz Guzikmjg@FreeBSD.org2020-09-01T21:19:14Zurn:sha1:662c13053f4bf2d6245ba7e2b66c10d1cd5c1fb9White space cleanup -- remove trailing tab's or spaces2020-02-12T13:31:36ZRandall Stewartrrs@FreeBSD.org2020-02-12T13:31:36Zurn:sha1:481be5de9deed47eae529c7e5df890520ebc6837
from any line.
Sponsored by: Netflix Inc.
Add "tcpmss" opcode to match the TCP MSS value.2019-06-21T10:54:51ZAndrey V. Elsukovae@FreeBSD.org2019-06-21T10:54:51Zurn:sha1:978f2d17285bf3a0017510c61eb71a2dcae38dbe
With this opcode it is possible to match TCP packets with specified
MSS option, whose value corresponds to configured in opcode value.
It is allowed to specify single value, range of values, or array of
specific values or ranges. E.g.
# ipfw add deny log tcp from any to any tcpmss 0-500
Reviewed by: melifaro,bcr
Obtained from: Yandex LLC
MFC after: 1 week
Sponsored by: Yandex LLC
Add NAT64 CLAT implementation as defined in RFC6877.2019-03-18T11:44:53ZAndrey V. Elsukovae@FreeBSD.org2019-03-18T11:44:53Zurn:sha1:5c04f73e07b97ba421d072b7679e8ef477b8babc
CLAT is customer-side translator that algorithmically translates 1:1
private IPv4 addresses to global IPv6 addresses, and vice versa.
It is implemented as part of ipfw_nat64 kernel module. When module
is loaded or compiled into the kernel, it registers "nat64clat" external
action. External action named instance can be created using `create`
command and then used in ipfw rules. The create command accepts two
IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted,
IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used.
# ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX
# ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out
# ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in
Obtained from: Yandex LLC
Submitted by: Boris N. Lytochkin
MFC after: 1 month
Relnotes: yes
Sponsored by: Yandex LLC
Add ability to request listing and deleting only for dynamic states.2018-12-04T16:12:43ZAndrey V. Elsukovae@FreeBSD.org2018-12-04T16:12:43Zurn:sha1:d66f9c86fa3fd8d8f0a56ea96b03ca11f2fac1fb
This can be useful, when net.inet.ip.fw.dyn_keep_states is enabled, but
after rules reloading some state must be deleted. Added new flag '-D'
for such purpose.
Retire '-e' flag, since there can not be expired states in the meaning
that this flag historically had.
Also add "verbose" mode for listing of dynamic states, it can be enabled
with '-v' flag and adds additional information to states list. This can
be useful for debugging.
Obtained from: Yandex LLC
MFC after: 2 months
Sponsored by: Yandex LLC
Make multiline APPLY_MASK() macro to be function-like.2018-11-20T18:38:28ZAndrey V. Elsukovae@FreeBSD.org2018-11-20T18:38:28Zurn:sha1:5786c6b9f999bc003952dbc8d049c7e6690ef009
Reported by: cem
MFC after: 1 week
Add IPFW_RULE_JUSTOPTS flag, that is used by ipfw(8) to mark rule,2018-10-21T15:10:59ZAndrey V. Elsukovae@FreeBSD.org2018-10-21T15:10:59Zurn:sha1:094d6f8d75b4fad7704a0acf708f7dc600d4a134
that was added using "new rule format". And then, when the kernel
returns rule with this flag, ipfw(8) can correctly show it.
Reported by: lev
MFC after: 3 weeks
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D17373