aboutsummaryrefslogtreecommitdiff
path: root/sbin/ipfw/Makefile
Commit message (Collapse)AuthorAgeFilesLines
* ipfw: Add tests for the NPTv6 rule parserDag-Erling Smørgrav2025-08-251-0/+3
|
* Remove residual blank line at start of MakefileWarner Losh2024-07-151-1/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* ipfw: Introduce dnctlKristof Provost2021-09-081-0/+4
| | | | | | | | | | | | | | Introduce a link to the ipfw command, dnctl, for dummynet configuration. dnctl only handles dummynet configuration, and is part of the effort to support dummynet in pf. /sbin/ipfw continues to accept pipe, queue and sched commands, but these can now also be issued via the new dnctl command. Reviewed by: donner MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30465
* ipfw(8): Fix most warnings with the default WARNS level.Mark Johnston2020-07-131-1/+2
| | | | | | | | | | | | | | - Add missing const and static qualifiers. - Avoid shadowing the global "co" by renaming it to "g_co". - Avoid mixing signedness in loop bound checks. - Leave -Wcast-align warnings disabled for now. Reviewed by: ae, melifaro MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D25456 Notes: svn path=/head/; revision=363164
* Add NAT64 CLAT implementation as defined in RFC6877.Andrey V. Elsukov2019-03-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | CLAT is customer-side translator that algorithmically translates 1:1 private IPv4 addresses to global IPv6 addresses, and vice versa. It is implemented as part of ipfw_nat64 kernel module. When module is loaded or compiled into the kernel, it registers "nat64clat" external action. External action named instance can be created using `create` command and then used in ipfw rules. The create command accepts two IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted, IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used. # ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX # ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out # ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in Obtained from: Yandex LLC Submitted by: Boris N. Lytochkin MFC after: 1 month Relnotes: yes Sponsored by: Yandex LLC Notes: svn path=/head/; revision=345264
* Allow jail names (not just IDs) to be specified for: cpuset(1), ipfw(8),Jamie Gritton2018-07-031-1/+1
| | | | | | | | | | | | | sockstat(1), ugidfw(8) These are the last of the jail-aware userland utilities that didn't work with names. PR: 229266 MFC after: 3 days Differential Revision: D16047 Notes: svn path=/head/; revision=335921
* Add ipfw_nat64 module that implements stateless and stateful NAT64.Andrey V. Elsukov2016-08-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The module works together with ipfw(4) and implemented as its external action module. Stateless NAT64 registers external action with name nat64stl. This keyword should be used to create NAT64 instance and to address this instance in rules. Stateless NAT64 uses two lookup tables with mapped IPv4->IPv6 and IPv6->IPv4 addresses to perform translation. A configuration of instance should looks like this: 1. Create lookup tables: # ipfw table T46 create type addr valtype ipv6 # ipfw table T64 create type addr valtype ipv4 2. Fill T46 and T64 tables. 3. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 4. Create NAT64 instance: # ipfw nat64stl NAT create table4 T46 table6 T64 5. Add rules that matches the traffic: # ipfw add nat64stl NAT ip from any to table(T46) # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96 6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Stateful NAT64 registers external action with name nat64lsn. The only one option required to create nat64lsn instance - prefix4. It defines the pool of IPv4 addresses used for translation. A configuration of instance should looks like this: 1. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 2. Create NAT64 instance: # ipfw nat64lsn NAT create prefix4 A.B.C.D/28 3. Add rules that matches the traffic: # ipfw add nat64lsn NAT ip from any to A.B.C.D/28 # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96 4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D6434 Notes: svn path=/head/; revision=304046
* Add ipfw_nptv6 module that implements Network Prefix Translation for IPv6Andrey V. Elsukov2016-07-181-0/+1
| | | | | | | | | | | | | | | | | as defined in RFC 6296. The module works together with ipfw(4) and implemented as its external action module. When it is loaded, it registers as eaction and can be used in rules. The usage pattern is similar to ipfw_nat(4). All matched by rule traffic goes to the NPT module. Reviewed by: hrs Obtained from: Yandex LLC MFC after: 1 month Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D6420 Notes: svn path=/head/; revision=303012
* Create packages for atm, ccdconfig, devd, ipf, ipfw,Glen Barber2016-02-091-0/+1
| | | | | | | | | | | iscsi, natd, nandfs, pf, quotacheck, and routed. Add ping6 and rtsol to the runtime package. Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=295448
* Convert sbin/ to LIBADDBaptiste Daroussin2014-11-251-2/+1
| | | | | | | Reduce overlinking Notes: svn path=/head/; revision=275030
* Move further to eliminate next pieces of number-assuming code inside tables.Alexander V. Chernikov2014-06-141-1/+1
| | | | | | | | | | | | | | | Kernel changes: * Add IP_FW_OBJ_FLUSH opcode (flush table based on its name/set) * Add IP_FW_OBJ_DUMP opcode (dumps table data based on its names/set) * Add IP_FW_OBJ_LISTSIZE / IP_FW_OBJ_LIST opcodes (get list of kernel tables) Userland changes: * move tables code to separate tables.c file * get rid of tables_max * switch "all"/list handling to new opcodes Notes: svn path=/projects/ipfw/; revision=267487
* Use src.opts.mk in preference to bsd.own.mk except where we need stuffWarner Losh2014-05-061-1/+1
| | | | | | | from the latter. Notes: svn path=/head/; revision=265420
* Fix world build WITHOUT_PF.Gleb Smirnoff2014-02-121-1/+9
| | | | | | | Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=261797
* add back DPADD (removed by mistake in a previous commit)Luigi Rizzo2010-03-081-0/+1
| | | | Notes: svn path=/head/; revision=204869
* Bring in the most recent version of ipfw and dummynet, developedLuigi Rizzo2010-03-021-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and tested over the past two months in the ipfw3-head branch. This also happens to be the same code available in the Linux and Windows ports of ipfw and dummynet. The major enhancement is a completely restructured version of dummynet, with support for different packet scheduling algorithms (loadable at runtime), faster queue/pipe lookup, and a much cleaner internal architecture and kernel/userland ABI which simplifies future extensions. In addition to the existing schedulers (FIFO and WF2Q+), we include a Deficit Round Robin (DRR or RR for brevity) scheduler, and a new, very fast version of WF2Q+ called QFQ. Some test code is also present (in sys/netinet/ipfw/test) that lets you build and test schedulers in userland. Also, we have added a compatibility layer that understands requests from the RELENG_7 and RELENG_8 versions of the /sbin/ipfw binaries, and replies correctly (at least, it does its best; sometimes you just cannot tell who sent the request and how to answer). The compatibility layer should make it possible to MFC this code in a relatively short time. Some minor glitches (e.g. handling of ipfw set enable/disable, and a workaround for a bug in RELENG_7's /sbin/ipfw) will be fixed with separate commits. CREDITS: This work has been partly supported by the ONELAB2 project, and mostly developed by Riccardo Panicucci and myself. The code for the qfq scheduler is mostly from Fabio Checconi, and Marta Carbone and Francesco Magno have helped with testing, debugging and some bug fixes. Notes: svn path=/head/; revision=204591
* Fixed dependencies (make checkdpadd).Ruslan Ermilov2010-02-251-0/+1
| | | | Notes: svn path=/head/; revision=204329
* - fix dummynet 'fast' mode for WF2Q case.Oleg Bulyzhin2009-06-241-0/+1
| | | | | | | | | - fix printing of pipe profile data. - introduce new pipe parameter: 'burst' - how much data can be sent through pipe bypassing bandwidth limit. Notes: svn path=/head/; revision=194930
* put the altq-related functions into a separate file.Luigi Rizzo2009-02-011-1/+1
| | | | | | | | Minor cleanup of the includes used by the various source files, including annotations of why certain headers are used. Notes: svn path=/head/; revision=187983
* fix printing of uint64_t values, so we can use WARNS=2Luigi Rizzo2009-01-271-1/+1
| | | | Notes: svn path=/head/; revision=187787
* Put nat and ipv6 support in their own files.Luigi Rizzo2009-01-271-1/+1
| | | | | | | | | | | Usual moving of code with no changes from ipfw2.c to the newly created files, and addition of prototypes to ipfw2.h I have added forward declarations for ipfw_insn_* in ipfw2.h to avoid a global dependency on ip_fw.h Notes: svn path=/head/; revision=187770
* never mind, for the time being let's stick with WARNS=0 untilLuigi Rizzo2009-01-271-2/+2
| | | | | | | we sort out all proper printf formats. Notes: svn path=/head/; revision=187768
* Start splitting the monster file in smaller blocks.Luigi Rizzo2009-01-271-1/+1
| | | | | | | | | | | | | | | In this episode: - introduce a common header with a minimal set of common definitions; - bring the main() function and options parser in main.c - rename the main functions with an ipfw_ prefix No code changes except for the introduction of a global variable, resvd_set_number, which stores the RESVD_SET value from ip_fw.h and is used to remove the dependency of main.c from ip_fw.h (and the subtree of dependencies) for just a single constant. Notes: svn path=/head/; revision=187767
* I believe this is safe to build with WARNS=2 nowLuigi Rizzo2009-01-271-1/+1
| | | | Notes: svn path=/head/; revision=187763
* Remove blindly-copied extra include path.Brian Feldman2004-10-031-1/+0
| | | | Notes: svn path=/head/; revision=136079
* Add to IPFW the ability to do ALTQ classification/tagging.Brian Feldman2004-10-031-0/+1
| | | | Notes: svn path=/head/; revision=136071
* Uncommented WARNS=0. ipfw2.c is full of printf format errors that areBruce Evans2002-07-111-1/+1
| | | | | | | | | | | fatal on alphas. Fixed setting of WARNS. WARNS should never be set unconditionally, since this breaks testing of different WARNS values by setting it at a higher level (e.g., on the command line). Notes: svn path=/head/; revision=99788
* The new ipfw code.Luigi Rizzo2002-06-271-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code makes use of variable-size kernel representation of rules (exactly the same concept of BPF instructions, as used in the BSDI's firewall), which makes firewall operation a lot faster, and the code more readable and easier to extend and debug. The interface with the rest of the system is unchanged, as witnessed by this commit. The only extra kernel files that I am touching are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In userland I only had to touch those programs which manipulate the internal representation of firewall rules). The code is almost entirely new (and I believe I have written the vast majority of those sections which were taken from the former ip_fw.c), so rather than modifying the old ip_fw.c I decided to create a new file, sys/netinet/ip_fw2.c . Same for the user interface, which is in sbin/ipfw/ipfw2.c (it still compiles to /sbin/ipfw). The old files are still there, and will be removed in due time. I have not renamed the header file because it would have required touching a one-line change to a number of kernel files. In terms of user interface, the new "ipfw" is supposed to accepts the old syntax for ipfw rules (and produce the same output with "ipfw show". Only a couple of the old options (out of some 30 of them) has not been implemented, but they will be soon. On the other hand, the new code has some very powerful extensions. First, you can put "or" connectives between match fields (and soon also between options), and write things like ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any This should make rulesets slightly more compact (and lines longer!), by condensing 2 or more of the old rules into single ones. Also, as an example of how easy the rules can be extended, I have implemented an 'address set' match pattern, where you can specify an IP address in a format like this: 10.20.30.0/26{18,44,33,22,9} which will match the set of hosts listed in braces belonging to the subnet 10.20.30.0/26 . The match is done using a bitmap, so it is essentially a constant time operation requiring a handful of CPU instructions (and a very small amount of memmory -- for a full /24 subnet, the instruction only consumes 40 bytes). Again, in this commit I have focused on functionality and tried to minimize changes to the other parts of the system. Some performance improvement can be achieved with minor changes to the interface of ip_fw_chk_t. This will be done later when this code is settled. The code is meant to compile unmodified on RELENG_4 (once the PACKET_TAG_* changes have been merged), for this reason you will see #ifdef __FreeBSD_version in a couple of places. This should minimize errors when (hopefully soon) it will be time to do the MFC. Notes: svn path=/head/; revision=98943
* Default to WARNS=2.David E. O'Brien2001-12-041-1/+1
| | | | | | | | | Binary builds that cannot handle this must explicitly set WARNS=0. Reviewed by: mike Notes: svn path=/head/; revision=87325
* - Backout botched attempt to introduce MANSECT feature.Ruslan Ermilov2001-03-261-0/+1
| | | | | | | - MAN[1-9] -> MAN. Notes: svn path=/head/; revision=74815
* Set the default manual section for sbin/ to 8.Ruslan Ermilov2001-03-201-1/+0
| | | | Notes: svn path=/head/; revision=74531
* Convert this Makefile to the usual style.Ruslan Ermilov2000-10-061-3/+3
| | | | Notes: svn path=/head/; revision=66733
* Submitted by: Whistle Communications (archie Cobbs)Julian Elischer1997-06-021-0/+2
| | | | | | | | | | | | | | | | | | these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description. Notes: svn path=/head/; revision=26359
* Update to match kernel code.Poul-Henning Kamp1996-02-241-11/+0
| | | | Notes: svn path=/head/; revision=14233
* A new ipfw program that can set and control the new features.Poul-Henning Kamp1996-02-241-0/+9
| | | | | | | An almost correct usage is printed. Notes: svn path=/head/; revision=14231
* ipfirewall.4 is obviously not here anymore! Adjust the Makefile.Jordan K. Hubbard1995-02-181-2/+0
| | | | Notes: svn path=/head/; revision=6545
* New man pages from Ugen. Delete my old, first attempt. I only hopeJordan K. Hubbard1994-11-171-0/+4
| | | | | | | | | | | that the english in Ugen's two replacement pages is not too impenetrable! :-) [Note: Poul - please pull these into the BETA branch along with the other firewall changes] Submitted by: ugen Notes: svn path=/head/; revision=4541
* Add the ipfw command, for IP firewall construction.Jordan K. Hubbard1994-10-281-0/+5
Submitted by: danny ugen Notes: svn path=/cvs2svn/branches/ipfw/; revision=3965
generated by cgit v1.3 (git 2.53.0) at 2026-08-02 01:07:32 +0000