Update to IPFilter 3.3.8. Man pages still to go. See sbin/ipf/HISTORY

for details.

14 files changed, 103 insertions, 46 deletions

diff --git a/sbin/ipf/HISTORY b/sbin/ipf/HISTORY
index 8e386cd93d7..0812e373b33 100644
--- a/sbin/ipf/HISTORY
+++ b/sbin/ipf/HISTORY
@@ -1,4 +1,4 @@
-# $OpenBSD: HISTORY,v 1.2 1999/12/28 08:20:40 kjell Exp $
+#	$OpenBSD: HISTORY,v 1.3 2000/02/01 19:29:59 kjell Exp $
 #
 # NOTE: Quite a few patches and suggestions come from other sources, to whom
 #       I'm greatly indebted, even if no names are mentioned.
@@ -9,7 +9,7 @@
 #
 # Thanks to Tel.Net Media for allowing me to maintain and further develop
 # IP Filter as part of my job and supplying Sun equipment for testing the
-# move to 64bits.
+# move to 64bits and Gigabit Ethernet.
 #
 # Thanks to BSDI for providing object files for BSD/OS 3.1 and the means
 # to further support development of IP Filter under BSDI.
@@ -21,6 +21,43 @@
 # and especially those who have found the time to port IP Filter to new
 # platforms.
 #
+3.3.8	01/02/2000 - Released
+
+fix state handling of SYN packets.
+
+add parsing recognition of extra icmp types/codes and fix handling of
+icmp time stamps and mask requests - Frank volf
+
+3.3.7	25/01/2000 - Released
+
+sync on state information as well as NAT information when required
+
+record nat protocol in all nat log records
+
+don't reuse the IP# from an active NAT session if the IP# in the rule
+has changed dynamically.
+
+lookup the protocol for NAT log information in ipmon and pass that to
+portname.
+
+fix the bug with changing the outbound interface of a packet where it
+would lead to a panic.
+
+use fr_running instead of ipl_inited. (sysctl name change on freebsd)
+
+return EIO if someone attempts an ioctl on state/nat if ipfilter is not
+enabled.
+
+fix rule insertion bug
+
+make state flushing clean anything that's not fully established (4/4)
+
+call fr_state_flush() after we've released ipf_state so we don't generate
+a recursive mutex acquisition panic
+
+fix parsing of icmp code after return-icmp/return-icmp-as-dest and add
+some patches to enhance parsing strength
+
 3.3.6	28/12/1999 - Released
 
 add in missing rwlock release in fr_checkicmpmatchingstate() and fix check
diff --git a/sbin/ipf/facpri.c b/sbin/ipf/facpri.c
index c3af7068cc2..4c866ca3698 100644
--- a/sbin/ipf/facpri.c
+++ b/sbin/ipf/facpri.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: facpri.c,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/*	$OpenBSD: facpri.c,v 1.2 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -20,7 +21,7 @@
 #include "facpri.h"
 
 #if !defined(lint)
-static const char rcsid[] = "@(#)$Id: facpri.c,v 1.1 1999/12/14 04:17:17 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: facpri.c,v 1.2 1999/08/01 11:10:45 darrenr Exp $";
 #endif
 
 typedef	struct	table	{
diff --git a/sbin/ipf/facpri.h b/sbin/ipf/facpri.h
index 1ca7ddd26f5..1d29c4ba82e 100644
--- a/sbin/ipf/facpri.h
+++ b/sbin/ipf/facpri.h
@@ -1,11 +1,12 @@
-/* $OpenBSD: facpri.h,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/*	$OpenBSD: facpri.h,v 1.2 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1999 by Darren Reed.
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and due credit is given
  * to the original author and the contributors.
- * $Id: facpri.h,v 1.1 1999/12/14 04:17:17 kjell Exp $
+ * $IPFilter: facpri.h,v 1.2 1999/08/01 11:10:46 darrenr Exp $
  */
 
 #ifndef	__FACPRI_H__
diff --git a/sbin/ipf/ifaddr.c b/sbin/ipf/ifaddr.c
index 300e3e27f3e..832ca4e4cf8 100644
--- a/sbin/ipf/ifaddr.c
+++ b/sbin/ipf/ifaddr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ifaddr.c,v 1.1 1999/12/16 07:38:45 kjell Exp $ */
+/* $OpenBSD: ifaddr.c,v 1.2 2000/02/01 19:30:00 kjell Exp $ */
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
@@ -6,6 +6,7 @@
 #include <netinet/in.h>
 #include <err.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include "ifaddr.h"
 
 
diff --git a/sbin/ipf/ifaddr.h b/sbin/ipf/ifaddr.h
index 96ef1bac246..19f77d05926 100644
--- a/sbin/ipf/ifaddr.h
+++ b/sbin/ipf/ifaddr.h
@@ -1,7 +1,7 @@
-/* $OpenBSD: ifaddr.h,v 1.1 1999/12/16 07:38:45 kjell Exp $ */
+/* $OpenBSD: ifaddr.h,v 1.2 2000/02/01 19:30:00 kjell Exp $ */
 
-#ifndef	__IFADDR_H__
-#define	__IFADDR_H__
+#ifndef        __IFADDR_H__
+#define        __IFADDR_H__
 
 int     if_addr __P((char *, struct in_addr *));
 
diff --git a/sbin/ipf/ipf.c b/sbin/ipf/ipf.c
index bf2517b13af..02c43d9177b 100644
--- a/sbin/ipf/ipf.c
+++ b/sbin/ipf/ipf.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ipf.c,v 1.20 1999/12/15 05:20:24 kjell Exp $ */
+/*	$OpenBSD: ipf.c,v 1.21 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -44,7 +45,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)ipf.c	1.23 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipf.c,v 1.20 1999/12/15 05:20:24 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ipf.c,v 2.2 1999/08/06 15:26:08 darrenr Exp $";
 #endif
 
 #if	SOLARIS
diff --git a/sbin/ipf/ipf.h b/sbin/ipf/ipf.h
index 5435972babd..30e3329eb18 100644
--- a/sbin/ipf/ipf.h
+++ b/sbin/ipf/ipf.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ipf.h,v 1.11 1999/12/15 05:20:24 kjell Exp $ */
+/*	$OpenBSD: ipf.h,v 1.12 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -7,7 +8,7 @@
  * to the original author and the contributors.
  *
  * @(#)ipf.h	1.12 6/5/96
- * $Id: ipf.h,v 1.11 1999/12/15 05:20:24 kjell Exp $
+ * $IPFilter: ipf.h,v 2.1.2.1 1999/10/05 12:59:25 darrenr Exp $
  */
 
 #ifndef	__IPF_H__
diff --git a/sbin/ipf/opt.c b/sbin/ipf/opt.c
index 74df2df5c45..3e384d68c5a 100644
--- a/sbin/ipf/opt.c
+++ b/sbin/ipf/opt.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: opt.c,v 1.11 1999/12/15 05:20:24 kjell Exp $ */
+/*	$OpenBSD: opt.c,v 1.12 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -28,7 +29,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)opt.c	1.8 4/10/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: opt.c,v 1.11 1999/12/15 05:20:24 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: opt.c,v 2.1 1999/08/04 17:30:15 darrenr Exp $";
 #endif
 
 extern	int	opts;
diff --git a/sbin/ipf/parse.c b/sbin/ipf/parse.c
index f891877b1f0..7cad35c146a 100644
--- a/sbin/ipf/parse.c
+++ b/sbin/ipf/parse.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: parse.c,v 1.30 1999/12/28 08:30:31 kjell Exp $ */
+/*	$OpenBSD: parse.c,v 1.31 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -42,7 +43,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)parse.c	1.44 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: parse.c,v 1.30 1999/12/28 08:30:31 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: parse.c,v 2.1.2.8 2000/01/27 08:49:42 darrenr Exp $";
 #endif
 
 extern	struct	ipopt_names	ionames[], secclass[];
@@ -129,21 +130,25 @@ int     linenum;
 
 	if (!strcasecmp("block", *cpp)) {
 		fil.fr_flags |= FR_BLOCK;
-		if (!strncasecmp(*(cpp+1), "return-icmp-as-dest", 19))
+		if (!strncasecmp(*(cpp+1), "return-icmp-as-dest", 19) &&
+		    (i = 19))
 			fil.fr_flags |= FR_FAKEICMP;
-		else if (!strncasecmp(*(cpp+1), "return-icmp", 11))
+		else if (!strncasecmp(*(cpp+1), "return-icmp", 11) && (i = 11))
 			fil.fr_flags |= FR_RETICMP;
 		if (fil.fr_flags & FR_RETICMP) {
 			cpp++;
-			if (!*(cpp+1)) {
-				fprintf(stderr, "%d: missing icmp code\n",
-					linenum);
-				return NULL;
+			if (strlen(*cpp) == i) {
+				if (*(cpp + 1) && **(cpp +1) == '(') {
+					cpp++;
+					i = 0;
+				} else
+					i = -1;
 			}
-			i = 11;
-			if ((strlen(*cpp) > i) && (*(*cpp + i) != '('))
-				i = 19;
-			if (*(*cpp + i) == '(') {
+
+			/*
+			 * The ICMP code is not required to follow in ()'s
+			 */
+			if ((i >= 0) && (*(*cpp + i) == '(')) {
 				i++;
 				j = icmpcode(*cpp + i);
 				if (j == -1) {
@@ -256,7 +261,7 @@ int     linenum;
 
 	if (!strcasecmp("log", *cpp)) {
 		if (!*++cpp) {
-			fprintf(stderr, "%d: missing source specification\n", 
+			fprintf(stderr, "%d: missing source specification\n",
 				linenum);
 			return NULL;
 		}
@@ -766,7 +771,7 @@ int     linenum;
 
 /*
  * returns an ip address as a long var as a result of either a DNS lookup or
- * straight inet_aton() call
+ * straight inet_addr() call
  */
 u_32_t	hostnum(host, resolved, linenum)
 char	*host;
@@ -1247,12 +1252,13 @@ int     linenum;
 }
 
 
-#define	MAX_ICMPCODE	12
+#define	MAX_ICMPCODE	15
 
 char	*icmpcodes[] = {
 	"net-unr", "host-unr", "proto-unr", "port-unr", "needfrag", "srcfail",
 	"net-unk", "host-unk", "isolate", "net-prohib", "host-prohib",
-	"net-tos", "host-tos", NULL };
+	"net-tos", "host-tos", "filter-prohib", "host-preced", "preced-cutoff", 
+	NULL };
 /*
  * Return the number for the associated ICMP unreachable code.
  */
diff --git a/sbin/ipfstat/fils.c b/sbin/ipfstat/fils.c
index 5def479df1f..67ec78629f0 100644
--- a/sbin/ipfstat/fils.c
+++ b/sbin/ipfstat/fils.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: fils.c,v 1.17 1999/12/15 05:20:25 kjell Exp $ */
+/*	$OpenBSD: fils.c,v 1.18 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -52,7 +53,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)fils.c	1.21 4/20/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fils.c,v 1.17 1999/12/15 05:20:25 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: fils.c,v 2.2.2.5 2000/01/27 08:49:40 darrenr Exp $";
 #endif
 
 #define	F_IN	0
@@ -81,7 +82,7 @@ static void Usage(name)
 char *name;
 {
 	fprintf(stderr,
-	    "usage: %s [-aAfhIinosv] [-d device] [-M core] [-N system]\n", 
+	    "usage: %s [-aAfhIinosv] [-d device] [-M core]\n", 
 		name);
 	exit(1);
 }
@@ -98,7 +99,7 @@ char *argv[];
 	char	*name = NULL, *device = IPL_NAME;
 	int	c, fd;
 
-	while ((c = getopt(argc, argv, "AafhIinosvd:M:")) != -1)
+	while ((c = getopt(argc, argv, "AafhgIinosvd:M:")) != -1)
 	{
 		switch (c)
 		{
@@ -247,11 +248,13 @@ struct	friostat	*fp;
 	printf(" input packets:\t\tblocked %lu passed %lu nomatch %lu",
 			fp->f_st[0].fr_block, fp->f_st[0].fr_pass,
 			fp->f_st[0].fr_nom);
-	printf(" counted %lu\n", fp->f_st[0].fr_acct);
+	printf(" counted %lu short %lu\n", 
+			fp->f_st[0].fr_acct, fp->f_st[0].fr_short);
 	printf("output packets:\t\tblocked %lu passed %lu nomatch %lu",
 			fp->f_st[1].fr_block, fp->f_st[1].fr_pass,
 			fp->f_st[1].fr_nom);
-	printf(" counted %lu\n", fp->f_st[0].fr_acct);
+	printf(" counted %lu short %lu\n", 
+			fp->f_st[1].fr_acct, fp->f_st[1].fr_short);
 	printf(" input packets logged:\tblocked %lu passed %lu\n",
 			fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl);
 	printf("output packets logged:\tblocked %lu passed %lu\n",
diff --git a/sbin/ipfstat/kmem.c b/sbin/ipfstat/kmem.c
index 7d57fb57fbf..b56fa34ee32 100644
--- a/sbin/ipfstat/kmem.c
+++ b/sbin/ipfstat/kmem.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: kmem.c,v 1.12 1999/12/15 05:20:25 kjell Exp $ */
+/*	$OpenBSD: kmem.c,v 1.13 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -21,7 +22,7 @@
 
 #if !defined(lint)
 static const char sccsid[] = "@(#)kmem.c	1.4 1/12/96 (C) 1992 Darren Reed";
-static const char rcsid[] = "@(#)$Id: kmem.c,v 1.12 1999/12/15 05:20:25 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: kmem.c,v 2.1 1999/08/04 17:30:09 darrenr Exp $";
 #endif
 
 static	int	kmemfd = -1;
diff --git a/sbin/ipfstat/kmem.h b/sbin/ipfstat/kmem.h
index 5da38aad7de..9d8e7cee3af 100644
--- a/sbin/ipfstat/kmem.h
+++ b/sbin/ipfstat/kmem.h
@@ -1,11 +1,12 @@
-/* $OpenBSD: kmem.h,v 1.9 1999/12/15 05:20:25 kjell Exp $ */
+/*	$OpenBSD: kmem.h,v 1.10 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
  * Redistribution and use in source and binary forms are permitted
  * provided that this notice is preserved and due credit is given
  * to the original author and the contributors.
- * $Id: kmem.h,v 1.9 1999/12/15 05:20:25 kjell Exp $
+ * $IPFilter: kmem.h,v 2.1 1999/08/04 17:30:10 darrenr Exp $
  */
 
 #ifndef	__KMEM_H__
diff --git a/sbin/ipnat/ipnat.c b/sbin/ipnat/ipnat.c
index ab3cd70dfdd..70774ba9f92 100644
--- a/sbin/ipnat/ipnat.c
+++ b/sbin/ipnat/ipnat.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ipnat.c,v 1.33 1999/12/16 07:38:45 kjell Exp $ */
+/*	$OpenBSD: ipnat.c,v 1.34 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -57,7 +58,7 @@ extern	char	*sys_errlist[];
 
 #if !defined(lint)
 static const char sccsid[] ="@(#)ipnat.c	1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipnat.c,v 1.33 1999/12/16 07:38:45 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ipnat.c,v 2.1.2.2 1999/12/04 02:09:30 darrenr Exp $";
 #endif
 
 
@@ -402,6 +403,7 @@ char	*msk;
 	return mask;
 }
 
+
 /*
  * returns an ip address as a long var as a result of either a DNS lookup or
  * straight inet_addr() call
diff --git a/sbin/ipnat/natparse.c b/sbin/ipnat/natparse.c
index f20a8704ae5..40204a429e5 100644
--- a/sbin/ipnat/natparse.c
+++ b/sbin/ipnat/natparse.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: natparse.c,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/*	$OpenBSD: natparse.c,v 1.2 2000/02/01 19:30:00 kjell Exp $	*/
+
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -54,7 +55,7 @@ extern	char	*sys_errlist[];
 
 #if !defined(lint)
 static const char sccsid[] ="@(#)ipnat.c	1.9 6/5/96 (C) 1993 Darren Reed";
-static const char rcsid[] = "@(#)$Id: natparse.c,v 1.1 1999/12/14 04:17:17 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: natparse.c,v 1.2.2.1 1999/11/20 22:50:30 darrenr Exp $";
 #endif