Update to Darren Reed's IPFilter 3.3.5

Fixes: realaudio proxy issues, "log level" printing, and
source address for icmp replies (was reversed).

Thoughtfully submitted by techs@obfuscation.org

5 files changed, 65 insertions, 69 deletions

diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index 9eec14d24ff..eff9d8d23b1 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -1,4 +1,4 @@
-/*       $OpenBSD: fil.c,v 1.18 1999/12/15 07:04:20 itojun Exp $       */
+/*       $OpenBSD: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $       */
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -8,7 +8,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)fil.c	1.36 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 1.18 1999/12/15 07:04:20 itojun Exp $";
+static const char rcsid[] = "@(#)$Id: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $";
 #endif
 
 #include <sys/errno.h>
@@ -1179,7 +1179,7 @@ nodata:
  * SUCH DAMAGE.
  *
  *	@(#)uipc_mbuf.c	8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 1.18 1999/12/15 07:04:20 itojun Exp $
+ * $Id: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $
  */
 /*
  * Copy data from an mbuf chain starting "off" bytes from the beginning,
@@ -1545,7 +1545,6 @@ struct in_addr *inp;
 	in = sin->sin_addr;
 #  endif /* linux */
 # endif /* SOLARIS */
-	in.s_addr = ntohl(in.s_addr);
 	*inp = in;
 	return 0;
 }
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index 7885d41230e..45a71603e54 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -1,4 +1,4 @@
-/*    $OpenBSD: ip_fil.c,v 1.27 1999/12/15 05:20:21 kjell Exp $    */
+/*    $OpenBSD: ip_fil.c,v 1.28 1999/12/17 06:17:08 kjell Exp $    */
 /*
  * Copyright (C) 1993-1998 by Darren Reed.
  *
@@ -8,7 +8,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_fil.c	2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.27 1999/12/15 05:20:21 kjell Exp $";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.28 1999/12/17 06:17:08 kjell Exp $";
 #endif
 
 #ifndef	SOLARIS
@@ -762,15 +762,15 @@ caddr_t data;
 	}
 
 	if (!f) {
-		if (req == SIOCINAFR || req == SIOCINIFR) {
-			ftail = fprev;
-			if (fp->fr_hits) {
-				while (--fp->fr_hits && (f = *ftail)) {
+		if (req != SIOCINAFR || req != SIOCINIFR)
+			while ((f = *ftail))
+				ftail = &f->fr_next;
+		else {
+			if (fp->fr_hits)
+				while (--fp->fr_hits && (f = *ftail))
 					ftail = &f->fr_next;
-				}
-			}
+			f = NULL;
 		}
-		f = NULL;
 	}
 
 	if (req == SIOCDELFR || req == SIOCRMIFR) {
@@ -795,7 +795,7 @@ caddr_t data;
 			error = EEXIST;
 		else {
 			if (unit == IPL_LOGAUTH)
-				return fr_auth_ioctl(data, req, f, ftail);
+				return fr_auth_ioctl(data, req, fp, ftail);
 			KMALLOC(f, frentry_t *);
 			if (f != NULL) {
 				if (fg && fg->fg_head)
@@ -1018,7 +1018,7 @@ int send_icmp_err(oip, type, code, ifp, dst)
 ip_t *oip;
 int type, code;
 void *ifp;
-struct in_addr	dst;
+struct in_addr dst;
 {
 	struct icmp *icmp;
 	struct mbuf *m;
@@ -1053,7 +1053,6 @@ struct in_addr	dst;
 	if (dst.s_addr == 0) {
 		if (fr_ifpaddr(ifp, &dst) == -1)
 			return -1;
-		dst.s_addr = htonl(dst.s_addr);
 	}
 	nip->ip_src = dst;
 	nip->ip_dst = oip->ip_src;
@@ -1320,19 +1319,9 @@ done:
 		RTFREE(ro->ro_rt);
 	return 0;
 bad:
-# if BSD >= 199306
-	if (error == EMSGSIZE) {
-		/* Send ICMP error here */
-		struct mbuf *mcopy;
-
-		mcopy = m_copy(m, 0, imin((int)ip->ip_len, 68));
-		if (mcopy) {
-			mcopy->m_pkthdr.rcvif = (struct ifnet *)ifp;
-			icmp_error(mcopy, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
-				   ip->ip_dst.s_addr, ifp);
-		}
-	}
-# endif
+	if (error == EMSGSIZE)
+		(void) send_icmp_err(ip, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
+				     ifp, ip->ip_dst);
 	m_freem(m);
 	goto done;
 }
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index 45631f9e547..25feccd54fa 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_nat.c,v 1.23 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_nat.c,v 1.24 1999/12/17 06:17:08 kjell Exp $ */
 /*
  * Copyright (C) 1995-1998 by Darren Reed.
  *
@@ -10,7 +10,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_nat.c	1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 1.23 1999/12/15 05:20:22 kjell Exp $";
+static const char rcsid[] = "@(#)$Id: ip_nat.c,v 1.24 1999/12/17 06:17:08 kjell Exp $";
 #endif
 
 #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
@@ -791,6 +791,7 @@ int direction;
 					KFREE(nat);
 					return NULL;
 				}
+				in.s_addr = ntohl(in.s_addr);
 			} else if (!in.s_addr && !np->in_outmsk) {
 				/*
 				 * 0/0 - use the original source address/port.
@@ -1727,7 +1728,7 @@ void *ifp;
 			 */
 			sum1 = nat->nat_outip.s_addr;
 			if (fr_ifpaddr(ifp2, &in) != -1)
-				nat->nat_outip.s_addr = htonl(in.s_addr);
+				nat->nat_outip = in;
 			sum2 = nat->nat_outip.s_addr;
 
 			if (sum1 == sum2)
diff --git a/sys/netinet/ip_raudio_pxy.c b/sys/netinet/ip_raudio_pxy.c
index 9cbff3fc059..0212a0c1ebf 100644
--- a/sys/netinet/ip_raudio_pxy.c
+++ b/sys/netinet/ip_raudio_pxy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_raudio_pxy.c,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/* $OpenBSD: ip_raudio_pxy.c,v 1.2 1999/12/17 06:17:08 kjell Exp $ */
 #if SOLARIS && defined(_KERNEL)
 extern	kmutex_t	ipf_rw;
 #endif
@@ -57,7 +57,7 @@ ap_session_t *aps;
 nat_t *nat;
 {
 	raudio_t *rap = aps->aps_data;
-	char membuf[512 + 1], *s;
+	unsigned char membuf[512 + 1], *s;
 	u_short id = 0;
 	tcphdr_t *tcp;
 	int off, dlen;
@@ -83,14 +83,14 @@ nat_t *nat;
 	dlen = msgdsize(m) - off;
 	if (dlen <= 0)
 		return 0;
-	copyout_mblk(m, off, MIN(sizeof(membuf), dlen), membuf);
+	copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
 #else
 	m = *(mb_t **)fin->fin_mp;
 
 	dlen = mbufchainlen(m) - off;
 	if (dlen <= 0)
 		return 0;
-	m_copydata(m, off, MIN(sizeof(membuf), dlen), membuf);
+	m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
 #endif
 	/*
 	 * In all the startup parsing, ensure that we don't go outside
@@ -100,7 +100,7 @@ nat_t *nat;
 	 * Look for the start of connection "PNA" string if not seen yet.
 	 */
 	if (rap->rap_seenpna == 0) {
-		s = memstr("PNA", membuf, 3, dlen);
+		s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
 		if (s == NULL)
 			return 0;
 		s += 3;
@@ -164,7 +164,7 @@ ip_t *ip;
 ap_session_t *aps;
 nat_t *nat;
 {
-	char membuf[IPF_MAXPORTLEN + 1], *s;
+	unsigned char membuf[IPF_MAXPORTLEN + 1], *s;
 	tcphdr_t *tcp, tcph, *tcp2 = &tcph;
 	raudio_t *rap = aps->aps_data;
 	struct in_addr swa, swb;
@@ -199,13 +199,13 @@ nat_t *nat;
 	if (dlen <= 0)
 		return 0;
 	bzero(membuf, sizeof(membuf));
-	copyout_mblk(m, off, MIN(sizeof(membuf), dlen), membuf);
+	copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
 #else
 	dlen = mbufchainlen(m) - off;
 	if (dlen <= 0)
 		return 0;
 	bzero(membuf, sizeof(membuf));
-	m_copydata(m, off, MIN(sizeof(membuf), dlen), membuf);
+	m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
 #endif
 
 	seq = ntohl(tcp->th_seq);
@@ -214,7 +214,7 @@ nat_t *nat;
 	 * We only care for the first 19 bytes coming back from the server.
 	 */
 	if (rap->rap_sseq == 0) {
-		s = memstr("PNA", membuf, 3, dlen);
+		s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
 		if (s == NULL)
 			return 0;
 		a1 = s - membuf;
@@ -243,50 +243,57 @@ nat_t *nat;
 		return 0;
 	rap->rap_sdone = 1;
 
-	s = rap->rap_svr + 13;
-	rap->rap_srport = (*s << 8) | *(s + 1);
+	s = (u_char *)rap->rap_svr + 11;
+	if (((*s << 8) | *(s + 1)) == RA_ID_ROBUST) {
+		s += 2;
+		rap->rap_srport = (*s << 8) | *(s + 1);
+	}
+
 	swp = ip->ip_p;
 	swa = ip->ip_src;
 	swb = ip->ip_dst;
+
 	ip->ip_p = IPPROTO_UDP;
+	ip->ip_src = nat->nat_inip;
+	ip->ip_dst = nat->nat_oip;
+
 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
 	bzero((char *)tcp2, sizeof(*tcp2));
 	fi.fin_dp = (char *)tcp2;
 	fi.fin_fr = &raudiofr;
 	tcp2->th_win = htons(8192);
 
-	if ((rap->rap_mode & RAP_M_UDP_ROBUST) == RAP_M_UDP_ROBUST) {
-		ip->ip_src = nat->nat_inip;
-		ip->ip_dst = nat->nat_oip;
-		sp = rap->rap_srport;
-		dp = rap->rap_prport;
-		tcp2->th_sport = htons(dp);
-		tcp2->th_dport = htons(sp);
+	if (((rap->rap_mode & RAP_M_UDP_ROBUST) == RAP_M_UDP_ROBUST) &&
+	    (rap->rap_srport != 0)) {
+		dp = rap->rap_srport;
+		sp = rap->rap_prport;
+		tcp2->th_sport = htons(sp);
+		tcp2->th_dport = htons(dp);
 		fi.fin_data[0] = dp;
 		fi.fin_data[1] = sp;
-		ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP, NAT_OUTBOUND);
+		ipn = nat_new(nat->nat_ptr, ip, &fi, 
+			      IPN_UDP | (sp ? 0 : FI_W_SPORT),
+			      NAT_OUTBOUND);
 		if (ipn != NULL) {
 			ipn->nat_age = fr_defnatage;
-			(void) fr_addstate(ip, &fi, 0);
+			(void) fr_addstate(ip, &fi, sp ? 0 : FI_W_SPORT);
 		}
-		ip->ip_src = swa;
-		ip->ip_dst = swb;
 	}
 
-	sp = rap->rap_plport;
-
-	tcp2->th_sport = htons(sp);
-	tcp2->th_dport = 0; /* XXX - don't specify remote port */
-	fi.fin_data[0] = sp;
-	fi.fin_data[1] = 0;
-	ip->ip_src = nat->nat_inip;
-	ip->ip_src = nat->nat_oip;
-	ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT, NAT_OUTBOUND);
-	if (ipn != NULL) {
-		ipn->nat_age = fr_defnatage;
-		(void) fr_addstate(ip, &fi, FI_W_DPORT);
+	if ((rap->rap_mode & RAP_M_UDP) == RAP_M_UDP) {
+		sp = rap->rap_plport;
+		tcp2->th_sport = htons(sp);
+		tcp2->th_dport = 0; /* XXX - don't specify remote port */
+		fi.fin_data[0] = sp;
+		fi.fin_data[1] = 0;
+		ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT,
+			      NAT_OUTBOUND);
+		if (ipn != NULL) {
+			ipn->nat_age = fr_defnatage;
+			(void) fr_addstate(ip, &fi, FI_W_DPORT);
+		}
 	}
-
+		
 	ip->ip_p = swp;
 	ip->ip_src = swa;
 	ip->ip_dst = swb;
diff --git a/sys/netinet/ipl.h b/sys/netinet/ipl.h
index 9ebb6abc239..9c4d8badf2d 100644
--- a/sys/netinet/ipl.h
+++ b/sys/netinet/ipl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipl.h,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/* $OpenBSD: ipl.h,v 1.2 1999/12/17 06:17:08 kjell Exp $ */
 /*
  * Copyright (C) 1993-1999 by Darren Reed.
  *
@@ -12,6 +12,6 @@
 #ifndef	__IPL_H__
 #define	__IPL_H__
 
-#define	IPL_VERSION	"IP Filter: v3.3.4"
+#define	IPL_VERSION	"IP Filter: v3.3.5"
 
 #endif