summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sbin/ipf/HISTORY23
-rw-r--r--sys/netinet/fil.c56
-rw-r--r--sys/netinet/ip_auth.c15
-rw-r--r--sys/netinet/ip_auth.h8
-rw-r--r--sys/netinet/ip_fil.c124
-rw-r--r--sys/netinet/ip_fil.h14
-rw-r--r--sys/netinet/ip_nat.c18
-rw-r--r--sys/netinet/ip_state.c14
-rw-r--r--sys/netinet/ipl.h4
9 files changed, 143 insertions, 133 deletions
diff --git a/sbin/ipf/HISTORY b/sbin/ipf/HISTORY
index 9b5a7433c31..be00c1875f4 100644
--- a/sbin/ipf/HISTORY
+++ b/sbin/ipf/HISTORY
@@ -1,4 +1,4 @@
-# $OpenBSD: HISTORY,v 1.7 2000/05/01 06:16:48 kjell Exp $
+# $OpenBSD: HISTORY,v 1.8 2000/05/24 21:59:11 kjell Exp $
#
# NOTE: Quite a few patches and suggestions come from other sources, to whom
# I'm greatly indebted, even if no names are mentioned.
@@ -21,6 +21,27 @@
# and especially those who have found the time to port IP Filter to new
# platforms.
#
+3.3.16 23/05/2000 - Released
+
+don't add TCP state if it is an RST packet and (attempt) to send out
+RST/ICMP packets in a manner that bypasses IP Filter.
+
+add patch to work with 4.0_STABLE delayed checksums
+
+3.3.15 20/05/2000 - Released
+
+fix destination being 0/32 in NAT map rules
+
+fix ipmon -F
+
+3.3.14 10/05/2000 - Released
+
+Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun
+
+ignore previous NAT mappings for 0/0 and 0/32 rules
+
+struct friostat got too big for SunOS4
+
3.3.13 26/04/2000 - Released
Fix parsing of "range" with "portmap"
diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index 05a4adaeea1..676b5418e0f 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: fil.c,v 1.24 2000/05/10 20:40:52 deraadt Exp $ */
+/* $OpenBSD: fil.c,v 1.25 2000/05/24 21:59:10 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
@@ -9,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$IPFilter: fil.c,v 2.3.2.18 2000/04/25 16:21:09 darrenr Exp $";
+static const char rcsid[] = "@(#)$IPFilter: fil.c,v 2.3.2.20 2000/05/22 06:57:42 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -99,9 +99,7 @@ extern int opts;
second; }
# define FR_VERBOSE(verb_pr) verbose verb_pr
# define FR_DEBUG(verb_pr) debug verb_pr
-# define SEND_RESET(ip, qif, if, m, fin) send_reset(ip, if)
# define IPLLOG(a, c, d, e) ipllog()
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
#else /* #ifndef _KERNEL */
# define FR_IFVERBOSE(ex,second,verb_pr) ;
# define FR_IFDEBUG(ex,second,verb_pr) ;
@@ -111,23 +109,6 @@ extern int opts;
# if SOLARIS || defined(__sgi)
extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
extern kmutex_t ipf_rw;
-# endif
-# if SOLARIS
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \
- ip, qif)
-# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip, qif)
-# define ICMP_ERROR(b, ip, t, c, if, dst) \
- icmp_error(ip, t, c, if, dst)
-# else /* SOLARIS */
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
-# ifdef linux
-# define SEND_RESET(ip, qif, if, fin) send_reset(ip, ifp)
-# define ICMP_ERROR(b, ip, t, c, if, dst) icmp_send(b,t,c,0,if)
-# else
-# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip)
-# define ICMP_ERROR(b, ip, t, c, if, dst) \
- send_icmp_err(ip, t, c, if, dst)
-# endif /* linux */
# endif /* SOLARIS || __sgi */
#endif /* _KERNEL */
@@ -247,12 +228,17 @@ fr_info_t *fin;
if (!off && (icmp->icmp_type == ICMP_ECHOREPLY ||
icmp->icmp_type == ICMP_ECHO))
minicmpsz = ICMP_MINLEN;
+
if (!off && (icmp->icmp_type == ICMP_TSTAMP ||
icmp->icmp_type == ICMP_TSTAMPREPLY))
- minicmpsz = 20; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + 3*timestamp(3*4) */
+ minicmpsz = 20;
+/* type(1) + code(1) + cksum(2) + id(2) + seq(2) + 3*timestamp(3*4) */
+
if (!off && (icmp->icmp_type == ICMP_MASKREQ ||
icmp->icmp_type == ICMP_MASKREPLY))
- minicmpsz = 12; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + mask(4) */
+ minicmpsz = 12;
+/* type(1) + code(1) + cksum(2) + id(2) + seq(2) + mask(4) */
+
if ((!(ip->ip_len >= hlen + minicmpsz) && !off) ||
(off && off < sizeof(struct icmp)))
fi->fi_fl |= FI_SHORT;
@@ -632,6 +618,16 @@ int out;
*/
m->m_flags &= ~M_CANFASTFWD;
# endif /* M_CANFASTFWD */
+# ifdef CSUM_DELAY_DATA
+ /*
+ * disable delayed checksums.
+ */
+ if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
+ in_delayed_cksum(m);
+ m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
+ }
+# endif /* CSUM_DELAY_DATA */
+
if ((ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP ||
ip->ip_p == IPPROTO_ICMP)) {
@@ -764,7 +760,7 @@ int out;
* then pretend we've dropped it already.
*/
if ((pass & FR_AUTH))
- if (FR_NEWAUTH(m, fin, ip, qif) != 0)
+ if (fr_newauth((mb_t *)m, fin, ip) != 0)
#ifdef _KERNEL
m = *mp = NULL;
#else
@@ -894,17 +890,11 @@ logit:
dst = ip->ip_dst;
else
dst.s_addr = 0;
-# if SOLARIS
- ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
- qif, dst);
-# else
- ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
- ifp, dst);
-# endif
+ send_icmp_err(ip, ICMP_UNREACH, fin, dst);
ATOMIC_INC(frstats[0].fr_ret);
} else if (((pass & FR_RETMASK) == FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
- if (SEND_RESET(ip, qif, ifp, fin) == 0) {
+ if (send_reset(ip, fin) == 0) {
ATOMIC_INC(frstats[1].fr_ret);
}
}
@@ -1197,7 +1187,7 @@ nodata:
* SUCH DAMAGE.
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * $IPFilter: fil.c,v 2.3.2.18 2000/04/25 16:21:09 darrenr Exp $
+ * $IPFilter: fil.c,v 2.3.2.20 2000/05/22 06:57:42 darrenr Exp $
*/
/*
* Copy data from an mbuf chain starting "off" bytes from the beginning,
diff --git a/sys/netinet/ip_auth.c b/sys/netinet/ip_auth.c
index 43e73374df0..67f134fcd9d 100644
--- a/sys/netinet/ip_auth.c
+++ b/sys/netinet/ip_auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_auth.c,v 1.13 2000/05/01 06:16:47 kjell Exp $ */
+/* $OpenBSD: ip_auth.c,v 1.14 2000/05/24 21:59:10 kjell Exp $ */
/*
* Copyright (C) 1998 by Darren Reed & Guido van Rooij.
@@ -8,7 +8,7 @@
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$IPFilter: ip_auth.c,v 2.1.2.3 2000/04/25 16:21:12 darrenr Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_auth.c,v 2.1.2.4 2000/05/22 06:57:45 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -198,17 +198,14 @@ fr_info_t *fin;
* If we do, store it and wake up any user programs which are waiting to
* hear about these events.
*/
-int fr_newauth(m, fin, ip
-#if defined(_KERNEL) && SOLARIS
-, qif)
-qif_t *qif;
-#else
-)
-#endif
+int fr_newauth(m, fin, ip)
mb_t *m;
fr_info_t *fin;
ip_t *ip;
{
+#if defined(_KERNEL) && SOLARIS
+ qif_t *qif = fin->fin_qif;
+#endif
int i;
WRITE_ENTER(&ipf_auth);
diff --git a/sys/netinet/ip_auth.h b/sys/netinet/ip_auth.h
index 3a23b0fe9c3..adbed16d23f 100644
--- a/sys/netinet/ip_auth.h
+++ b/sys/netinet/ip_auth.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_auth.h,v 1.7 2000/03/13 23:40:17 kjell Exp $ */
+/* $OpenBSD: ip_auth.h,v 1.8 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1997-1998 by Darren Reed & Guido Van Rooij.
@@ -7,7 +7,7 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $IPFilter: ip_auth.h,v 2.1 1999/08/04 17:29:54 darrenr Exp $
+ * $IPFilter: ip_auth.h,v 2.1.2.1 2000/05/22 06:57:47 darrenr Exp $
*
*/
#ifndef __IP_AUTH_H__
@@ -56,11 +56,7 @@ extern u_32_t fr_checkauth __P((ip_t *, fr_info_t *));
extern void fr_authexpire __P((void));
extern void fr_authunload __P((void));
extern mb_t *fr_authpkts[];
-#if defined(_KERNEL) && SOLARIS
-extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *, qif_t *));
-#else
extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *));
-#endif
#if defined(__NetBSD__) || defined(__OpenBSD__)
extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **));
#else
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index c13b9416216..5f5cb113d24 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_fil.c,v 1.34 2000/05/01 06:16:47 kjell Exp $ */
+/* $OpenBSD: ip_fil.c,v 1.35 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
@@ -9,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$IPFilter: ip_fil.c,v 2.4.2.20 2000/04/18 16:31:27 darrenr Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_fil.c,v 2.4.2.21 2000/05/22 06:57:47 darrenr Exp $";
#endif
#ifndef SOLARIS
@@ -144,7 +144,7 @@ static int frrequest __P((int, int, caddr_t, int));
#endif
#ifdef _KERNEL
static int (*fr_savep) __P((ip_t *, int, void *, int, struct mbuf **));
-static int send_ip __P((struct mbuf *, ip_t *));
+static int send_ip __P((ip_t *, fr_info_t *, struct mbuf *));
# ifdef __sgi
extern kmutex_t ipf_rw;
extern KRWLOCK_T ipf_mutex;
@@ -914,12 +914,11 @@ register struct uio *uio;
* send_reset - this could conceivably be a call to tcp_respond(), but that
* requires a large amount of setting up and isn't any more efficient.
*/
-int send_reset(fin, oip)
-fr_info_t *fin;
+int send_reset(oip, fin)
struct ip *oip;
+fr_info_t *fin;
{
struct tcphdr *tcp, *tcp2;
- struct tcpiphdr *tp;
struct mbuf *m;
int tlen = 0;
ip_t *ip;
@@ -942,13 +941,12 @@ struct ip *oip;
m->m_len = sizeof(*tcp2) + sizeof(*ip);
# if BSD >= 199306
m->m_data += max_linkhdr;
- m->m_pkthdr.len = m->m_len;
+ m->m_pkthdr.len = sizeof(*tcp2) + sizeof(*ip);
m->m_pkthdr.rcvif = (struct ifnet *)0;
# endif
- bzero(mtod(m, char *), sizeof(struct tcpiphdr));
ip = mtod(m, struct ip *);
- tp = mtod(m, struct tcpiphdr *);
- tcp2 = (struct tcphdr *)((char *)ip + sizeof(*ip));
+ bzero((char *)ip, sizeof(*tcp2) + sizeof(*ip));
+ tcp2 = (struct tcphdr *)(ip + 1);
ip->ip_src.s_addr = oip->ip_dst.s_addr;
ip->ip_dst.s_addr = oip->ip_src.s_addr;
@@ -959,27 +957,25 @@ struct ip *oip;
tcp2->th_ack = htonl(tcp2->th_ack);
tcp2->th_off = sizeof(*tcp2) >> 2;
tcp2->th_flags = TH_RST|TH_ACK;
- tp->ti_pr = oip->ip_p;
- tp->ti_len = htons(sizeof(struct tcphdr));
+ ip->ip_p = IPPROTO_TCP;
+ ip->ip_len = htons(sizeof(struct tcphdr));
tcp2->th_sum = in_cksum(m, sizeof(*ip) + sizeof(*tcp2));
+ ip->ip_id = oip->ip_id;
ip->ip_tos = oip->ip_tos;
- ip->ip_p = oip->ip_p;
ip->ip_len = sizeof(*ip) + sizeof(*tcp2);
- return send_ip(m, ip);
+ return send_ip(ip, fin, m);
}
-static int send_ip(m, ip)
+static int send_ip(ip, fin, m)
+fr_info_t *fin;
struct mbuf *m;
ip_t *ip;
{
-# if (defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)) || \
- (defined(_BSDI_VERSION) && (_BSDI_VERSION >= 199802))
- struct route ro;
-# endif
-
+ ip->ip_v = IPVERSION;
+ ip->ip_hl = (sizeof(*ip) >> 2);
# if (BSD < 199306) || defined(__sgi)
ip->ip_ttl = tcp_ttl;
# else
@@ -989,43 +985,34 @@ ip_t *ip;
# ifdef IPSEC
m->m_pkthdr.rcvif = NULL;
# endif
-# if defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
- {
- int err;
-
- bzero((char *)&ro, sizeof(ro));
- err = ip_output(m, (struct mbuf *)0, &ro, 0, 0);
- if (ro.ro_rt)
- RTFREE(ro.ro_rt);
- return err;
- }
-# else
- /*
- * extra 0 in case of multicast
- */
-# if _BSDI_VERSION >= 199802
- return ip_output(m, (struct mbuf *)0, &ro, 0, 0, NULL);
-# else
-# if defined(__OpenBSD__)
- return ip_output(m, (struct mbuf *)0, 0, 0, 0, NULL);
-# else
- return ip_output(m, (struct mbuf *)0, 0, 0, 0);
-# endif
-# endif
-# endif
+ return ipfr_fastroute(m, fin, NULL);
}
-int send_icmp_err(oip, type, code, ifp, dst)
+int send_icmp_err(oip, type, fin, dst)
ip_t *oip;
-int type, code;
-void *ifp;
+int type;
+fr_info_t *fin;
struct in_addr dst;
{
struct icmp *icmp;
struct mbuf *m;
ip_t *nip;
+ int code;
+
+ if ((oip->ip_p == IPPROTO_ICMP) && !(fin->fin_fi.fi_fl & FI_SHORT))
+ switch (ntohs(fin->fin_data[0]) >> 8)
+ {
+ case ICMP_ECHO :
+ case ICMP_TSTAMP :
+ case ICMP_IREQ :
+ case ICMP_MASKREQ :
+ break;
+ default :
+ return 0;
+ }
+ code = fin->fin_icode;
# if (BSD < 199306) || defined(__sgi)
m = m_get(M_DONTWAIT, MT_HEADER);
# else
@@ -1044,8 +1031,6 @@ struct in_addr dst;
nip = mtod(m, ip_t *);
icmp = (struct icmp *)(nip + 1);
- nip->ip_v = IPVERSION;
- nip->ip_hl = (sizeof(*nip) >> 2);
nip->ip_p = IPPROTO_ICMP;
nip->ip_id = oip->ip_id;
nip->ip_sum = 0;
@@ -1053,7 +1038,7 @@ struct in_addr dst;
nip->ip_tos = oip->ip_tos;
nip->ip_len = sizeof(*nip) + sizeof(*icmp) + 8;
if (dst.s_addr == 0) {
- if (fr_ifpaddr(ifp, &dst) == -1)
+ if (fr_ifpaddr(fin->fin_ifp, &dst) == -1)
return -1;
}
nip->ip_src = dst;
@@ -1077,7 +1062,7 @@ struct in_addr dst;
}
# endif
icmp->icmp_cksum = ipf_cksum((u_short *)icmp, sizeof(*icmp) + 8);
- return send_ip(m, nip);
+ return send_ip(nip, fin, m);
}
@@ -1119,10 +1104,10 @@ frdest_t *fdp;
register struct ip *ip, *mhip;
register struct mbuf *m = m0;
register struct route *ro;
- int len, off, error = 0, hlen;
+ int len, off, error = 0, hlen, code;
+ struct ifnet *ifp, *sifp;
struct sockaddr_in *dst;
struct route iproute;
- struct ifnet *ifp;
frentry_t *fr;
hlen = fin->fin_hlen;
@@ -1136,7 +1121,13 @@ frdest_t *fdp;
dst->sin_family = AF_INET;
fr = fin->fin_fr;
- ifp = fdp->fd_ifp;
+ if (fdp)
+ ifp = fdp->fd_ifp;
+ else {
+ ifp = fin->fin_ifp;
+ dst->sin_addr = ip->ip_dst;
+ }
+
/*
* In case we're here due to "to <if>" being used with "keep state",
* check that we're going in the correct direction.
@@ -1145,9 +1136,10 @@ frdest_t *fdp;
if ((ifp != NULL) && (fdp == &fr->fr_tif))
return -1;
dst->sin_addr = ip->ip_dst;
- } else
+ } else if (fdp)
dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
-# ifdef __bsdi__
+
+# if BSD >= 199306
dst->sin_len = sizeof(*dst);
# endif
# if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) && \
@@ -1161,7 +1153,7 @@ frdest_t *fdp;
rtalloc(ro);
# endif
if (!ifp) {
- if (!(fin->fin_fr->fr_flags & FR_FASTROUTE)) {
+ if (!fr || !(fr->fr_flags & FR_FASTROUTE)) {
error = -2;
goto bad;
}
@@ -1191,8 +1183,10 @@ frdest_t *fdp;
ATOMIC_INC(frstats[1].fr_acct);
}
fin->fin_fr = NULL;
- (void) fr_checkstate(ip, fin);
- (void) ip_natout(ip, fin);
+ if (!fr || !(fr->fr_flags & FR_RETMASK)) {
+ (void) fr_checkstate(ip, fin);
+ (void) ip_natout(ip, fin);
+ }
} else
ip->ip_sum = 0;
/*
@@ -1316,9 +1310,15 @@ done:
RTFREE(ro->ro_rt);
return 0;
bad:
- if (error == EMSGSIZE)
- (void) send_icmp_err(ip, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
- ifp, ip->ip_dst);
+ if (error == EMSGSIZE) {
+ sifp = fin->fin_ifp;
+ fin->fin_ifp = ifp;
+ code = fin->fin_icode;
+ fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
+ (void) send_icmp_err(ip, ICMP_UNREACH, fin, ip->ip_dst);
+ fin->fin_ifp = sifp;
+ fin->fin_icode = code;
+ }
m_freem(m);
goto done;
}
diff --git a/sys/netinet/ip_fil.h b/sys/netinet/ip_fil.h
index e930e6783c1..4ca811561b3 100644
--- a/sys/netinet/ip_fil.h
+++ b/sys/netinet/ip_fil.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_fil.h,v 1.19 2000/05/10 20:40:53 deraadt Exp $ */
+/* $OpenBSD: ip_fil.h,v 1.20 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
@@ -8,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_fil.h 1.35 6/5/96
- * $IPFilter: ip_fil.h,v 2.3.2.9 2000/03/08 11:43:30 darrenr Exp $
+ * $IPFilter: ip_fil.h,v 2.3.2.11 2000/05/22 06:57:50 darrenr Exp $
*/
#ifndef __IP_FIL_H__
@@ -459,11 +459,12 @@ extern int ipflog_clear __P((minor_t));
extern int ipflog_read __P((minor_t, struct uio *));
extern int ipflog __P((u_int, ip_t *, fr_info_t *, mb_t *));
extern int ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
+extern int send_icmp_err __P((ip_t *, int, fr_info_t *, struct in_addr));
+extern int send_reset __P((ip_t *, fr_info_t *));
# if SOLARIS
extern int fr_check __P((ip_t *, int, void *, int, qif_t *, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *,
int, qif_t *, mb_t **));
-extern int icmp_error __P((ip_t *, int, int, qif_t *, struct in_addr));
# if SOLARIS2 >= 7
extern int iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
# else
@@ -472,7 +473,6 @@ extern int iplioctl __P((dev_t, int, int *, int, cred_t *, int *));
extern int iplopen __P((dev_t *, int, int, cred_t *));
extern int iplclose __P((dev_t, int, int, cred_t *));
extern int ipfsync __P((void));
-extern int send_reset __P((fr_info_t *, ip_t *, qif_t *));
extern int ipfr_fastroute __P((qif_t *, ip_t *, mblk_t *, mblk_t **,
fr_info_t *, frdest_t *));
extern void copyin_mblk __P((mblk_t *, size_t, size_t, char *));
@@ -485,12 +485,6 @@ extern int iplread __P((dev_t, struct uio *, cred_t *));
# else /* SOLARIS */
extern int fr_check __P((ip_t *, int, void *, int, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-# ifdef linux
-extern int send_reset __P((tcpiphdr_t *, struct ifnet *));
-# else
-extern int send_reset __P((fr_info_t *, struct ip *));
-extern int send_icmp_err __P((ip_t *, int, int, void *, struct in_addr));
-# endif
extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *));
extern size_t mbufchainlen __P((mb_t *));
# ifdef __sgi
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index b62baa9691e..15ab3908c88 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_nat.c,v 1.31 2000/05/10 20:40:53 deraadt Exp $ */
+/* $OpenBSD: ip_nat.c,v 1.32 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1995-1998 by Darren Reed.
@@ -11,7 +11,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$IPFilter: ip_nat.c,v 2.2.2.15 2000/04/25 16:21:13 darrenr Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_nat.c,v 2.2.2.18 2000/05/19 15:52:29 darrenr Exp $";
#endif
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
@@ -326,11 +326,17 @@ int mode;
{
#ifdef IPFILTER_LOG
case SIOCIPFFB :
+ {
+ int tmp;
+
if (!(mode & FWRITE))
error = EPERM;
- else
- *(int *)data = ipflog_clear(IPL_LOGNAT);
+ else {
+ tmp = ipflog_clear(IPL_LOGNAT);
+ IWCOPY((char *)&tmp, (char *)data, sizeof(tmp));
+ }
break;
+ }
#endif
case SIOCADNAT :
if (!(mode & FWRITE)) {
@@ -800,7 +806,7 @@ int direction;
port += MAPBLK_MINPORT;
port = htons(port);
}
- } else if (!np->in_nip &&
+ } else if (!np->in_outip &&
(np->in_outmsk == 0xffffffff)) {
/*
* 0/32 - use the interface's IP address.
@@ -811,7 +817,7 @@ int direction;
return NULL;
}
in.s_addr = ntohl(in.s_addr);
- } else if (!np->in_nip && !np->in_outmsk) {
+ } else if (!np->in_outip && !np->in_outmsk) {
/*
* 0/0 - use the original source address/port.
*/
diff --git a/sys/netinet/ip_state.c b/sys/netinet/ip_state.c
index 849ec516837..983d2ca299b 100644
--- a/sys/netinet/ip_state.c
+++ b/sys/netinet/ip_state.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_state.c,v 1.21 2000/05/01 06:16:47 kjell Exp $ */
+/* $OpenBSD: ip_state.c,v 1.22 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1995-1998 by Darren Reed.
@@ -9,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$IPFilter: ip_state.c,v 2.3.2.23 2000/04/25 16:21:16 darrenr Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_state.c,v 2.3.2.25 2000/05/22 06:57:53 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -232,8 +232,12 @@ int mode;
case SIOCIPFFB :
if (!(mode & FWRITE))
error = EPERM;
- else
- *(int *)data = ipflog_clear(IPL_LOGSTATE);
+ else {
+ int tmp;
+
+ tmp = ipflog_clear(IPL_LOGSTATE);
+ IWCOPY((char *)&tmp, data, sizeof(tmp));
+ }
break;
#endif
case SIOCGIPST :
@@ -314,6 +318,8 @@ u_int flags;
{
register tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
+ if (tcp->th_flags & TH_RST)
+ return NULL;
/*
* The endian of the ports doesn't matter, but the ack and
* sequence numbers do as we do mathematics on them later.
diff --git a/sys/netinet/ipl.h b/sys/netinet/ipl.h
index 64458d225e9..ffdd854ff0d 100644
--- a/sys/netinet/ipl.h
+++ b/sys/netinet/ipl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipl.h,v 1.10 2000/05/10 20:40:53 deraadt Exp $ */
+/* $OpenBSD: ipl.h,v 1.11 2000/05/24 21:59:11 kjell Exp $ */
/*
* Copyright (C) 1993-1999 by Darren Reed.
@@ -13,6 +13,6 @@
#ifndef __IPL_H__
#define __IPL_H__
-#define IPL_VERSION "IP Filter: v3.3.14"
+#define IPL_VERSION "IP Filter: v3.3.16"
#endif
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 21:26:58 +0000