summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
Diffstat (limited to 'sys')
-rw-r--r--sys/netinet/fil.c21
-rw-r--r--sys/netinet/ip_auth.c7
-rw-r--r--sys/netinet/ip_auth.h5
-rw-r--r--sys/netinet/ip_fil.c66
-rw-r--r--sys/netinet/ip_fil.h16
-rw-r--r--sys/netinet/ip_fil_compat.h5
-rw-r--r--sys/netinet/ip_frag.c5
-rw-r--r--sys/netinet/ip_frag.h5
-rw-r--r--sys/netinet/ip_ftp_pxy.c3
-rw-r--r--sys/netinet/ip_log.c5
-rw-r--r--sys/netinet/ip_nat.c18
-rw-r--r--sys/netinet/ip_nat.h6
-rw-r--r--sys/netinet/ip_proxy.c5
-rw-r--r--sys/netinet/ip_proxy.h5
-rw-r--r--sys/netinet/ip_raudio_pxy.c3
-rw-r--r--sys/netinet/ip_rcmd_pxy.c3
-rw-r--r--sys/netinet/ip_state.c56
-rw-r--r--sys/netinet/ip_state.h6
-rw-r--r--sys/netinet/ipl.h5
19 files changed, 136 insertions, 109 deletions
diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index eff9d8d23b1..a51f2b0c4bc 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $ */
+/* $OpenBSD: fil.c,v 1.20 2000/02/01 19:29:57 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -8,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: fil.c,v 2.3.2.16 2000/01/27 08:49:37 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -246,6 +247,12 @@ fr_info_t *fin;
if (!off && (icmp->icmp_type == ICMP_ECHOREPLY ||
icmp->icmp_type == ICMP_ECHO))
minicmpsz = ICMP_MINLEN;
+ if (!off && (icmp->icmp_type == ICMP_TSTAMP ||
+ icmp->icmp_type == ICMP_TSTAMPREPLY))
+ minicmpsz = 20; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + 3*timestamp(3*4) */
+ if (!off && (icmp->icmp_type == ICMP_MASKREQ ||
+ icmp->icmp_type == ICMP_MASKREPLY))
+ minicmpsz = 12; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + mask(4) */
if ((!(ip->ip_len >= hlen + minicmpsz) && !off) ||
(off && off < sizeof(struct icmp)))
fi->fi_fl |= FI_SHORT;
@@ -631,7 +638,7 @@ int out;
case IPPROTO_UDP:
plen = sizeof(udphdr_t);
break;
- /* need enough for complete ICMP error IP header */
+ /* 96 - enough for complete ICMP error IP header */
case IPPROTO_ICMP:
plen = ICMPERR_MAXPKTLEN - sizeof(ip_t);
break;
@@ -689,6 +696,9 @@ int out;
READ_ENTER(&ipf_mutex);
+ if (fin->fin_fi.fi_fl & FI_SHORT)
+ ATOMIC_INC(frstats[out].fr_short);
+
/*
* Check auth now. This, combined with the check below to see if apass
* is 0 is to ensure that we don't count the packet twice, which can
@@ -1179,7 +1189,7 @@ nodata:
* SUCH DAMAGE.
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 1.19 1999/12/17 06:17:07 kjell Exp $
+ * $IPFilter: fil.c,v 2.3.2.16 2000/01/27 08:49:37 darrenr Exp $
*/
/*
* Copy data from an mbuf chain starting "off" bytes from the beginning,
@@ -1580,7 +1590,10 @@ void frsync()
# else
for (ifp = ifnet; ifp; ifp = ifp->if_next)
# endif
+ {
ip_natsync(ifp);
+ ip_statesync(ifp);
+ }
# endif
WRITE_ENTER(&ipf_mutex);
diff --git a/sys/netinet/ip_auth.c b/sys/netinet/ip_auth.c
index ad69de43d9d..bca4a7a5da6 100644
--- a/sys/netinet/ip_auth.c
+++ b/sys/netinet/ip_auth.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_auth.c,v 1.9 1999/12/15 05:20:21 kjell Exp $ */
+/* $OpenBSD: ip_auth.c,v 1.10 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1998 by Darren Reed & Guido van Rooij.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_auth.c,v 1.9 1999/12/15 05:20:21 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_auth.c,v 2.1.2.2 2000/01/16 10:12:14 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -397,7 +398,7 @@ fr_authioctlloop:
# if SOLARIS
error = fr_qout(fr_auth[i].fra_q, m);
# else /* SOLARIS */
-# if ((_BSDI_VERSION >= 199802) || defined(__OpenBSD__))
+# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__)
error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
NULL);
# else
diff --git a/sys/netinet/ip_auth.h b/sys/netinet/ip_auth.h
index 7f6dead90e7..2e6492ea84a 100644
--- a/sys/netinet/ip_auth.h
+++ b/sys/netinet/ip_auth.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_auth.h,v 1.4 1999/12/15 05:20:21 kjell Exp $ */
+/* $OpenBSD: ip_auth.h,v 1.5 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1997-1998 by Darren Reed & Guido Van Rooij.
*
@@ -6,7 +7,7 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_auth.h,v 1.4 1999/12/15 05:20:21 kjell Exp $
+ * $IPFilter: ip_auth.h,v 2.1 1999/08/04 17:29:54 darrenr Exp $
*
*/
#ifndef __IP_AUTH_H__
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index 45a71603e54..681c9475688 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_fil.c,v 1.28 1999/12/17 06:17:08 kjell Exp $ */
+/* $OpenBSD: ip_fil.c,v 1.29 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -8,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.28 1999/12/17 06:17:08 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_fil.c,v 2.4.2.16 2000/01/16 10:12:42 darrenr Exp $";
#endif
#ifndef SOLARIS
@@ -127,7 +128,6 @@ extern int tcp_ttl;
# endif
#endif
-int ipl_inited = 0;
# if defined (__OpenBSD__)
int ipl_unreach = ICMP_UNREACH_FILTER_PROHIB;
# else
@@ -226,20 +226,8 @@ int count;
}
# endif
-#if defined( __OpenBSD__)
-/*
- * Since iplattach() is called by main() at boot time, we put in a
- * fake stub so that none of the machinery is initialized till explicitly
- * enabled via ipf -E. Therefore we rename the real iplattach() to
- * ipl_enable(). See also skeleton iplinit() later in this file.
- */
-void iplattach __P((int));
-void iplattach(int dummy) {};
-int ipl_enable()
-# else
int iplattach()
-# endif /* OpenBSD */
{
char *defpass;
int s;
@@ -248,7 +236,7 @@ int iplattach()
# endif
SPL_NET(s);
- if (ipl_inited || (fr_checkp == fr_check)) {
+ if (fr_running || (fr_checkp == fr_check)) {
printf("IP Filter: already initialized\n");
SPL_X(s);
return EBUSY;
@@ -276,7 +264,6 @@ int iplattach()
}
# endif
- ipl_inited = 1;
bzero((char *)frcache, sizeof(frcache));
fr_savep = fr_checkp;
fr_checkp = fr_check;
@@ -304,6 +291,7 @@ int iplattach()
timeout(ipfr_slowtimer, NULL, hz/2);
# endif
#endif
+ fr_running = 1;
return 0;
}
@@ -312,11 +300,7 @@ int iplattach()
* Disable the filter by removing the hooks from the IP input/output
* stream.
*/
-# if defined(__OpenBSD__)
-int ipl_disable()
-# else
int ipldetach()
-# endif
{
int s, i = FR_INQUE|FR_OUTQUE;
@@ -332,7 +316,7 @@ int ipldetach()
# endif
#endif
SPL_NET(s);
- if (!ipl_inited)
+ if (!fr_running)
{
printf("IP Filter: not initialized\n");
SPL_X(s);
@@ -341,7 +325,7 @@ int ipldetach()
fr_checkp = fr_savep;
i = frflush(IPL_LOGIPF, i);
- ipl_inited = 0;
+ fr_running = 0;
# ifdef NETBSD_PF
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
@@ -464,11 +448,15 @@ int mode;
SPL_NET(s);
if (unit == IPL_LOGNAT) {
+ if (!fr_running)
+ return EIO;
error = nat_ioctl(data, cmd, mode);
SPL_X(s);
return error;
}
if (unit == IPL_LOGSTATE) {
+ if (!fr_running)
+ return EIO;
error = fr_state_ioctl(data, cmd, mode);
SPL_X(s);
return error;
@@ -489,23 +477,10 @@ int mode;
error = EPERM;
else {
IRCOPY(data, (caddr_t)&enable, sizeof(enable));
- if (enable) {
-# if defined(__OpenBSD__)
- error = ipl_enable();
-# else
+ if (enable)
error = iplattach();
-# endif
- if (error == 0)
- fr_running = 1;
- } else {
-# if defined(__OpenBSD__)
- error = ipl_disable();
-# else
+ else
error = ipldetach();
-# endif
- if (error == 0)
- fr_running = 0;
- }
}
break;
}
@@ -762,13 +737,15 @@ caddr_t data;
}
if (!f) {
- if (req != SIOCINAFR || req != SIOCINIFR)
+ if (req != SIOCINAFR && req != SIOCINIFR)
while ((f = *ftail))
ftail = &f->fr_next;
else {
- if (fp->fr_hits)
+ if (fp->fr_hits) {
+ ftail = fprev;
while (--fp->fr_hits && (f = *ftail))
ftail = &f->fr_next;
+ }
f = NULL;
}
}
@@ -1004,8 +981,8 @@ ip_t *ip;
# if _BSDI_VERSION >= 199802
return ip_output(m, (struct mbuf *)0, &ro, 0, 0, NULL);
# else
-# if defined(__OpenBSD__)
- return ip_output(m, (struct mbuf *)0, 0, 0, 0, NULL);
+# if defined(__OpenBSD__)
+ return ip_output(m, (struct mbuf *)0, 0, 0, 0, NULL);
# else
return ip_output(m, (struct mbuf *)0, 0, 0, 0);
# endif
@@ -1091,13 +1068,8 @@ void
# endif
iplinit()
{
-# if defined(__OpenBSD__)
- /* must explicitly enable with 'ipf -E'
- * which invokes ipl_enable(); */
-# else
if (iplattach() != 0)
printf("IP Filter failed to attach\n");
-# endif
ip_init();
}
# endif /* ! __NetBSD__ */
diff --git a/sys/netinet/ip_fil.h b/sys/netinet/ip_fil.h
index 96bc712f0d0..45f16bd5c04 100644
--- a/sys/netinet/ip_fil.h
+++ b/sys/netinet/ip_fil.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_fil.h,v 1.14 1999/12/28 08:20:40 kjell Exp $ */
+/* $OpenBSD: ip_fil.h,v 1.15 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_fil.h 1.35 6/5/96
- * $Id: ip_fil.h,v 1.14 1999/12/28 08:20:40 kjell Exp $
+ * $IPFilter: ip_fil.h,v 2.3.2.7 2000/01/27 08:49:41 darrenr Exp $
*/
#ifndef __IP_FIL_H__
@@ -272,6 +273,7 @@ typedef struct filterstats {
u_long fr_pass; /* packets allowed */
u_long fr_block; /* packets denied */
u_long fr_nom; /* packets which don't match any rule */
+ u_long fr_short; /* packets which are short */
u_long fr_ppkl; /* packets allowed and logged */
u_long fr_bpkl; /* packets denied and logged */
u_long fr_npkl; /* packets unmatched and logged */
@@ -448,15 +450,7 @@ extern int iplclose __P((dev_t, int));
# if defined(__NetBSD__) && defined(PFIL_HOOKS)
extern void ipfilterattach __P((int));
# endif
-
-#if !defined(__OpenBSD__)
-/*
- * OpenBSD has this call in the kernel but doesn't export it to userland.
- * See ip_fil.c for actual hook and more details.
- */
extern int iplattach __P((void));
-#endif
-
extern int ipl_enable __P((void));
extern int ipl_disable __P((void));
extern void ipflog_init __P((void));
@@ -563,7 +557,7 @@ extern void fr_makefrip __P((int, ip_t *, fr_info_t *));
extern int fr_ifpaddr __P((void *, struct in_addr *));
extern char *memstr __P((char *, char *, int, int));
extern int ipl_unreach;
-extern int ipl_inited;
+extern int fr_running;
extern u_long ipl_frouteok[2];
extern int fr_pass;
extern int fr_flags;
diff --git a/sys/netinet/ip_fil_compat.h b/sys/netinet/ip_fil_compat.h
index eab1ee7e804..49a53893719 100644
--- a/sys/netinet/ip_fil_compat.h
+++ b/sys/netinet/ip_fil_compat.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_fil_compat.h,v 1.11 1999/12/15 05:20:21 kjell Exp $ */
+/* $OpenBSD: ip_fil_compat.h,v 1.12 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_compat.h 1.8 1/14/96
- * $Id: ip_fil_compat.h,v 1.11 1999/12/15 05:20:21 kjell Exp $
+ * $IPFilter: ip_compat.h,v 2.1.2.3 1999/11/18 13:55:26 darrenr Exp $
*/
#ifndef __IP_COMPAT_H__
diff --git a/sys/netinet/ip_frag.c b/sys/netinet/ip_frag.c
index 1444e14c23d..8c376473ec7 100644
--- a/sys/netinet/ip_frag.c
+++ b/sys/netinet/ip_frag.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_frag.c,v 1.14 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_frag.c,v 1.15 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -8,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_frag.c,v 1.14 1999/12/15 05:20:22 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_frag.c,v 2.4.2.4 1999/11/28 04:52:10 darrenr Exp $";
#endif
#if defined(KERNEL) && !defined(_KERNEL)
diff --git a/sys/netinet/ip_frag.h b/sys/netinet/ip_frag.h
index 647bf54dc29..730abffbd67 100644
--- a/sys/netinet/ip_frag.h
+++ b/sys/netinet/ip_frag.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_frag.h,v 1.9 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_frag.h,v 1.10 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_frag.h 1.5 3/24/96
- * $Id: ip_frag.h,v 1.9 1999/12/15 05:20:22 kjell Exp $
+ * $IPFilter: ip_frag.h,v 2.2 1999/08/06 06:26:38 darrenr Exp $
*/
#ifndef __IP_FRAG_H__
diff --git a/sys/netinet/ip_ftp_pxy.c b/sys/netinet/ip_ftp_pxy.c
index 08e5ce5ae3f..bdb1e5e381e 100644
--- a/sys/netinet/ip_ftp_pxy.c
+++ b/sys/netinet/ip_ftp_pxy.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_ftp_pxy.c,v 1.5 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_ftp_pxy.c,v 1.6 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Simple FTP transparent proxy for in-kernel use. For use with the NAT
* code.
diff --git a/sys/netinet/ip_log.c b/sys/netinet/ip_log.c
index 87c9de1c4a1..d458053c0a0 100644
--- a/sys/netinet/ip_log.c
+++ b/sys/netinet/ip_log.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_log.c,v 1.5 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_log.c,v 1.6 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1997-1998 by Darren Reed.
*
@@ -6,7 +7,7 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_log.c,v 1.5 1999/12/15 05:20:22 kjell Exp $
+ * $IPFilter: ip_log.c,v 2.1.2.2 1999/09/21 11:55:44 darrenr Exp $
*/
#include <sys/param.h>
#if defined(KERNEL) && !defined(_KERNEL)
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index ffd708579ba..34f9d120ff8 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_nat.c,v 1.25 1999/12/17 07:50:05 kjell Exp $ */
+/* $OpenBSD: ip_nat.c,v 1.26 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
@@ -10,7 +11,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 1.25 1999/12/17 07:50:05 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_nat.c,v 2.2.2.12 2000/01/24 12:43:40 darrenr Exp $";
#endif
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
@@ -744,12 +745,22 @@ int direction;
port = 0;
in.s_addr = np->in_nip;
if (l == 0) {
+ /*
+ * Check to see if there is an existing NAT
+ * setup for this IP address pair.
+ */
natl = nat_maplookup(fin->fin_ifp, flags,
ip->ip_src, ip->ip_dst);
if (natl != NULL) {
in = natl->nat_outip;
+ if ((in.s_addr & np->in_outmsk) !=
+ np->in_outip)
+ in.s_addr = 0;
+ else
#ifndef sparc
- in.s_addr = ntohl(in.s_addr);
+ in.s_addr = ntohl(in.s_addr);
+#else
+ ;
#endif
}
}
@@ -1784,6 +1795,7 @@ u_int type;
natl.nl_origport = nat->nat_oport;
natl.nl_inport = nat->nat_inport;
natl.nl_outport = nat->nat_outport;
+ natl.nl_p = nat->nat_p;
natl.nl_type = type;
natl.nl_rule = -1;
#ifndef LARGE_NAT
diff --git a/sys/netinet/ip_nat.h b/sys/netinet/ip_nat.h
index 60f4533c844..1e87fba23fe 100644
--- a/sys/netinet/ip_nat.h
+++ b/sys/netinet/ip_nat.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_nat.h,v 1.13 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_nat.h,v 1.14 2000/02/01 19:29:58 kjell Exp $ */
+
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_nat.h 1.5 2/4/96
- * $Id: ip_nat.h,v 1.13 1999/12/15 05:20:22 kjell Exp $
+ * $IPFilter: ip_nat.h,v 2.1.2.3 2000/01/24 12:44:24 darrenr Exp $
*/
#ifndef __IP_NAT_H__
@@ -187,6 +188,7 @@ typedef struct natlog {
int nl_rule;
U_QUAD_T nl_pkts;
U_QUAD_T nl_bytes;
+ u_char nl_p;
} natlog_t;
diff --git a/sys/netinet/ip_proxy.c b/sys/netinet/ip_proxy.c
index 0cf9c2d265c..49adee8d3e5 100644
--- a/sys/netinet/ip_proxy.c
+++ b/sys/netinet/ip_proxy.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_proxy.c,v 1.5 1999/12/15 05:20:22 kjell Exp $ */
+/* $OpenBSD: ip_proxy.c,v 1.6 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Copyright (C) 1997-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 1.5 1999/12/15 05:20:22 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_proxy.c,v 2.2.2.1 1999/09/19 12:18:19 darrenr Exp $";
#endif
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
diff --git a/sys/netinet/ip_proxy.h b/sys/netinet/ip_proxy.h
index bcc464b1779..330d84a1cb3 100644
--- a/sys/netinet/ip_proxy.h
+++ b/sys/netinet/ip_proxy.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_proxy.h,v 1.4 1999/12/15 05:20:23 kjell Exp $ */
+/* $OpenBSD: ip_proxy.h,v 1.5 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Copyright (C) 1997-1998 by Darren Reed.
*
@@ -6,7 +7,7 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_proxy.h,v 1.4 1999/12/15 05:20:23 kjell Exp $
+ * $IPFilter: ip_proxy.h,v 2.1.2.1 1999/09/19 12:18:20 darrenr Exp $
*/
#ifndef __IP_PROXY_H__
diff --git a/sys/netinet/ip_raudio_pxy.c b/sys/netinet/ip_raudio_pxy.c
index 7d9ab5b3291..0c84298e392 100644
--- a/sys/netinet/ip_raudio_pxy.c
+++ b/sys/netinet/ip_raudio_pxy.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_raudio_pxy.c,v 1.3 1999/12/28 08:20:40 kjell Exp $ */
+/* $OpenBSD: ip_raudio_pxy.c,v 1.4 2000/02/01 19:29:59 kjell Exp $ */
+
#if SOLARIS && defined(_KERNEL)
extern kmutex_t ipf_rw;
#endif
diff --git a/sys/netinet/ip_rcmd_pxy.c b/sys/netinet/ip_rcmd_pxy.c
index 5782e9f3400..7f9cd27b53b 100644
--- a/sys/netinet/ip_rcmd_pxy.c
+++ b/sys/netinet/ip_rcmd_pxy.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_rcmd_pxy.c,v 1.1 1999/12/14 04:17:17 kjell Exp $ */
+/* $OpenBSD: ip_rcmd_pxy.c,v 1.2 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Simple RCMD transparent proxy for in-kernel use. For use with the NAT
* code.
diff --git a/sys/netinet/ip_state.c b/sys/netinet/ip_state.c
index 2233e604a76..d307114c092 100644
--- a/sys/netinet/ip_state.c
+++ b/sys/netinet/ip_state.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_state.c,v 1.17 1999/12/28 09:43:33 kjell Exp $ */
+/* $OpenBSD: ip_state.c,v 1.18 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
@@ -8,7 +9,7 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_state.c,v 1.17 1999/12/28 09:43:33 kjell Exp $";
+static const char rcsid[] = "@(#)$IPFilter: ip_state.c,v 2.3.2.18 2000/01/27 08:51:30 darrenr Exp $";
#endif
#include <sys/errno.h>
@@ -175,11 +176,10 @@ int which;
delete = 1;
break;
case 1 :
- if ((is->is_p == IPPROTO_TCP) &&
- (((is->is_state[0] <= TCPS_ESTABLISHED) &&
- (is->is_state[1] > TCPS_ESTABLISHED)) ||
- ((is->is_state[1] <= TCPS_ESTABLISHED) &&
- (is->is_state[0] > TCPS_ESTABLISHED))))
+ if (is->is_p != IPPROTO_TCP)
+ break;
+ if ((is->is_state[0] != TCPS_ESTABLISHED) ||
+ (is->is_state[1] != TCPS_ESTABLISHED))
delete = 1;
break;
}
@@ -458,7 +458,7 @@ tcphdr_t *tcp;
win = ntohs(tcp->th_win);
end = seq + ip->ip_len - fin->fin_hlen - (tcp->th_off << 2) +
((tcp->th_flags & TH_SYN) ? 1 : 0) +
- ((tcp->th_flags & TH_FIN) ? 1 : 0);
+ ((tcp->th_flags & TH_FIN) ? 1 : 0);
if (fdata->td_end == 0) {
/*
@@ -472,6 +472,8 @@ tcphdr_t *tcp;
if (!(tcp->th_flags & TH_ACK)) { /* Pretend an ack was sent */
ack = tdata->td_end;
win = 1;
+ if ((tcp->th_flags == TH_SYN) && (tdata->td_maxwin == 0))
+ tdata->td_maxwin = 1;
} else if (((tcp->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
(ack == 0)) {
/* gross hack to get around certain broken tcp stacks */
@@ -487,7 +489,7 @@ tcphdr_t *tcp;
#define SEQ_GE(a,b) ((int)((a) - (b)) >= 0)
#define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
if ((SEQ_GE(fdata->td_maxend, end)) &&
- (SEQ_GE(seq + maxwin, fdata->td_end - maxwin)) &&
+ (SEQ_GE(seq, fdata->td_end - maxwin)) &&
/* XXX what about big packets */
#define MAXACKWINDOW 66000
(ackskew >= -MAXACKWINDOW) &&
@@ -672,8 +674,8 @@ fr_info_t *fin;
int type;
u_int hv;
- /*
- * Does it at least have the return (basic) IP header ?
+ /*
+ * Does it at least have the return (basic) IP header ?
* Only a basic IP header (no options) should be with
* an ICMP error header.
*/
@@ -707,10 +709,10 @@ fr_info_t *fin;
if ((icmp->icmp_type != ICMP_ECHO) &&
(icmp->icmp_type != ICMP_TSTAMP) &&
(icmp->icmp_type != ICMP_IREQ) &&
- (icmp->icmp_type != ICMP_MASKREQ))
+ (icmp->icmp_type != ICMP_MASKREQ))
return NULL;
- /*
+ /*
* perform a lookup of the ICMP packet in the state table
*/
@@ -734,9 +736,9 @@ fr_info_t *fin;
for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_next)
if ((is->is_p == pr) &&
fr_matchsrcdst(is, src, dst, &ofin, NULL)) {
- /*
+ /*
* in the state table ICMP query's are stored
- * with the type of the corresponding ICMP
+ * with the type of the corresponding ICMP
* response. Correct here
*/
if (((is->is_type == ICMP_ECHOREPLY) &&
@@ -746,7 +748,7 @@ fr_info_t *fin;
(is->is_type - 1 == ic->icmp_type)) {
ips_stats.iss_hits++;
is->is_pkts++;
- is->is_bytes += ip->ip_len;
+ is->is_bytes += ip->ip_len;
fr = is->is_rule;
RWLOCK_EXIT(&ipf_state);
return fr;
@@ -804,7 +806,7 @@ fr_info_t *fin;
* comes the other way around
*/
is->is_pkts++;
- is->is_bytes += ip->ip_len;
+ is->is_bytes += ip->ip_len;
/*
* we deliberately do not touch the timeouts
* for the accompanying state table entry.
@@ -1040,11 +1042,11 @@ void fr_timeoutstate()
} else
isp = &is->is_next;
RWLOCK_EXIT(&ipf_state);
+ SPL_X(s);
if (fr_state_doflush) {
(void) fr_state_flush(1);
fr_state_doflush = 0;
}
- SPL_X(s);
}
@@ -1181,3 +1183,21 @@ u_int type;
(void) ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1);
}
#endif
+
+
+void ip_statesync(ifp)
+void *ifp;
+{
+ register ipstate_t *is;
+ register int i;
+
+ WRITE_ENTER(&ipf_state);
+ for (i = fr_statesize - 1; i >= 0; i--)
+ for (is = ips_table[i]; is != NULL; is = is->is_next) {
+ if (is->is_ifpin == ifp)
+ is->is_ifpin = NULL;
+ if (is->is_ifpout == ifp)
+ is->is_ifpout = NULL;
+ }
+ RWLOCK_EXIT(&ipf_state);
+}
diff --git a/sys/netinet/ip_state.h b/sys/netinet/ip_state.h
index 8752f068b98..7033b9344ab 100644
--- a/sys/netinet/ip_state.h
+++ b/sys/netinet/ip_state.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ip_state.h,v 1.10 1999/12/15 05:20:23 kjell Exp $ */
+/* $OpenBSD: ip_state.h,v 1.11 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Copyright (C) 1995-1998 by Darren Reed.
*
@@ -7,7 +8,7 @@
* to the original author and the contributors.
*
* @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
- * $Id: ip_state.h,v 1.10 1999/12/15 05:20:23 kjell Exp $
+ * $IPFilter: ip_state.h,v 2.1.2.2 2000/01/24 13:13:52 darrenr Exp $
*/
#ifndef __IP_STATE_H__
#define __IP_STATE_H__
@@ -152,6 +153,7 @@ extern int fr_stateinit __P((void));
extern int fr_tcpstate __P((ipstate_t *, fr_info_t *, ip_t *, tcphdr_t *));
extern ipstate_t *fr_addstate __P((ip_t *, fr_info_t *, u_int));
extern frentry_t *fr_checkstate __P((ip_t *, fr_info_t *));
+extern void ip_statesync __P((void *));
extern void fr_timeoutstate __P((void));
extern void fr_tcp_age __P((u_long *, u_char *, ip_t *, fr_info_t *, int));
extern void fr_stateunload __P((void));
diff --git a/sys/netinet/ipl.h b/sys/netinet/ipl.h
index 4716411676b..8c19f3df9b4 100644
--- a/sys/netinet/ipl.h
+++ b/sys/netinet/ipl.h
@@ -1,4 +1,5 @@
-/* $OpenBSD: ipl.h,v 1.3 1999/12/28 08:20:40 kjell Exp $ */
+/* $OpenBSD: ipl.h,v 1.4 2000/02/01 19:29:59 kjell Exp $ */
+
/*
* Copyright (C) 1993-1999 by Darren Reed.
*
@@ -12,6 +13,6 @@
#ifndef __IPL_H__
#define __IPL_H__
-#define IPL_VERSION "IP Filter: v3.3.6"
+#define IPL_VERSION "IP Filter: v3.3.8"
#endif
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 02:51:31 +0000