HISTORY revision 22514
122514Sdarrenr# 222514Sdarrenr# NOTE: Quite a few patches and suggestions come from other sources, to whom 322514Sdarrenr# I'm greatly indebted, even if no names are mentioned. 422514Sdarrenr# 522514Sdarrenr# Thanks to Craig Bishop of connect.com.au and Sun Microsystems for the 622514Sdarrenr# loan of a machine to work on a Solaris 2.x port of this software. 722514Sdarrenr# 822514Sdarrenr3.1.7 8/2/97 - Released 922514Sdarrenr 1022514SdarrenrMacros used for ntohs/htons supplied with gcc don't always work very well 1122514Sdarrenrwhen the assignment is the same variable being converted. 1222514Sdarrenr 1322514SdarrenrFilter matching doesn't not match rule which checks tcp flags on packets 1422514Sdarrenrwhich are fragments - David Wilson 1522514Sdarrenr 1622514Sdarrenr3.1.7beta 30/1/97 - Released 1722514Sdarrenr 1822514SdarrenrFix up NAT bugs introduced in last major change (now tested), including 1922514Sdarrenrnat_delete(), nat_lookupredir(), checksum changes, etc. 2022514Sdarrenr 2122514Sdarrenr3.1.7alpha 30/1/97 - Released 2222514Sdarrenr 2322514SdarrenrMany changes to NAT code, including contributions from Laurent Joncheray 2422514Sdarrenr<lpj@ans.net> 2522514Sdarrenr 2622514SdarrenrUse "NO_SLEEP" when allocating memory under SunOS. 2722514Sdarrenr 2822514SdarrenrMake kernel printf's nicer for BSD/SunOS4 2922514Sdarrenr 3022514SdarrenrAlways do a checksum for packets being filtered going out and being 3122514Sdarrenrprocessed by fastroute. 3222514Sdarrenr 3322514SdarrenrLeave kernel to play with cdevsw on *BSD systems with LKM's. 3422514Sdarrenr 3522514Sdarrenripnat.1 man page fixes. 3622514Sdarrenr 3722514Sdarrenr3.1.6 21/1/97 - Released 3822514Sdarrenr 3922514SdarrenrAllow NAT to work on BSD systems in conjunction with "pass .. to ifname" 4022514Sdarrenr 4122514SdarrenrMemory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried 4222514Sdarrenrto free memory twice. 4322514Sdarrenr 4422514SdarrenrNAT recalculates IP header checksum based on difference between IP#'s and 4522514Sdarrenrport numbers - should be just IP#'s (Solaris2 only) 4622514Sdarrenr 4722514Sdarrenr3.1.5 13/1/97 - Released 4822514Sdarrenr 4922514Sdarrenrfixed setting of NAT timeouts and use different timeouts for concurrent 5022514SdarrenrTCP sessions using the same IP# mapping (when port mapping isn't used) 5122514Sdarrenr 5222514Sdarrenrmultiple loading/unloading of LKM's doesn't clean up cdevsw properly for 5322514Sdarrenr*BSD systems. 5422514Sdarrenr 5522514Sdarrenr3.1.4 10/1/97 - Released 5622514Sdarrenr 5722514Sdarrenradd command line options -C and -F to ipnat to flush NAT list and table 5822514Sdarrenr 5922514Sdarrenripnat -l loops on output - Neil Readwin (nreadwin@nysales.micrognosis.com) 6022514Sdarrenr 6122514SdarrenrNetBSD/FreeBSD kernel malloc changes - Daniel Carosone 6222514Sdarrenr 6322514Sdarrenr3.1.3 10/1/97 - Released 6422514Sdarrenr 6522514SdarrenrNAT chains not constructed correctly in hash tables - Antony Y.R Lu 6622514Sdarrenr(antony@hawk.ee.ncku.edu.tw) 6722514Sdarrenr 6822514SdarrenrUpdated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2 6922514Sdarrenr 7022514Sdarrenrman page update (ipf.5) from Daniel Carosone (dan@geek.com.au) 7122514Sdarrenr 7222514SdarrenrICMP header checksum update now included in NAT. 7322514Sdarrenr 7422514SdarrenrSolaris2 needs to modify IP header checksums in ip_natin and ip_natout. 7522514Sdarrenr 7622514Sdarrenr3.1.2 4/12/96 - Released 7722514Sdarrenr 7822514Sdarrenripmon doesn't use syslog all the time when given -s option 7922514Sdarrenr 8022514Sdarrenrfixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro 8122514Sdarrenr 8222514Sdarrenrcheck the results of hostname resolution in ipnat 8322514Sdarrenr 8422514Sdarrenr"make *install" fixed for subdirectories. 8522514Sdarrenr 8622514Sdarrenrproblems with "ARCH:=" and gnu make resolved 8722514Sdarrenr 8822514Sdarrenrparser reports an error for lines with whitespaces only rather than skipping 8922514Sdarrenrthem. D.Carosone@abm.com.au (Daniel Carosone) 9022514Sdarrenr 9122514Sdarrenrpatches for integration into NetBSD-current (post 1.2). 9222514Sdarrenr 9322514Sdarrenradd an option to allow non-IP packets going up/down the stream on Solaris2 9422514Sdarrenrto be dropped. John Bass. 9522514Sdarrenr 9622514Sdarrenr3.1.2beta 21/11/96 - Released 9722514Sdarrenr 9822514Sdarrenrmake ipsend compile on Linux 2.0.24 9922514Sdarrenr 10022514Sdarrenrchanges to TCP kept state algorithm, making it watch state on TCP 10122514Sdarrenrconnections in both directions. Also use the same algorithm for NAT TCP. 10222514Sdarrenr 10322514Sdarrenr-Wall cleanup - Bernd Ernesti 10422514Sdarrenr 10522514Sdarrenradded "or-block" for "pass .. log or-block" after a suggestion from 10622514SdarrenrDavid Oppenheim (davido@optimation.com.au) 10722514Sdarrenr 10822514Sdarrenradded subdirectories for building IP Filter in SunOS5/BSD for different 10922514Sdarrenrcpu architecures 11022514Sdarrenr 11122514SdarrenrSolaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2 11222514Sdarrenr 11322514Sdarrenrmbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96 11422514Sdarrenr 11522514Sdarrenr3.1.1 28/10/96 - Released 11622514Sdarrenr 11722514SdarrenrInstallation script fixes and deinstall scripts for IP Filter on: 11822514SdarrenrSunOS4/FreeBSD/NetBSD 11922514Sdarrenr 12022514SdarrenrMan page fixes - Paul Dubois (dubois@primate.wisc.edu) 12122514Sdarrenr 12222514SdarrenrFix use of SOLARIS macro in ipmon, rewrote ipllog() (again!) 12322514Sdarrenr 12422514Sdarrenrparsing isn't completely case insensitive - David Wilson 12522514Sdarrenr(davidw@optimation.com.au) 12622514Sdarrenr 12722514SdarrenrRelease ipl_mutex across uiomove() calls 12822514Sdarrenr 12922514Sdarrenrprint entire rule entries out for "ipf -z" when zero'ing per-rule stats. 13022514Sdarrenr 13122514Sdarrenripfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik 13222514Sdarrenr(ts@polynet.lviv.ua) 13322514Sdarrenr 13422514SdarrenrNew algorithm for setting timeouts for TCP connection (more closely follow 13522514SdarrenrTCP FSM) - Pradeep Krishnan (pkrishna@netcom.com) 13622514Sdarrenr 13722514SdarrenrTrack both window sizes for TCP connections through "keep state". 13822514Sdarrenr 13922514SdarrenrSolaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel 14022514Sdarrenr(wezel@bio.vu.nl) 14122514Sdarrenr 14222514Sdarrenr3.1.1-beta2 6/10/96 - Released 14322514Sdarrenr 14422514SdarrenrSolaris2 fastroute/dup-to/to now works 14522514Sdarrenr 14622514Sdarrenripmon `record' reading rewritten 14722514Sdarrenr 14822514SdarrenrAdded post-NetBSD1.2 packet filter patches - Mathew Green (mrg@eterna.com.au) 14922514Sdarrenr 15022514SdarrenrAttempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson 15122514Sdarrenr(davidw@optimation.com.au) 15222514Sdarrenr 15322514SdarrenrMichael Ryan (mike@NetworX.ie) reports the following: 15422514Sdarrenr* The Trumpet WinSock under Windows always sends its SYN packet with an ACK 15522514Sdarrenr value of 1, unlike any other implementation I've seen, which would set it 15622514Sdarrenr to zero. The "keep state" feature of IP Filter doesn't work when receiving 15722514Sdarrenr non-zero ACK values on new connection requests. 15822514Sdarrenr* */Makefile install rule doesn't install all the binaries/man pages 15922514Sdarrenr* Make ipnat use "tcp/udp" instead of "tcpudp" 16022514Sdarrenr* Print out "tcp/udp" properly 16122514Sdarrenr* ipnat "portmap tcp" matches "portmap udp" when adding/removing 16222514Sdarrenr* NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't 16322514Sdarrenr 16422514Sdarrenr3.1.1-beta 1/9/96 - Released 16522514Sdarrenr 16622514Sdarrenradd better detection of TCP connections closing to TCP state monitoring. 16722514Sdarrenr 16822514Sdarrenrfr_addstate() not called correctly for fragments. "keep state" and 16922514Sdarrenr"keep frag" code don't work together 100% - Songqing Cai 17022514Sdarrenr(songqing_cai@sterling.com) 17122514Sdarrenr 17222514Sdarrenrcall to fr_addstate() incorrect for adding state in combination with keeping 17322514Sdarrenrfragment information - Songqing Cai (songqing_cai@sterling.com) 17422514Sdarrenr 17522514SdarrenrKFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood 17622514Sdarrenr(cgull@smoke.marlboro.vt.us) 17722514Sdarrenr 17822514Sdarrenrmake ipf parser recognise '\\' as a `continued line' marker - Dima Ruban 17922514Sdarrenr(dima@best.net) 18022514Sdarrenr 18122514Sdarrenr3.1.1-alpha 23/8/96 - Released 18222514Sdarrenr 18322514Sdarrenrkernel panic's when ICMP packets go through NAT code 18422514Sdarrenr 18522514Sdarrenrstats aren't zero'd properly with ipf -Z 18622514Sdarrenr 18722514Sdarrenripnat doesn't show port numbers correctly all the time and also add the 18822514Sdarrenrprotocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com) 18922514Sdarrenr 19022514Sdarrenrfast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com) 19122514Sdarrenr 19222514SdarrenrNetBSD-1.2 patches from - VaX#n8 <vax@linkdead.paranoia.com> 19322514Sdarrenr 19422514SdarrenrUsage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu) 19522514Sdarrenr 19622514Sdarrenrip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall 19722514Sdarrenr(nrh@tardis.ed.ac.uk) 19822514Sdarrenr 19922514Sdarrenr3.1.0 7/7/96 - Released 20022514Sdarrenr 20122514SdarrenrReformatted ipnat output to be compatible with it's input, so that 20222514Sdarrenr"ipnat -l | ipnat -rf -" is possible. 20322514Sdarrenr 20422514Sdarrenr3.1.0beta 30/6/96 - Released 20522514Sdarrenr 20622514SdarrenrNetBSD-1.2 patches from Greg Woods (woods@most.weird.com) 20722514Sdarrenr 20822514Sdarrenrkernel module must not be installed stripped (Solaris2), as created by 20922514Sdarrenr"make package" for Solaris2 - Peter Heimann 21022514Sdarrenr(peter@i3.informatik.rwth-aachen.de) 21122514Sdarrenr 21222514Sdarrenr3.1.0alpha 5/6/96 - Released 21322514Sdarrenr 21422514Sdarrenrinclude examples in package for solaris2 21522514Sdarrenr 21622514Sdarrenrpatches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS) 21722514Sdarrenr 21822514Sdarrenrremoved trailing space from printouts of rules in ipf. 21922514Sdarrenr 22022514Sdarrenripresend supports the same range of inputs that ipftest does. 22122514Sdarrenr 22222514Sdarrenrsending a duplicate copy of a packet to another network devices is now 22322514Sdarrenrsupported. ("dup-to") 22422514Sdarrenr 22522514Sdarrenrsending a packet to an arbitary interface is now supported, irrespective 22622514Sdarrenrof its actual route, with no ttl decrement. Can also be routed without 22722514Sdarrenrthe ttl being decremented. ("to" and "fastroute"). 22822514Sdarrenr 22922514Sdarrenr"call" option added to support calling a generic function if a packet is 23022514Sdarrenrmatched. 23122514Sdarrenr 23222514Sdarrenrshow all (upto 4) recorded bytes from the interface name in logging from 23322514Sdarrenripmon. 23422514Sdarrenr 23522514Sdarrenrsupport for using unix file permissions for read/write access on the device 23622514Sdarrenris now in place. 23722514Sdarrenr 23822514Sdarrenrrecursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per@stibo.dk> 23922514Sdarrenr 24022514Sdarrenripftest doesn't call initparse() for THISHOST - Catherine Allen 24122514Sdarrenr(cla@connect.com.au) 24222514Sdarrenr 24322514SdarrenrMan page corrections from Rex Bona (rex@pengo.comsmiths.com.au) 24422514Sdarrenr 24522514Sdarrenr3.0.4 10/4/96 - Released 24622514Sdarrenr 24722514Sdarrenrlooop in `parsing' IP packets with optlen 0 for ip options. 24822514Sdarrenr 24922514Sdarrenrrule number not initialized and resulted in unexpected results for state 25022514Sdarrenrmaching. 25122514Sdarrenr 25222514Sdarrenroption parsing and printing bugs - Pradeep Krishnan 25322514Sdarrenr 25422514Sdarrenr3.0.4beta 25/3/96 - Released 25522514Sdarrenr 25622514Sdarrenrwouldn't parse "keep flags keep state" correctly. 25722514Sdarrenr 25822514SdarrenrSunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon 25922514Sdarrenr 26022514Sdarrenrpatches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems 26122514Sdarrenrfrom Thorsten Lockert <tholo@tetherless.com> 26222514Sdarrenr 26322514Sdarrenrb* functions in fil.c on Solaris 2.4 26422514Sdarrenr 26522514Sdarrenr3.0.3 17/3/96 - Released 26622514Sdarrenr 26722514Sdarrenradded patches to support IP Filter initialisation when compiled into the 26822514Sdarrenrkernel. 26922514Sdarrenr 27022514Sdarrenradded -x option to ipmon to display hex dumps of logged packets. 27122514Sdarrenr 27222514Sdarrenradded -H option to ipftest to allow ascii-hex formatted input to specify 27322514Sdarrenrarbitary IP packets. 27422514Sdarrenr 27522514SdarrenrSending TCP RSTs as a response now work for Solaris2 x86 27622514Sdarrenr 27722514Sdarrenradd patches to make IP Filter compile into NetBSD kernels properly. 27822514Sdarrenr 27922514Sdarrenrpatch to stop SunOS 4.1.x kernels panicing with "data traps". 28022514Sdarrenr 28122514Sdarrenripfboot script unloads and reloads ipf module on Solaris2 if it is already 28222514Sdarrenrloaded into the kernel. 28322514Sdarrenr 28422514SdarrenrInstallation of IP Filter as a Solaris2 package is now supported. 28522514Sdarrenr 28622514SdarrenrMan pages for ipnat.4, ipnat.5 added. 28722514Sdarrenr 28822514Sdarrenradded some more regression tests and fixed up IP Filter to pass the new tests 28922514Sdarrenr(previous versions failed some of the tests in set 12). 29022514Sdarrenr 29122514SdarrenrIP option filter processing has changed so that saying "with opt lsrr" will 29222514Sdarrenrcheck only for that one, but not mask out other options, so a packet with 29322514Sdarrenrstrict source routing, along with loose source routing will match all of 29422514Sdarrenr"with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr". 29522514Sdarrenr 29622514SdarrenrIPL_NAME needed in ipnat.c - Kelly (kelly@count04.mry.scruznet.com) 29722514Sdarrenr 29822514Sdarrenrpatches for clean NetBSD compilation from Bernd Ernesti (bernd@arresum.inka.de) 29922514Sdarrenr 30022514Sdarrenrmake install is incorrect - Julian Briggs (julian@lightwork.co.uk) 30122514Sdarrenr 30222514Sdarrenrstrtol() returns 0x7fffffff for all negative numbers, 30322514Sdarrenrprintfr() generates incorrect output for "opt sec-class *", 30422514Sdarrenrhandling of "not opt xxx opt yyy" incorrect. 30522514Sdarrenr- Minh Tonthat (minht@sbei.com)/Pradeep Krishnan (pradeepk@sbei.com) 30622514Sdarrenr 30722514Sdarrenrm_pullup() called only for input and not output; caused problems 30822514Sdarrenrwith filtering icmp - Nigel Verdon (verdenn@gb.swissbank.com) 30922514Sdarrenr 31022514Sdarrenrparsing problem for "port 1" and NetBSD patches incorrect - 31122514SdarrenrAndreas Gustafsson (gson@guava.araneus.fi) 31222514Sdarrenr 31322514Sdarrenr3.0.2 4/2/96 - Released 31422514Sdarrenr 31522514SdarrenrCorrected bug where NAT recalculates checksums for fragments. 31622514Sdarrenr 31722514Sdarrenrmake NAT recalculate UDP checksums (rather than setting them to 0), 31822514Sdarrenrif they're non-zero. 31922514Sdarrenr 32022514SdarrenrDNS patches - Real Page (Real.Page@Matrox.com) 32122514Sdarrenr 32222514Sdarrenralteration of checksum recalculations in NAT code and addition of 32322514Sdarrenrredirection with NAT - Mike Neuman 32422514Sdarrenr 32522514Sdarrenrcore dump, if tcp/udp is used with a port number and not service name, 32622514Sdarrenrin ipf - Mike Neuman (mcn@engarde.com) 32722514Sdarrenr 32822514Sdarrenrinitparse() call, missing to prime "<thishost>" hook - Craig Bishop 32922514Sdarrenr 33022514Sdarrenr3.0.1 14/1/96 - Released 33122514Sdarrenr 33222514Sdarrenrmiscellaneous patches for Solaris2 33322514Sdarrenr 33422514Sdarrenr3.0 14/1/96 - Released 33522514Sdarrenr 33622514SdarrenrPatch included for FDDI, from Richard Ohnemus 33722514Sdarrenr(Richard_Ohnemus@dallas.csd.sterling.com) 33822514Sdarrenr 33922514SdarrenrCode cleanup for release. 34022514Sdarrenr 34122514Sdarrenr3.0beta4 10/1/96 34222514Sdarrenr 34322514Sdarrenrrecursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop 34422514Sdarrenr 34522514Sdarrenrrecursive mutex in sending TCP RSTs fixed, reported by Tony Becker 34622514Sdarrenr 34722514Sdarrenr3.0beta3 9/1/96 34822514Sdarrenr 34922514SdarrenrFIxup for Solaris2.5 install and interface name bug in ipftest from 35022514SdarrenrJulian Briggs (julian@lightwork.co.uk) 35122514Sdarrenr 35222514SdarrenrByte order patches for ipmon from Tony Becker (tony@mcrsys.com) 35322514Sdarrenr 35422514Sdarrenr3.0beta2 7/1/96 35522514Sdarrenr 35622514SdarrenrAdded the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD. 35722514SdarrenrNote, this isn't really what one would call IP account, when compared to 35822514Sdarrenrprocess accounting, sigh. 35922514Sdarrenr 36022514SdarrenrSplit up ipresend into iptest/ipresend/ipsend 36122514Sdarrenr 36222514SdarrenrAdded another m_pullup() inside fr_check() for BSD style kernels and 36322514Sdarrenradded some checks to ipllog() to not log more than is present (for short 36422514Sdarrenrpackets). 36522514Sdarrenr 36622514SdarrenrFixed bug where failed hostname/netname resolution goes undetecte and 36722514Sdarrenrbecomes 0.0.0.0 (any) (reported Guido van Rooij) 36822514Sdarrenr 36922514Sdarrenr3.0beta 11/11/95 - Released 37022514Sdarrenr 37122514SdarrenrRewrote the way rule testing is done, reducing the number of files needed and 37222514Sdarrenrgenerated. 37322514Sdarrenr 37422514SdarrenrSIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green) 37522514Sdarrenr 37622514SdarrenrPatches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3 37722514SdarrenrBSD based Unixes (panic'd) 37822514Sdarrenr 37922514SdarrenrPatches for FreeBSD/i86 ipmon from Riku Kalinen <riku@tequila.nixu.fi> 38022514Sdarrenr(I think someone else already told me about these but they got lost :-/) 38122514Sdarrenr 38222514SdarrenrChanged Makefile structure to build object files for different operating 38322514Sdarrenrsystems in separate directories by default. 38422514Sdarrenr 38522514SdarrenrBSDI has ef0 for first ethernet interface 38622514Sdarrenr 38722514SdarrenrAllow for a "not" operator before optional keywords. 38822514Sdarrenr 38922514SdarrenrThe "rule number" was being incorrectly incremented every time it went through 39022514Sdarrenrthe loop rather than when it matched a rule. 39122514Sdarrenr 39222514Sdarrenr2.8.2 24/10/95 - Released 39322514Sdarrenr 39422514SdarrenrFixed up problems with "textip" for doing lots of testing. 39522514Sdarrenr 39622514SdarrenrFixed bug in detection of "short" tcp/ip packets (all reported as being short). 39722514Sdarrenr 39822514SdarrenrSolaris 2.4 port now works 100%. 39922514Sdarrenr 40022514SdarrenrMan page errors reported and fixed. 40122514Sdarrenr 40222514SdarrenrRemoved duplicate entry in etc/services for login on port 49 (Craig Bishop). 40322514Sdarrenr 40422514SdarrenrFixed ipmon output to put a space after the log-letter. 40522514Sdarrenr 40622514SdarrenrPatch from Guido van Rooij to fix parsing problem. 40722514Sdarrenr 40822514Sdarrenr2.8.1 15/10/95 - Released 40922514Sdarrenr 41022514SdarrenrAdded ttl and tos filtering. 41122514Sdarrenr 41222514SdarrenrPatches for fixing up compilation and port problems (little endian) 41322514Sdarrenrfrom Guido van Rooij <guido@IAEhv.nl>. 41422514Sdarrenr 41522514SdarrenrMan page problems reported and fixed by Carson Gaspar <carson@lehman.com>. 41622514Sdarrenr 41722514Sdarrenripsend doesn't compile properly on Solaris2.4 41822514Sdarrenr 41922514SdarrenrLots of work done for Solaris2.4 to make it MT/MP safe and work. 42022514Sdarrenr 42122514Sdarrenr2.8 15/9/95 - Released 42222514Sdarrenr 42322514Sdarrenripmon can now send messages to syslogd (-s) and use names instead of 42422514Sdarrenrnumbers (-N). 42522514Sdarrenr 42622514SdarrenrIP packets are now "compiled" into a structure only containing filterable 42722514Sdarrenrbits. 42822514Sdarrenr 42922514SdarrenrAdded regression testing in the test/ subdirectory, using a new option 43022514Sdarrenr(-b) with the ipftest program. 43122514Sdarrenr 43222514SdarrenrAdded "nomatch" return to filter results. These are counted and show 43322514Sdarrenrup in reports from ipfstat. 43422514Sdarrenr 43522514SdarrenrMoved filter code out of ip_fil.c and into fil.c - there is now only one 43622514Sdarrenrinstance of it in the package. 43722514Sdarrenr 43822514SdarrenrAdded Solaris 2.4 support. 43922514Sdarrenr 44022514SdarrenrAdded IPSO basic security option filtering. 44122514Sdarrenr 44222514SdarrenrAdded name support for filtering on all 19 named IP options. 44322514Sdarrenr 44422514SdarrenrPatches from Ivan Brawley to log packet contents as well as packet headers. 44522514Sdarrenr 44622514SdarrenrUpdate for sun/conf.c.diff from Ivan Brawley <ibrawley@awadi.com.AU> 44722514Sdarrenr 44822514SdarrenrAdded patches for FreeBSD 1, and added two new switches (-E, -D) to ipf, 44922514Sdarrenralong with a new ioctl, SIOCFRENB. 45022514SdarrenrFrom: Dieter Dworkin Muller <dworkin@village.org> 45122514Sdarrenr 45222514Sdarrenr2.7.3 31/7.95 - Released 45322514Sdarrenr 45422514SdarrenrDidn't compile cleanly without IPFILTER_LOG defined (Mathew Green). 45522514Sdarrenr 45622514Sdarrenripftest now deals with tcpdump3 binary output files (from libpcap) with -P. 45722514Sdarrenr 45822514SdarrenrBrought ipftest program upto date with actual filter code. 45922514Sdarrenr 46022514SdarrenrFilter would cause a match to occur when it wasn't meant to if the packet 46122514Sdarrenrhad short headers and was missing portions that should have been there. 46222514SdarrenrErr, it would rightly not match on them, but their absence caused a match 46322514Sdarrenrwhen it shouldn't have been. 46422514Sdarrenr 46522514Sdarrenr2.7.2 26/7/95 - Released 46622514Sdarrenr 46722514SdarrenrProblem with filtering just SYN flagged packets reported by 46822514SdarrenrDieter Dworkin Muller <dworkin@village.org>. To solve this 46922514Sdarrenrproblem, added support for masking TCP flags for comparison "flags X/Y". 47022514Sdarrenr 47122514Sdarrenr2.7.1 9/7/95 - Released 47222514Sdarrenr 47322514SdarrenrAdded ip_dirbroadcast support for Sun ip_input.c 47422514Sdarrenr 47522514SdarrenrFixed up the install scripts for FreeBSD/NetBSD to recognise where they are 47622514Sdarrenrbetter. 47722514Sdarrenr 47822514Sdarrenr2.7 7/7/95 - Released 47922514Sdarrenr 48022514SdarrenrAdded "return-rst" to return TCP RST's to TCP packets. 48122514Sdarrenr 48222514SdarrenrActually ported it to FreeBSD-i386 2.0.0, so it works there properly now. 48322514Sdarrenr 48422514SdarrenrAdded insertion of filter rules. Use "@<#>" at the beginning of a filter 48522514Sdarrenrto insert a rule at row #. 48622514Sdarrenr 48722514SdarrenrFilter keeps track of how many times each rule is matched. 48822514Sdarrenr 48922514SdarrenrChanged compile time things to match kernel option (IPFILTER_LKM & 49022514SdarrenrIPFILTER_LOG). 49122514Sdarrenr 49222514SdarrenrUpdated ip_input.c and ip_output.c with paches for 3.5 Multicast IP. 49322514Sdarrenr(No change required for 3.6) 49422514Sdarrenr 49522514SdarrenrNow includes TCP fragments which start inside the TCP header as being short. 49622514SdarrenrAdded counting the number of times each rule is matched. 49722514Sdarrenr 49822514Sdarrenr 49922514Sdarrenr2.6 11/5/95 - Released 50022514Sdarrenr 50122514SdarrenrAdded -n option to ipf: when supplied, no changes are made to the kernel. 50222514Sdarrenr 50322514SdarrenrAdded installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI. 50422514Sdarrenr 50522514SdarrenrRewrote filtering to use a more generic mask & match procedure for 50622514Sdarrenrchecking if a packet matches a rule. 50722514Sdarrenr 50822514Sdarrenr2.5.2 27/4/95 - Released 50922514Sdarrenr 51022514Sdarrenr"tcp/udp" and a non-initialised pointer caused the "proto" to become 51122514Sdarrenra `random' value; added "ip#/dotted.mask" notation to the BNF. 51222514SdarrenrFrom Adam W. Feigin <feigin@iis.ee.ethz.ch> 51322514Sdarrenr 51422514Sdarrenr2.5.1 22/3/95 - Released 51522514Sdarrenr 51622514Sdarrenr"tcp/udp" had a strange effect (undesired) on getserv*() functions, 51722514Sdarrenrcausing protocol/service lookups to fail. Reported by Matthew Green. 51822514Sdarrenr 51922514Sdarrenr2.5 17/3/95 - Released 52022514Sdarrenr 52122514SdarrenrAdded a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop 52222514Sdarrenroutput through the ipftest program. Suggestions from: 52322514SdarrenrMichael Ciavarella (mikec@phyto.apana.org.au) 52422514Sdarrenr 52522514SdarrenrConflicts occur when "general" filter rules are used for ports and the 52622514Sdarrenrlack of a "proto" when used with "port" matches other packets when only 52722514SdarrenrTCP/UDP are implied. 52822514SdarrenrReported Matthew Green (mrg@fulcom.com.au); 52922514Sdarrenrreported & fixed 6-8/3/95 53022514Sdarrenr 53122514SdarrenrAdded filtering of short TCP packets using "with short" 28/2/95 53222514Sdarrenr(These can possibly slip by checks for the various flags). Short UDP 53322514Sdarrenror ICMP are dropped to the floor and logged. 53422514Sdarrenr 53522514SdarrenrAdded filtering of fragmented packets using "with frag" 24/2/95 53622514Sdarrenr 53722514SdarrenrPort to NetBSD-current completed 20/2/95, using LKM. 53822514Sdarrenr 53922514SdarrenrAdded logging of the rule # which caused the logging to happen and the 54022514Sdarrenrinterface on which the packet is currently as suggested by 54122514SdarrenrAndreas Greulich (greulich@math-stat.unibe.ch) 10/2/95 54222514Sdarrenr 54322514Sdarrenr2.4 9/2/95 - Released 54422514SdarrenrFixed saving of IP headers in ICMP packets. 54522514Sdarrenr 54622514Sdarrenr2.3 29/1/95 54722514SdarrenrAdded ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL). 54822514SdarrenrFixed iplread() and iplsave() with help from Marc Huber. 54922514Sdarrenr 55022514Sdarrenr2.2 7/1/95 - Released 55122514SdarrenrAdded code from Marc Huber <huber@fzi.de> to allow it to allocate 55222514Sdarrenrits own major char number dynamically when modload'ing. Fixed up 55322514Sdarrenruse of <, >, <=, >= and >< for ports. 55422514Sdarrenr 55522514Sdarrenr2.1 21/12/94 - Released 55622514Sdarrenrrepackaged to include the correct ip_output.c and ip_input.c *goof* 55722514Sdarrenr 55822514Sdarrenr2.0 18/12/94 - Released 55922514Sdarrenradded code to check for port ranges - complete. 56022514Sdarrenrrewrote to work as a loadable kernel module - complete. 56122514Sdarrenr 56222514Sdarrenr1.1 56322514Sdarrenradded code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers. 56422514Sdarrenr 56522514Sdarrenr1.0 22/04/93 - Released 56622514SdarrenrFirst release cut. 56722514Sdarrenr 568