HISTORY revision 23279
1# 2# NOTE: Quite a few patches and suggestions come from other sources, to whom 3# I'm greatly indebted, even if no names are mentioned. 4# 5# Thanks to Craig Bishop of connect.com.au and Sun Microsystems for the 6# loan of a machine to work on a Solaris 2.x port of this software. 7# 8prevent use of return-rst and return-icmp with rules blocking packets going 9out, preventing panics in certain situations. 10 11loop forms in frag cache table - Yury Pshenychny <yura@rd.zgik.zaporizhzhe.ua> 12 13should use SPLNET/SPLX around expire routines in NAT/frag/state code. 14 15redeclared malloc in 44arp.c - 16 173.1.7 8/2/97 - Released 18 19Macros used for ntohs/htons supplied with gcc don't always work very well 20when the assignment is the same variable being converted. 21 22Filter matching doesn't not match rule which checks tcp flags on packets 23which are fragments - David Wilson 24 253.1.7beta 30/1/97 - Released 26 27Fix up NAT bugs introduced in last major change (now tested), including 28nat_delete(), nat_lookupredir(), checksum changes, etc. 29 303.1.7alpha 30/1/97 - Released 31 32Many changes to NAT code, including contributions from Laurent Joncheray 33<lpj@ans.net> 34 35Use "NO_SLEEP" when allocating memory under SunOS. 36 37Make kernel printf's nicer for BSD/SunOS4 38 39Always do a checksum for packets being filtered going out and being 40processed by fastroute. 41 42Leave kernel to play with cdevsw on *BSD systems with LKM's. 43 44ipnat.1 man page fixes. 45 463.1.6 21/1/97 - Released 47 48Allow NAT to work on BSD systems in conjunction with "pass .. to ifname" 49 50Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried 51to free memory twice. 52 53NAT recalculates IP header checksum based on difference between IP#'s and 54port numbers - should be just IP#'s (Solaris2 only) 55 563.1.5 13/1/97 - Released 57 58fixed setting of NAT timeouts and use different timeouts for concurrent 59TCP sessions using the same IP# mapping (when port mapping isn't used) 60 61multiple loading/unloading of LKM's doesn't clean up cdevsw properly for 62*BSD systems. 63 643.1.4 10/1/97 - Released 65 66add command line options -C and -F to ipnat to flush NAT list and table 67 68ipnat -l loops on output - Neil Readwin (nreadwin@nysales.micrognosis.com) 69 70NetBSD/FreeBSD kernel malloc changes - Daniel Carosone 71 723.1.3 10/1/97 - Released 73 74NAT chains not constructed correctly in hash tables - Antony Y.R Lu 75(antony@hawk.ee.ncku.edu.tw) 76 77Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2 78 79man page update (ipf.5) from Daniel Carosone (dan@geek.com.au) 80 81ICMP header checksum update now included in NAT. 82 83Solaris2 needs to modify IP header checksums in ip_natin and ip_natout. 84 853.1.2 4/12/96 - Released 86 87ipmon doesn't use syslog all the time when given -s option 88 89fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro 90 91check the results of hostname resolution in ipnat 92 93"make *install" fixed for subdirectories. 94 95problems with "ARCH:=" and gnu make resolved 96 97parser reports an error for lines with whitespaces only rather than skipping 98them. D.Carosone@abm.com.au (Daniel Carosone) 99 100patches for integration into NetBSD-current (post 1.2). 101 102add an option to allow non-IP packets going up/down the stream on Solaris2 103to be dropped. John Bass. 104 1053.1.2beta 21/11/96 - Released 106 107make ipsend compile on Linux 2.0.24 108 109changes to TCP kept state algorithm, making it watch state on TCP 110connections in both directions. Also use the same algorithm for NAT TCP. 111 112-Wall cleanup - Bernd Ernesti 113 114added "or-block" for "pass .. log or-block" after a suggestion from 115David Oppenheim (davido@optimation.com.au) 116 117added subdirectories for building IP Filter in SunOS5/BSD for different 118cpu architecures 119 120Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2 121 122mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96 123 1243.1.1 28/10/96 - Released 125 126Installation script fixes and deinstall scripts for IP Filter on: 127SunOS4/FreeBSD/NetBSD 128 129Man page fixes - Paul Dubois (dubois@primate.wisc.edu) 130 131Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!) 132 133parsing isn't completely case insensitive - David Wilson 134(davidw@optimation.com.au) 135 136Release ipl_mutex across uiomove() calls 137 138print entire rule entries out for "ipf -z" when zero'ing per-rule stats. 139 140ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik 141(ts@polynet.lviv.ua) 142 143New algorithm for setting timeouts for TCP connection (more closely follow 144TCP FSM) - Pradeep Krishnan (pkrishna@netcom.com) 145 146Track both window sizes for TCP connections through "keep state". 147 148Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel 149(wezel@bio.vu.nl) 150 1513.1.1-beta2 6/10/96 - Released 152 153Solaris2 fastroute/dup-to/to now works 154 155ipmon `record' reading rewritten 156 157Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg@eterna.com.au) 158 159Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson 160(davidw@optimation.com.au) 161 162Michael Ryan (mike@NetworX.ie) reports the following: 163* The Trumpet WinSock under Windows always sends its SYN packet with an ACK 164 value of 1, unlike any other implementation I've seen, which would set it 165 to zero. The "keep state" feature of IP Filter doesn't work when receiving 166 non-zero ACK values on new connection requests. 167* */Makefile install rule doesn't install all the binaries/man pages 168* Make ipnat use "tcp/udp" instead of "tcpudp" 169* Print out "tcp/udp" properly 170* ipnat "portmap tcp" matches "portmap udp" when adding/removing 171* NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't 172 1733.1.1-beta 1/9/96 - Released 174 175add better detection of TCP connections closing to TCP state monitoring. 176 177fr_addstate() not called correctly for fragments. "keep state" and 178"keep frag" code don't work together 100% - Songqing Cai 179(songqing_cai@sterling.com) 180 181call to fr_addstate() incorrect for adding state in combination with keeping 182fragment information - Songqing Cai (songqing_cai@sterling.com) 183 184KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood 185(cgull@smoke.marlboro.vt.us) 186 187make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban 188(dima@best.net) 189 1903.1.1-alpha 23/8/96 - Released 191 192kernel panic's when ICMP packets go through NAT code 193 194stats aren't zero'd properly with ipf -Z 195 196ipnat doesn't show port numbers correctly all the time and also add the 197protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com) 198 199fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com) 200 201NetBSD-1.2 patches from - VaX#n8 <vax@linkdead.paranoia.com> 202 203Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu) 204 205ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall 206(nrh@tardis.ed.ac.uk) 207 2083.1.0 7/7/96 - Released 209 210Reformatted ipnat output to be compatible with it's input, so that 211"ipnat -l | ipnat -rf -" is possible. 212 2133.1.0beta 30/6/96 - Released 214 215NetBSD-1.2 patches from Greg Woods (woods@most.weird.com) 216 217kernel module must not be installed stripped (Solaris2), as created by 218"make package" for Solaris2 - Peter Heimann 219(peter@i3.informatik.rwth-aachen.de) 220 2213.1.0alpha 5/6/96 - Released 222 223include examples in package for solaris2 224 225patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS) 226 227removed trailing space from printouts of rules in ipf. 228 229ipresend supports the same range of inputs that ipftest does. 230 231sending a duplicate copy of a packet to another network devices is now 232supported. ("dup-to") 233 234sending a packet to an arbitary interface is now supported, irrespective 235of its actual route, with no ttl decrement. Can also be routed without 236the ttl being decremented. ("to" and "fastroute"). 237 238"call" option added to support calling a generic function if a packet is 239matched. 240 241show all (upto 4) recorded bytes from the interface name in logging from 242ipmon. 243 244support for using unix file permissions for read/write access on the device 245is now in place. 246 247recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per@stibo.dk> 248 249ipftest doesn't call initparse() for THISHOST - Catherine Allen 250(cla@connect.com.au) 251 252Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au) 253 2543.0.4 10/4/96 - Released 255 256looop in `parsing' IP packets with optlen 0 for ip options. 257 258rule number not initialized and resulted in unexpected results for state 259maching. 260 261option parsing and printing bugs - Pradeep Krishnan 262 2633.0.4beta 25/3/96 - Released 264 265wouldn't parse "keep flags keep state" correctly. 266 267SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon 268 269patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems 270from Thorsten Lockert <tholo@tetherless.com> 271 272b* functions in fil.c on Solaris 2.4 273 2743.0.3 17/3/96 - Released 275 276added patches to support IP Filter initialisation when compiled into the 277kernel. 278 279added -x option to ipmon to display hex dumps of logged packets. 280 281added -H option to ipftest to allow ascii-hex formatted input to specify 282arbitary IP packets. 283 284Sending TCP RSTs as a response now work for Solaris2 x86 285 286add patches to make IP Filter compile into NetBSD kernels properly. 287 288patch to stop SunOS 4.1.x kernels panicing with "data traps". 289 290ipfboot script unloads and reloads ipf module on Solaris2 if it is already 291loaded into the kernel. 292 293Installation of IP Filter as a Solaris2 package is now supported. 294 295Man pages for ipnat.4, ipnat.5 added. 296 297added some more regression tests and fixed up IP Filter to pass the new tests 298(previous versions failed some of the tests in set 12). 299 300IP option filter processing has changed so that saying "with opt lsrr" will 301check only for that one, but not mask out other options, so a packet with 302strict source routing, along with loose source routing will match all of 303"with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr". 304 305IPL_NAME needed in ipnat.c - Kelly (kelly@count04.mry.scruznet.com) 306 307patches for clean NetBSD compilation from Bernd Ernesti (bernd@arresum.inka.de) 308 309make install is incorrect - Julian Briggs (julian@lightwork.co.uk) 310 311strtol() returns 0x7fffffff for all negative numbers, 312printfr() generates incorrect output for "opt sec-class *", 313handling of "not opt xxx opt yyy" incorrect. 314- Minh Tonthat (minht@sbei.com)/Pradeep Krishnan (pradeepk@sbei.com) 315 316m_pullup() called only for input and not output; caused problems 317with filtering icmp - Nigel Verdon (verdenn@gb.swissbank.com) 318 319parsing problem for "port 1" and NetBSD patches incorrect - 320Andreas Gustafsson (gson@guava.araneus.fi) 321 3223.0.2 4/2/96 - Released 323 324Corrected bug where NAT recalculates checksums for fragments. 325 326make NAT recalculate UDP checksums (rather than setting them to 0), 327if they're non-zero. 328 329DNS patches - Real Page (Real.Page@Matrox.com) 330 331alteration of checksum recalculations in NAT code and addition of 332redirection with NAT - Mike Neuman 333 334core dump, if tcp/udp is used with a port number and not service name, 335in ipf - Mike Neuman (mcn@engarde.com) 336 337initparse() call, missing to prime "<thishost>" hook - Craig Bishop 338 3393.0.1 14/1/96 - Released 340 341miscellaneous patches for Solaris2 342 3433.0 14/1/96 - Released 344 345Patch included for FDDI, from Richard Ohnemus 346(Richard_Ohnemus@dallas.csd.sterling.com) 347 348Code cleanup for release. 349 3503.0beta4 10/1/96 351 352recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop 353 354recursive mutex in sending TCP RSTs fixed, reported by Tony Becker 355 3563.0beta3 9/1/96 357 358FIxup for Solaris2.5 install and interface name bug in ipftest from 359Julian Briggs (julian@lightwork.co.uk) 360 361Byte order patches for ipmon from Tony Becker (tony@mcrsys.com) 362 3633.0beta2 7/1/96 364 365Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD. 366Note, this isn't really what one would call IP account, when compared to 367process accounting, sigh. 368 369Split up ipresend into iptest/ipresend/ipsend 370 371Added another m_pullup() inside fr_check() for BSD style kernels and 372added some checks to ipllog() to not log more than is present (for short 373packets). 374 375Fixed bug where failed hostname/netname resolution goes undetecte and 376becomes 0.0.0.0 (any) (reported Guido van Rooij) 377 3783.0beta 11/11/95 - Released 379 380Rewrote the way rule testing is done, reducing the number of files needed and 381generated. 382 383SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green) 384 385Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3 386BSD based Unixes (panic'd) 387 388Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku@tequila.nixu.fi> 389(I think someone else already told me about these but they got lost :-/) 390 391Changed Makefile structure to build object files for different operating 392systems in separate directories by default. 393 394BSDI has ef0 for first ethernet interface 395 396Allow for a "not" operator before optional keywords. 397 398The "rule number" was being incorrectly incremented every time it went through 399the loop rather than when it matched a rule. 400 4012.8.2 24/10/95 - Released 402 403Fixed up problems with "textip" for doing lots of testing. 404 405Fixed bug in detection of "short" tcp/ip packets (all reported as being short). 406 407Solaris 2.4 port now works 100%. 408 409Man page errors reported and fixed. 410 411Removed duplicate entry in etc/services for login on port 49 (Craig Bishop). 412 413Fixed ipmon output to put a space after the log-letter. 414 415Patch from Guido van Rooij to fix parsing problem. 416 4172.8.1 15/10/95 - Released 418 419Added ttl and tos filtering. 420 421Patches for fixing up compilation and port problems (little endian) 422from Guido van Rooij <guido@IAEhv.nl>. 423 424Man page problems reported and fixed by Carson Gaspar <carson@lehman.com>. 425 426ipsend doesn't compile properly on Solaris2.4 427 428Lots of work done for Solaris2.4 to make it MT/MP safe and work. 429 4302.8 15/9/95 - Released 431 432ipmon can now send messages to syslogd (-s) and use names instead of 433numbers (-N). 434 435IP packets are now "compiled" into a structure only containing filterable 436bits. 437 438Added regression testing in the test/ subdirectory, using a new option 439(-b) with the ipftest program. 440 441Added "nomatch" return to filter results. These are counted and show 442up in reports from ipfstat. 443 444Moved filter code out of ip_fil.c and into fil.c - there is now only one 445instance of it in the package. 446 447Added Solaris 2.4 support. 448 449Added IPSO basic security option filtering. 450 451Added name support for filtering on all 19 named IP options. 452 453Patches from Ivan Brawley to log packet contents as well as packet headers. 454 455Update for sun/conf.c.diff from Ivan Brawley <ibrawley@awadi.com.AU> 456 457Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf, 458along with a new ioctl, SIOCFRENB. 459From: Dieter Dworkin Muller <dworkin@village.org> 460 4612.7.3 31/7.95 - Released 462 463Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green). 464 465ipftest now deals with tcpdump3 binary output files (from libpcap) with -P. 466 467Brought ipftest program upto date with actual filter code. 468 469Filter would cause a match to occur when it wasn't meant to if the packet 470had short headers and was missing portions that should have been there. 471Err, it would rightly not match on them, but their absence caused a match 472when it shouldn't have been. 473 4742.7.2 26/7/95 - Released 475 476Problem with filtering just SYN flagged packets reported by 477Dieter Dworkin Muller <dworkin@village.org>. To solve this 478problem, added support for masking TCP flags for comparison "flags X/Y". 479 4802.7.1 9/7/95 - Released 481 482Added ip_dirbroadcast support for Sun ip_input.c 483 484Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are 485better. 486 4872.7 7/7/95 - Released 488 489Added "return-rst" to return TCP RST's to TCP packets. 490 491Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now. 492 493Added insertion of filter rules. Use "@<#>" at the beginning of a filter 494to insert a rule at row #. 495 496Filter keeps track of how many times each rule is matched. 497 498Changed compile time things to match kernel option (IPFILTER_LKM & 499IPFILTER_LOG). 500 501Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP. 502(No change required for 3.6) 503 504Now includes TCP fragments which start inside the TCP header as being short. 505Added counting the number of times each rule is matched. 506 507 5082.6 11/5/95 - Released 509 510Added -n option to ipf: when supplied, no changes are made to the kernel. 511 512Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI. 513 514Rewrote filtering to use a more generic mask & match procedure for 515checking if a packet matches a rule. 516 5172.5.2 27/4/95 - Released 518 519"tcp/udp" and a non-initialised pointer caused the "proto" to become 520a `random' value; added "ip#/dotted.mask" notation to the BNF. 521From Adam W. Feigin <feigin@iis.ee.ethz.ch> 522 5232.5.1 22/3/95 - Released 524 525"tcp/udp" had a strange effect (undesired) on getserv*() functions, 526causing protocol/service lookups to fail. Reported by Matthew Green. 527 5282.5 17/3/95 - Released 529 530Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop 531output through the ipftest program. Suggestions from: 532Michael Ciavarella (mikec@phyto.apana.org.au) 533 534Conflicts occur when "general" filter rules are used for ports and the 535lack of a "proto" when used with "port" matches other packets when only 536TCP/UDP are implied. 537Reported Matthew Green (mrg@fulcom.com.au); 538reported & fixed 6-8/3/95 539 540Added filtering of short TCP packets using "with short" 28/2/95 541(These can possibly slip by checks for the various flags). Short UDP 542or ICMP are dropped to the floor and logged. 543 544Added filtering of fragmented packets using "with frag" 24/2/95 545 546Port to NetBSD-current completed 20/2/95, using LKM. 547 548Added logging of the rule # which caused the logging to happen and the 549interface on which the packet is currently as suggested by 550Andreas Greulich (greulich@math-stat.unibe.ch) 10/2/95 551 5522.4 9/2/95 - Released 553Fixed saving of IP headers in ICMP packets. 554 5552.3 29/1/95 556Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL). 557Fixed iplread() and iplsave() with help from Marc Huber. 558 5592.2 7/1/95 - Released 560Added code from Marc Huber <huber@fzi.de> to allow it to allocate 561its own major char number dynamically when modload'ing. Fixed up 562use of <, >, <=, >= and >< for ports. 563 5642.1 21/12/94 - Released 565repackaged to include the correct ip_output.c and ip_input.c *goof* 566 5672.0 18/12/94 - Released 568added code to check for port ranges - complete. 569rewrote to work as a loadable kernel module - complete. 570 5711.1 572added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers. 573 5741.0 22/04/93 - Released 575First release cut. 576 577