HISTORY revision 24583
1# 2# NOTE: Quite a few patches and suggestions come from other sources, to whom 3# I'm greatly indebted, even if no names are mentioned. 4# 5# Thanks to Craig Bishop of connect.com.au and Sun Microsystems for the 6# loan of a machine to work on a Solaris 2.x port of this software. 7# 83.2alpha4 2/4/97 - Released 9 10Some compiler warnings cleaned up. 11 12FreeBSD-2.2 patches for LKM completed. 13 143.2alpha3 31/3/97 - Released 15 16ipmon changes: -N for reading NAT logfile, -S for reading state logfile. 17-a for reading all. -n now toggles hostname resolution. 18 19Add logging of new state entries and expiration of old state entries. 20count log successes and failures. 21 22Add logging of new NAT entries and expiration of old NAT entries. 23count log successes and failures. 24 25Use u_quad_t for records of bytes & packets where kept 26(IP Accounting: fr_hits, fr_bytes; IP state: is_pkts, is_bytes). 27 28Fixup use of CPU and DCPU in Makefiles. 29 30Fix broken 0/32 NAT mapping. Carl Makin <cmakin@nla.gov.au> 31 323.2alpha2 33 34Implement mapping to 0/32 as being an alias for automatically using the 35interface's first IP address. 36 37Implement separate minor devices for both NAT and IP state code. 38 39Fully prototype all functions. 40 41Fix Makefile problem due to attempt to fix Sun compiling problems. 42 433.1.10 23/3/97 - Released 44 45ipfstat -a requires a -i or -o command line option too. Print an error 46when not present rather than attempt to do something. 47 48patch updates for SunOS4 for kernel compiling. 49patch for ipmon -s (flush's syslog file which isn't good). Andrew J. Schorr 50<schorr@ead.dsa.com> 51 52too many people hit their heads hard when compiling code into the kernel 53that doesn't let any packets through. (fil.c - IPF_NOMATCH) 54 55icmp-type parsing doesn't return any errors when it isn't constructed 56correctly. Neil Readwin 57 58Using "-conf" with modload on SunOS4 doesn't work. 59Timothy Demarest <demarest@arraycomm.com> 60 61Need to define ARCH in makefile for SunOS4 building. "make sunos4" 62in INSTALL.SunOS is incorrect. James R Grinter <jrg@blodwen.demon.co.uk> 63[all SunOS targets now run buildsunos] 64 65NAT lookups are still incorrect, matching non-TCP/UDP with TCP/UDP 66information. ArkanoiD <ark@paranoid.convey.ru> 67 68Need to check for __FreeBSD_version being 199511 rather than 199607 69in mln_ipl.c. Eric Feillant <Eric.Feillant@EUnet.fr> 70 713.1.9 8/3/97 - Released 72 73fixed incorrect lookup of active NAT entries. 74 75patch for ip_deq() wrong for pre 2.1.6 FreeBSD. 76fyeung@fyeung8.netific.com (Francis Yeung) 77 78check for out with return-rst/return-icmp at wrong place - Erkki Ritoniemi 79(erkki@vlsi.fi) 80 81text_readip returns the interface pointer pointing to text on stack - 82Neil Readwin 83 84fix from Pradeep Krishnan for printout rules "with not opt sec". 85 863.1.8 18/2/97 - Released 87 88Diffs for ip_output.c and ip_input.c updated to fix bug with fastroute and 89compiling warnings about reuse of m0. 90 91prevent use of return-rst and return-icmp with rules blocking packets going 92out, preventing panics in certain situations. 93 94loop forms in frag cache table - Yury Pshenychny <yura@rd.zgik.zaporizhzhe.ua> 95 96should use SPLNET/SPLX around expire routines in NAT/frag/state code. 97 98redeclared malloc in 44arp.c - 99 1003.1.7 8/2/97 - Released 101 102Macros used for ntohs/htons supplied with gcc don't always work very well 103when the assignment is the same variable being converted. 104 105Filter matching doesn't not match rule which checks tcp flags on packets 106which are fragments - David Wilson 107 1083.1.7beta 30/1/97 - Released 109 110Fix up NAT bugs introduced in last major change (now tested), including 111nat_delete(), nat_lookupredir(), checksum changes, etc. 112 1133.1.7alpha 30/1/97 - Released 114 115Many changes to NAT code, including contributions from Laurent Joncheray 116<lpj@ans.net> 117 118Use "NO_SLEEP" when allocating memory under SunOS. 119 120Make kernel printf's nicer for BSD/SunOS4 121 122Always do a checksum for packets being filtered going out and being 123processed by fastroute. 124 125Leave kernel to play with cdevsw on *BSD systems with LKM's. 126 127ipnat.1 man page fixes. 128 1293.1.6 21/1/97 - Released 130 131Allow NAT to work on BSD systems in conjunction with "pass .. to ifname" 132 133Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried 134to free memory twice. 135 136NAT recalculates IP header checksum based on difference between IP#'s and 137port numbers - should be just IP#'s (Solaris2 only) 138 1393.1.5 13/1/97 - Released 140 141fixed setting of NAT timeouts and use different timeouts for concurrent 142TCP sessions using the same IP# mapping (when port mapping isn't used) 143 144multiple loading/unloading of LKM's doesn't clean up cdevsw properly for 145*BSD systems. 146 1473.1.4 10/1/97 - Released 148 149add command line options -C and -F to ipnat to flush NAT list and table 150 151ipnat -l loops on output - Neil Readwin (nreadwin@nysales.micrognosis.com) 152 153NetBSD/FreeBSD kernel malloc changes - Daniel Carosone 154 1553.1.3 10/1/97 - Released 156 157NAT chains not constructed correctly in hash tables - Antony Y.R Lu 158(antony@hawk.ee.ncku.edu.tw) 159 160Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2 161 162man page update (ipf.5) from Daniel Carosone (dan@geek.com.au) 163 164ICMP header checksum update now included in NAT. 165 166Solaris2 needs to modify IP header checksums in ip_natin and ip_natout. 167 1683.1.2 4/12/96 - Released 169 170ipmon doesn't use syslog all the time when given -s option 171 172fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro 173 174check the results of hostname resolution in ipnat 175 176"make *install" fixed for subdirectories. 177 178problems with "ARCH:=" and gnu make resolved 179 180parser reports an error for lines with whitespaces only rather than skipping 181them. D.Carosone@abm.com.au (Daniel Carosone) 182 183patches for integration into NetBSD-current (post 1.2). 184 185add an option to allow non-IP packets going up/down the stream on Solaris2 186to be dropped. John Bass. 187 1883.1.2beta 21/11/96 - Released 189 190make ipsend compile on Linux 2.0.24 191 192changes to TCP kept state algorithm, making it watch state on TCP 193connections in both directions. Also use the same algorithm for NAT TCP. 194 195-Wall cleanup - Bernd Ernesti 196 197added "or-block" for "pass .. log or-block" after a suggestion from 198David Oppenheim (davido@optimation.com.au) 199 200added subdirectories for building IP Filter in SunOS5/BSD for different 201cpu architecures 202 203Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2 204 205mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96 206 2073.1.1 28/10/96 - Released 208 209Installation script fixes and deinstall scripts for IP Filter on: 210SunOS4/FreeBSD/NetBSD 211 212Man page fixes - Paul Dubois (dubois@primate.wisc.edu) 213 214Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!) 215 216parsing isn't completely case insensitive - David Wilson 217(davidw@optimation.com.au) 218 219Release ipl_mutex across uiomove() calls 220 221print entire rule entries out for "ipf -z" when zero'ing per-rule stats. 222 223ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik 224(ts@polynet.lviv.ua) 225 226New algorithm for setting timeouts for TCP connection (more closely follow 227TCP FSM) - Pradeep Krishnan (pkrishna@netcom.com) 228 229Track both window sizes for TCP connections through "keep state". 230 231Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel 232(wezel@bio.vu.nl) 233 2343.1.1-beta2 6/10/96 - Released 235 236Solaris2 fastroute/dup-to/to now works 237 238ipmon `record' reading rewritten 239 240Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg@eterna.com.au) 241 242Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson 243(davidw@optimation.com.au) 244 245Michael Ryan (mike@NetworX.ie) reports the following: 246* The Trumpet WinSock under Windows always sends its SYN packet with an ACK 247 value of 1, unlike any other implementation I've seen, which would set it 248 to zero. The "keep state" feature of IP Filter doesn't work when receiving 249 non-zero ACK values on new connection requests. 250* */Makefile install rule doesn't install all the binaries/man pages 251* Make ipnat use "tcp/udp" instead of "tcpudp" 252* Print out "tcp/udp" properly 253* ipnat "portmap tcp" matches "portmap udp" when adding/removing 254* NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't 255 2563.1.1-beta 1/9/96 - Released 257 258add better detection of TCP connections closing to TCP state monitoring. 259 260fr_addstate() not called correctly for fragments. "keep state" and 261"keep frag" code don't work together 100% - Songqing Cai 262(songqing_cai@sterling.com) 263 264call to fr_addstate() incorrect for adding state in combination with keeping 265fragment information - Songqing Cai (songqing_cai@sterling.com) 266 267KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood 268(cgull@smoke.marlboro.vt.us) 269 270make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban 271(dima@best.net) 272 2733.1.1-alpha 23/8/96 - Released 274 275kernel panic's when ICMP packets go through NAT code 276 277stats aren't zero'd properly with ipf -Z 278 279ipnat doesn't show port numbers correctly all the time and also add the 280protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com) 281 282fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com) 283 284NetBSD-1.2 patches from - VaX#n8 <vax@linkdead.paranoia.com> 285 286Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu) 287 288ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall 289(nrh@tardis.ed.ac.uk) 290 2913.1.0 7/7/96 - Released 292 293Reformatted ipnat output to be compatible with it's input, so that 294"ipnat -l | ipnat -rf -" is possible. 295 2963.1.0beta 30/6/96 - Released 297 298NetBSD-1.2 patches from Greg Woods (woods@most.weird.com) 299 300kernel module must not be installed stripped (Solaris2), as created by 301"make package" for Solaris2 - Peter Heimann 302(peter@i3.informatik.rwth-aachen.de) 303 3043.1.0alpha 5/6/96 - Released 305 306include examples in package for solaris2 307 308patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS) 309 310removed trailing space from printouts of rules in ipf. 311 312ipresend supports the same range of inputs that ipftest does. 313 314sending a duplicate copy of a packet to another network devices is now 315supported. ("dup-to") 316 317sending a packet to an arbitary interface is now supported, irrespective 318of its actual route, with no ttl decrement. Can also be routed without 319the ttl being decremented. ("to" and "fastroute"). 320 321"call" option added to support calling a generic function if a packet is 322matched. 323 324show all (upto 4) recorded bytes from the interface name in logging from 325ipmon. 326 327support for using unix file permissions for read/write access on the device 328is now in place. 329 330recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per@stibo.dk> 331 332ipftest doesn't call initparse() for THISHOST - Catherine Allen 333(cla@connect.com.au) 334 335Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au) 336 3373.0.4 10/4/96 - Released 338 339looop in `parsing' IP packets with optlen 0 for ip options. 340 341rule number not initialized and resulted in unexpected results for state 342maching. 343 344option parsing and printing bugs - Pradeep Krishnan 345 3463.0.4beta 25/3/96 - Released 347 348wouldn't parse "keep flags keep state" correctly. 349 350SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon 351 352patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems 353from Thorsten Lockert <tholo@tetherless.com> 354 355b* functions in fil.c on Solaris 2.4 356 3573.0.3 17/3/96 - Released 358 359added patches to support IP Filter initialisation when compiled into the 360kernel. 361 362added -x option to ipmon to display hex dumps of logged packets. 363 364added -H option to ipftest to allow ascii-hex formatted input to specify 365arbitary IP packets. 366 367Sending TCP RSTs as a response now work for Solaris2 x86 368 369add patches to make IP Filter compile into NetBSD kernels properly. 370 371patch to stop SunOS 4.1.x kernels panicing with "data traps". 372 373ipfboot script unloads and reloads ipf module on Solaris2 if it is already 374loaded into the kernel. 375 376Installation of IP Filter as a Solaris2 package is now supported. 377 378Man pages for ipnat.4, ipnat.5 added. 379 380added some more regression tests and fixed up IP Filter to pass the new tests 381(previous versions failed some of the tests in set 12). 382 383IP option filter processing has changed so that saying "with opt lsrr" will 384check only for that one, but not mask out other options, so a packet with 385strict source routing, along with loose source routing will match all of 386"with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr". 387 388IPL_NAME needed in ipnat.c - Kelly (kelly@count04.mry.scruznet.com) 389 390patches for clean NetBSD compilation from Bernd Ernesti (bernd@arresum.inka.de) 391 392make install is incorrect - Julian Briggs (julian@lightwork.co.uk) 393 394strtol() returns 0x7fffffff for all negative numbers, 395printfr() generates incorrect output for "opt sec-class *", 396handling of "not opt xxx opt yyy" incorrect. 397- Minh Tonthat (minht@sbei.com)/Pradeep Krishnan (pradeepk@sbei.com) 398 399m_pullup() called only for input and not output; caused problems 400with filtering icmp - Nigel Verdon (verdenn@gb.swissbank.com) 401 402parsing problem for "port 1" and NetBSD patches incorrect - 403Andreas Gustafsson (gson@guava.araneus.fi) 404 4053.0.2 4/2/96 - Released 406 407Corrected bug where NAT recalculates checksums for fragments. 408 409make NAT recalculate UDP checksums (rather than setting them to 0), 410if they're non-zero. 411 412DNS patches - Real Page (Real.Page@Matrox.com) 413 414alteration of checksum recalculations in NAT code and addition of 415redirection with NAT - Mike Neuman 416 417core dump, if tcp/udp is used with a port number and not service name, 418in ipf - Mike Neuman (mcn@engarde.com) 419 420initparse() call, missing to prime "<thishost>" hook - Craig Bishop 421 4223.0.1 14/1/96 - Released 423 424miscellaneous patches for Solaris2 425 4263.0 14/1/96 - Released 427 428Patch included for FDDI, from Richard Ohnemus 429(Richard_Ohnemus@dallas.csd.sterling.com) 430 431Code cleanup for release. 432 4333.0beta4 10/1/96 434 435recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop 436 437recursive mutex in sending TCP RSTs fixed, reported by Tony Becker 438 4393.0beta3 9/1/96 440 441FIxup for Solaris2.5 install and interface name bug in ipftest from 442Julian Briggs (julian@lightwork.co.uk) 443 444Byte order patches for ipmon from Tony Becker (tony@mcrsys.com) 445 4463.0beta2 7/1/96 447 448Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD. 449Note, this isn't really what one would call IP account, when compared to 450process accounting, sigh. 451 452Split up ipresend into iptest/ipresend/ipsend 453 454Added another m_pullup() inside fr_check() for BSD style kernels and 455added some checks to ipllog() to not log more than is present (for short 456packets). 457 458Fixed bug where failed hostname/netname resolution goes undetecte and 459becomes 0.0.0.0 (any) (reported Guido van Rooij) 460 4613.0beta 11/11/95 - Released 462 463Rewrote the way rule testing is done, reducing the number of files needed and 464generated. 465 466SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green) 467 468Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3 469BSD based Unixes (panic'd) 470 471Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku@tequila.nixu.fi> 472(I think someone else already told me about these but they got lost :-/) 473 474Changed Makefile structure to build object files for different operating 475systems in separate directories by default. 476 477BSDI has ef0 for first ethernet interface 478 479Allow for a "not" operator before optional keywords. 480 481The "rule number" was being incorrectly incremented every time it went through 482the loop rather than when it matched a rule. 483 4842.8.2 24/10/95 - Released 485 486Fixed up problems with "textip" for doing lots of testing. 487 488Fixed bug in detection of "short" tcp/ip packets (all reported as being short). 489 490Solaris 2.4 port now works 100%. 491 492Man page errors reported and fixed. 493 494Removed duplicate entry in etc/services for login on port 49 (Craig Bishop). 495 496Fixed ipmon output to put a space after the log-letter. 497 498Patch from Guido van Rooij to fix parsing problem. 499 5002.8.1 15/10/95 - Released 501 502Added ttl and tos filtering. 503 504Patches for fixing up compilation and port problems (little endian) 505from Guido van Rooij <guido@IAEhv.nl>. 506 507Man page problems reported and fixed by Carson Gaspar <carson@lehman.com>. 508 509ipsend doesn't compile properly on Solaris2.4 510 511Lots of work done for Solaris2.4 to make it MT/MP safe and work. 512 5132.8 15/9/95 - Released 514 515ipmon can now send messages to syslogd (-s) and use names instead of 516numbers (-N). 517 518IP packets are now "compiled" into a structure only containing filterable 519bits. 520 521Added regression testing in the test/ subdirectory, using a new option 522(-b) with the ipftest program. 523 524Added "nomatch" return to filter results. These are counted and show 525up in reports from ipfstat. 526 527Moved filter code out of ip_fil.c and into fil.c - there is now only one 528instance of it in the package. 529 530Added Solaris 2.4 support. 531 532Added IPSO basic security option filtering. 533 534Added name support for filtering on all 19 named IP options. 535 536Patches from Ivan Brawley to log packet contents as well as packet headers. 537 538Update for sun/conf.c.diff from Ivan Brawley <ibrawley@awadi.com.AU> 539 540Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf, 541along with a new ioctl, SIOCFRENB. 542From: Dieter Dworkin Muller <dworkin@village.org> 543 5442.7.3 31/7.95 - Released 545 546Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green). 547 548ipftest now deals with tcpdump3 binary output files (from libpcap) with -P. 549 550Brought ipftest program upto date with actual filter code. 551 552Filter would cause a match to occur when it wasn't meant to if the packet 553had short headers and was missing portions that should have been there. 554Err, it would rightly not match on them, but their absence caused a match 555when it shouldn't have been. 556 5572.7.2 26/7/95 - Released 558 559Problem with filtering just SYN flagged packets reported by 560Dieter Dworkin Muller <dworkin@village.org>. To solve this 561problem, added support for masking TCP flags for comparison "flags X/Y". 562 5632.7.1 9/7/95 - Released 564 565Added ip_dirbroadcast support for Sun ip_input.c 566 567Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are 568better. 569 5702.7 7/7/95 - Released 571 572Added "return-rst" to return TCP RST's to TCP packets. 573 574Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now. 575 576Added insertion of filter rules. Use "@<#>" at the beginning of a filter 577to insert a rule at row #. 578 579Filter keeps track of how many times each rule is matched. 580 581Changed compile time things to match kernel option (IPFILTER_LKM & 582IPFILTER_LOG). 583 584Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP. 585(No change required for 3.6) 586 587Now includes TCP fragments which start inside the TCP header as being short. 588Added counting the number of times each rule is matched. 589 590 5912.6 11/5/95 - Released 592 593Added -n option to ipf: when supplied, no changes are made to the kernel. 594 595Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI. 596 597Rewrote filtering to use a more generic mask & match procedure for 598checking if a packet matches a rule. 599 6002.5.2 27/4/95 - Released 601 602"tcp/udp" and a non-initialised pointer caused the "proto" to become 603a `random' value; added "ip#/dotted.mask" notation to the BNF. 604From Adam W. Feigin <feigin@iis.ee.ethz.ch> 605 6062.5.1 22/3/95 - Released 607 608"tcp/udp" had a strange effect (undesired) on getserv*() functions, 609causing protocol/service lookups to fail. Reported by Matthew Green. 610 6112.5 17/3/95 - Released 612 613Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop 614output through the ipftest program. Suggestions from: 615Michael Ciavarella (mikec@phyto.apana.org.au) 616 617Conflicts occur when "general" filter rules are used for ports and the 618lack of a "proto" when used with "port" matches other packets when only 619TCP/UDP are implied. 620Reported Matthew Green (mrg@fulcom.com.au); 621reported & fixed 6-8/3/95 622 623Added filtering of short TCP packets using "with short" 28/2/95 624(These can possibly slip by checks for the various flags). Short UDP 625or ICMP are dropped to the floor and logged. 626 627Added filtering of fragmented packets using "with frag" 24/2/95 628 629Port to NetBSD-current completed 20/2/95, using LKM. 630 631Added logging of the rule # which caused the logging to happen and the 632interface on which the packet is currently as suggested by 633Andreas Greulich (greulich@math-stat.unibe.ch) 10/2/95 634 6352.4 9/2/95 - Released 636Fixed saving of IP headers in ICMP packets. 637 6382.3 29/1/95 639Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL). 640Fixed iplread() and iplsave() with help from Marc Huber. 641 6422.2 7/1/95 - Released 643Added code from Marc Huber <huber@fzi.de> to allow it to allocate 644its own major char number dynamically when modload'ing. Fixed up 645use of <, >, <=, >= and >< for ports. 646 6472.1 21/12/94 - Released 648repackaged to include the correct ip_output.c and ip_input.c *goof* 649 6502.0 18/12/94 - Released 651added code to check for port ranges - complete. 652rewrote to work as a loadable kernel module - complete. 653 6541.1 655added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers. 656 6571.0 22/04/93 - Released 658First release cut. 659 660