aboutsummaryrefslogtreecommitdiff
path: root/lib/libalias
Commit message (Collapse)AuthorAgeFilesLines
...
* Stage 3 of dynamic root support. Make all the libraries needed to runGordon Tetlow2003-08-171-0/+1
| | | | | | | | | binaries in /bin and /sbin installed in /lib. Only the versioned files reside in /lib, the .so symlink continues to live /usr/lib so the toolchain doesn't need to be modified. Notes: svn path=/head/; revision=119017
* In the PKT_ALIAS_PROXY_ONLY mode, make sure to preserve theRuslan Ermilov2003-06-131-0/+4
| | | | | | | | | original source IP address, as promised in the manual page. Spotted by: Vaclav Petricek Notes: svn path=/head/; revision=116315
* Removed a couple of .Xo/.Xc that are leftovers of the "ninth-argumentRuslan Ermilov2003-06-131-9/+3
| | | | | | | limit" mdoc(7) atavism. Notes: svn path=/head/; revision=116314
* Clarify that original address and port when doing transparent proxyingRuslan Ermilov2003-06-131-5/+5
| | | | | | | are _destination_ address and port. Notes: svn path=/head/; revision=116313
* Added myself to the AUTHORS section.Ruslan Ermilov2003-06-131-0/+2
| | | | Notes: svn path=/head/; revision=116312
* The .Fn functionPhilippe Charnier2003-06-081-4/+6
| | | | Notes: svn path=/head/; revision=116020
* A new API function PacketAliasRedirectDynamic() can be usedRuslan Ermilov2003-06-013-1/+36
| | | | | | | | to mark a fully specified static link as dynamic; i.e. make it a one-time link. Notes: svn path=/head/; revision=115650
* Make the PacketAliasSetAddress() function call optional. If itRuslan Ermilov2003-06-012-11/+18
| | | | | | | | | is not called, and no static rules match an outgoing packet, the latter retains its source IP address. This is in support of the "static NAT only" mode. Notes: svn path=/head/; revision=115648
* style.Makefile(5)David E. O'Brien2003-04-201-7/+6
| | | | Notes: svn path=/head/; revision=113755
* Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,Jens Schweikhardt2003-01-012-2/+2
| | | | | | | especially in troff files. Notes: svn path=/head/; revision=108533
* Zap now-unused SHLIB_MINORPeter Wemm2002-09-281-1/+0
| | | | Notes: svn path=/head/; revision=104073
* Don't forget to recalculate the IP checksum of the originalRuslan Ermilov2002-07-231-4/+12
| | | | | | | | | | IP datagram embedded into ICMP error message. Spotted by: tcpdump 3.7.1 (-vvv) MFC after: 3 days Notes: svn path=/head/; revision=100537
* Move IPFW2 definition before including ip_fw.hLuigi Rizzo2002-07-181-32/+30
| | | | | | | Make indentation of new parts consistent with the style used for this file. Notes: svn path=/head/; revision=100288
* Fix a bug caused by dereferencing an invalid pointer whenLuigi Rizzo2002-07-081-62/+65
| | | | | | | | | | | | no punch_fw was used. Fix another couple of bugs which prevented rules from being installed properly. On passing, use IPFW2 instead of NEW_IPFW to compile the new code, and slightly simplify the instruction generation code. Notes: svn path=/head/; revision=99623
* Remove trailing whitespaceBrian Somers2002-07-0110-142/+142
| | | | Notes: svn path=/head/; revision=99207
* The new ipfw code.Luigi Rizzo2002-06-271-0/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code makes use of variable-size kernel representation of rules (exactly the same concept of BPF instructions, as used in the BSDI's firewall), which makes firewall operation a lot faster, and the code more readable and easier to extend and debug. The interface with the rest of the system is unchanged, as witnessed by this commit. The only extra kernel files that I am touching are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In userland I only had to touch those programs which manipulate the internal representation of firewall rules). The code is almost entirely new (and I believe I have written the vast majority of those sections which were taken from the former ip_fw.c), so rather than modifying the old ip_fw.c I decided to create a new file, sys/netinet/ip_fw2.c . Same for the user interface, which is in sbin/ipfw/ipfw2.c (it still compiles to /sbin/ipfw). The old files are still there, and will be removed in due time. I have not renamed the header file because it would have required touching a one-line change to a number of kernel files. In terms of user interface, the new "ipfw" is supposed to accepts the old syntax for ipfw rules (and produce the same output with "ipfw show". Only a couple of the old options (out of some 30 of them) has not been implemented, but they will be soon. On the other hand, the new code has some very powerful extensions. First, you can put "or" connectives between match fields (and soon also between options), and write things like ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any This should make rulesets slightly more compact (and lines longer!), by condensing 2 or more of the old rules into single ones. Also, as an example of how easy the rules can be extended, I have implemented an 'address set' match pattern, where you can specify an IP address in a format like this: 10.20.30.0/26{18,44,33,22,9} which will match the set of hosts listed in braces belonging to the subnet 10.20.30.0/26 . The match is done using a bitmap, so it is essentially a constant time operation requiring a handful of CPU instructions (and a very small amount of memmory -- for a full /24 subnet, the instruction only consumes 40 bytes). Again, in this commit I have focused on functionality and tried to minimize changes to the other parts of the system. Some performance improvement can be achieved with minor changes to the interface of ip_fw_chk_t. This will be done later when this code is settled. The code is meant to compile unmodified on RELENG_4 (once the PACKET_TAG_* changes have been merged), for this reason you will see #ifdef __FreeBSD_version in a couple of places. This should minimize errors when (hopefully soon) it will be time to do the MFC. Notes: svn path=/head/; revision=98943
* Avoid unintentional trigraph.Garrett Wollman2002-05-301-1/+1
| | | | Notes: svn path=/head/; revision=97627
* Fixed the bug in transparent TCP proxying with the "encode_ip_hdr"Ruslan Ermilov2001-12-181-1/+3
| | | | | | | | | option -- TcpAliasOut() did not catch the IP header length change. Submitted by: Stepachev Andrey <aka50@mail.ru> Notes: svn path=/head/; revision=88132
* When servicing an internal FTP server, punch ipfirewall(4) holesRuslan Ermilov2001-11-271-5/+2
| | | | | | | | | | | | for passive mode data connections (PASV/EPSV -> 227/229). Well, the actual punching happens a bit later, when the aliasing link becomes fully specified. Prodded by: Danny Carroll <dannycarroll@hotmail.com> MFC after: 1 week Notes: svn path=/head/; revision=86953
* cmott@scientech.com -> cm@linktel.netBrian Somers2001-11-039-10/+10
| | | | | | | Requested by: Charles Mott <cmott@scientech.com> Notes: svn path=/head/; revision=85964
* mdoc(7) police: Use the new .In macro for #include statements.Ruslan Ermilov2001-10-011-3/+3
| | | | Notes: svn path=/head/; revision=84306
* Add __FBSDID's to libaliasMatthew Dillon2001-09-3010-21/+32
| | | | Notes: svn path=/head/; revision=84195
* Fixed the bug that prevented communication with FTP servers behindRuslan Ermilov2001-09-211-3/+4
| | | | | | | | | | | | | | | | | | NAT in extended passive mode if the server's public IP address was different from the main NAT address. This caused a wrong aliasing link to be created that did not route the incoming packets back to the original IP address of the server. natd -v -n pub0 -redirect_address localFTP publicFTP Note that even if localFTP == publicFTP, one still needs to supply the -redirect_address directive. It is needed as a helper because extended passive mode's 229 reply does not contain the IP address. MFC after: 1 week Notes: svn path=/head/; revision=83771
* Added TFTP support.Ruslan Ermilov2001-08-211-0/+9
| | | | | | | | Submitted by: Joe Clarke <marcus@marcuscom.com> MFC after: 2 weeks Notes: svn path=/head/; revision=82069
* Close the "IRC DCC" security breach reported recently on Bugtraq.Ruslan Ermilov2001-08-211-0/+6
| | | | | | | Submitted by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org> Notes: svn path=/head/; revision=82050
* Make the copyright consistent.Brian Somers2001-08-204-12/+0
| | | | | | | Previously approved by: Charles Mott <cmott@scientech.com> Notes: svn path=/head/; revision=82001
* Handle snprintf() returning -1Brian Somers2001-08-201-3/+13
| | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=81962
* mdoc(7) police:Ruslan Ermilov2001-08-071-4/+2
| | | | | | | | | | Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text. Not only this slows down the mdoc(7) processing significantly, but it also has an undesired (in this case) effect of disabling hyphenation within the entire enclosed block. Notes: svn path=/head/; revision=81251
* mdoc(7) police: removed HISTORY info from the .Os call.Ruslan Ermilov2001-07-101-1/+1
| | | | Notes: svn path=/head/; revision=79531
* Fixed the brain-o in rev. 1.10: the logic check was reversed.Ruslan Ermilov2001-06-271-1/+1
| | | | | | | Reported by: Bernd Fuerwitt <bf@fuerwitt.de> Notes: svn path=/head/; revision=78886
* Add BSD-style copyright headersBrian Somers2001-06-049-17/+253
| | | | | | | Approved by: Charles Mott <cmott@scientech.com> Notes: svn path=/head/; revision=77701
* Change to a standard BSD-style copyrightBrian Somers2001-06-041-13/+22
| | | | | | | Approved by: Atsushi Murai <amurai@spec.co.jp> Notes: svn path=/head/; revision=77696
* Add an integer field to keep protocol-specific flags with links.Ruslan Ermilov2001-05-303-15/+20
| | | | | | | | | | | | | For FTP control connection, keep the CRLF end-of-line termination status in there. Fixed the bug when the first FTP command in a session was ignored. PR: 24048 MFC after: 1 week Notes: svn path=/head/; revision=77485
* MAN[1-9] -> MAN.Ruslan Ermilov2001-03-271-1/+1
| | | | Notes: svn path=/head/; revision=74870
* Make header files conform to style(9).Brian Somers2001-03-256-326/+311
| | | | | | | | | Reviewed by (*): bde (*) alias_local.h only got a cursory glance. Notes: svn path=/head/; revision=74778
* Remove an extraneous declaration.Brian Somers2001-03-251-1/+0
| | | | Notes: svn path=/head/; revision=74768
* Remove (non-protected) variable names from function prototypes.Brian Somers2001-03-221-7/+5
| | | | Notes: svn path=/head/; revision=74651
* Add a few ``const''s to silence some -Wwrite-strings warningsBrian Somers2001-01-291-7/+9
| | | | Notes: svn path=/head/; revision=71796
* Ignore leading witespace in the string given to PacketAliasProxyRule().Brian Somers2001-01-291-0/+1
| | | | Notes: svn path=/head/; revision=71763
* mdoc(7) police: use the new feature of the An macro.Ruslan Ermilov2000-11-221-24/+14
| | | | Notes: svn path=/head/; revision=69025
* Added boolean argument to link searching functions, indicatingRuslan Ermilov2000-10-307-107/+42
| | | | | | | whether they should create a link if lookup has failed or not. Notes: svn path=/head/; revision=67980
* A significant rewrite of PPTP aliasing code.Ruslan Ermilov2000-10-304-151/+265
| | | | | | | | | | | | | | | | | PPTP links are no longer dropped by simple (and inappropriate in this case) "inactivity timeout" procedure, only when requested through the control connection. It is now possible to have multiple PPTP servers running behind NAT. Just redirect the incoming TCP traffic to port 1723, everything else is done transparently. Problems were reported and the fix was tested by: Michael Adler <Michael.Adler@compaq.com>, David Andersen <dga@lcs.mit.edu> Notes: svn path=/head/; revision=67966
* A failure to allocate memory for auxiliary TCP data is now fatal.Ruslan Ermilov2000-10-191-16/+15
| | | | | | | | This fixes a null pointer dereference problem that is unlikely to happen in normal circumstances. Notes: svn path=/head/; revision=67316
* A bit of indentation reformatting.Ruslan Ermilov2000-10-021-33/+21
| | | | Notes: svn path=/head/; revision=66545
* Fixed the calculations with UDP header length field.Ruslan Ermilov2000-09-211-2/+2
| | | | | | | | | | The field is in network byte order and contains the size of the header. Reviewed by: brian Notes: svn path=/head/; revision=66157
* Add -Wmissing-prototypes.Ruslan Ermilov2000-09-152-5/+8
| | | | Notes: svn path=/head/; revision=65892
* Match IPPROTO_ICMP with IP protocol field of the original IPRuslan Ermilov2000-09-011-2/+2
| | | | | | | | | | datagram embedded into ICMP error message, not with protocol field of ICMP message itself (which is always IPPROTO_ICMP). Pointed by: Erik Salander <erik@whistle.com> Notes: svn path=/head/; revision=65332
* Changed the way we handle outgoing ICMP error messages -- doRuslan Ermilov2000-09-011-12/+22
| | | | | | | | | | | not alias `ip_src' unless it comes from the host an original datagram that triggered this error message was destined for. PR: 20712 Reviewed by: brian, Charles Mott <cmott@scientech.com> Notes: svn path=/head/; revision=65317
* Grab ADJUST_CHECKSUM() macro from alias_local.h.Ruslan Ermilov2000-08-311-17/+0
| | | | Notes: svn path=/head/; revision=65281
* Create aliasing links for incoming ICMP echo/timestamp requests.Ruslan Ermilov2000-08-312-47/+24
| | | | | | | | This makes outgoing ICMP echo/timestamp replies to be de-aliased with the right source IP, not exactly the primary aliasing IP. Notes: svn path=/head/; revision=65280
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-17 12:36:15 +0000