IPFW2 Patch part 1

Gary Allan dragonfly at gallan.plus.com
Wed Jun 28 07:23:21 PDT 2006


Hello,

This patch removes ipfw1 in favour of ipfw2. ipfw2 is a superset of 
ipfw1 and no functionality should be lost. This will make bringing in 
improvements to ipfw2 from FreeBSD easier. This includes a PFIL_HOOKS 
conversion and additional functionality.

After applying the patch you must rebuild world and kernel. [ Or at 
least kernel, sbin/ipfw and lib/libalias are recompiled and reinstalled. ]

Regards

Gary

Files that can be removed.
  sbin/ipfw/ipfw.c
  sys/net/ipfw/ip_fw.c
Files modified by patch.
  lib/libalias/Makefile
  lib/libalias/alias_db.c
  sbin/ipfw/Makefile
  src/sbin/ipfw/ipfw.8
  sys/conf/options
  src/sys/i386/conf/LINT
  sys/net/dummynet/Makefile
  sys/net/dummynet/ip_dummynet.c
  sys/net/ipfw/Makefile
  sys/net/ipfw/ip_fw.h
  sys/net/ipfw/ip_fw2.c

Index: lib/libalias/Makefile
===================================================================
RCS file: /home/dcvs/src/lib/libalias/Makefile,v
retrieving revision 1.3
diff -u -r1.3 Makefile
--- lib/libalias/Makefile	21 Apr 2005 13:42:33 -0000	1.3
+++ lib/libalias/Makefile	28 Jun 2006 02:30:49 -0000
@@ -4,9 +4,7 @@
 LIB=		alias
 SHLIB_MAJOR=	5
 CFLAGS+=	-Wall -Wmissing-prototypes
-.if defined(IPFW2)
 CFLAGS+=	-DIPFW2
-.endif
 SRCS=		alias.c alias_cuseeme.c alias_db.c alias_ftp.c alias_irc.c \
 		alias_nbt.c alias_pptp.c alias_proxy.c alias_smedia.c \
 		alias_util.c
Index: lib/libalias/alias_db.c
===================================================================
RCS file: /home/dcvs/src/lib/libalias/alias_db.c,v
retrieving revision 1.4
diff -u -r1.4 alias_db.c
--- lib/libalias/alias_db.c	20 Aug 2004 00:08:17 -0000	1.4
+++ lib/libalias/alias_db.c	28 Jun 2006 02:08:47 -0000
@@ -2643,7 +2643,6 @@
 #include <string.h>
 #include <err.h>
 
-#if IPFW2		/* support for new firewall code */
 /*
  * helper function, updates the pointer to cmd with the length
  * of the current command, and also cleans up the first word of
@@ -2713,7 +2712,6 @@
 
     return ((void *)cmd - buf);
 }
-#endif /* IPFW2 */
 
 static void ClearAllFWHoles(void);
 
@@ -2804,7 +2802,6 @@
      *	add fwhole accept tcp from OAddr OPort to DAddr DPort
      *	add fwhole accept tcp from DAddr DPort to OAddr OPort
      */
-#if IPFW2
     if (GetOriginalPort(link) != 0 && GetDestPort(link) != 0) {
 	u_int32_t rulebuf[255];
 	int i;
@@ -2825,44 +2822,6 @@
 	if (r)
 		err(1, "alias punch inbound(2) setsockopt(IP_FW_ADD)");
     }
-#else	/* !IPFW2, old code to generate ipfw rule */
-
-    /* Build generic part of the two rules */
-    rule.fw_number = fwhole;
-    IP_FW_SETNSRCP(&rule, 1);	/* Number of source ports. */
-    IP_FW_SETNDSTP(&rule, 1);	/* Number of destination ports. */
-    rule.fw_flg = IP_FW_F_ACCEPT | IP_FW_F_IN | IP_FW_F_OUT;
-    rule.fw_prot = IPPROTO_TCP;
-    rule.fw_smsk.s_addr = INADDR_BROADCAST;
-    rule.fw_dmsk.s_addr = INADDR_BROADCAST;
-
-    /* Build and apply specific part of the rules */
-    rule.fw_src = GetOriginalAddress(link);
-    rule.fw_dst = GetDestAddress(link);
-    rule.fw_uar.fw_pts[0] = ntohs(GetOriginalPort(link));
-    rule.fw_uar.fw_pts[1] = ntohs(GetDestPort(link));
-
-    /* Skip non-bound links - XXX should not be strictly necessary,
-       but seems to leave hole if not done.  Leak of non-bound links?
-       (Code should be left even if the problem is fixed - it is a
-       clear optimization) */
-    if (rule.fw_uar.fw_pts[0] != 0 && rule.fw_uar.fw_pts[1] != 0) {
-        r = setsockopt(fireWallFD, IPPROTO_IP, IP_FW_ADD, &rule, sizeof rule);
-#ifdef DEBUG
-        if (r)
-            err(1, "alias punch inbound(1) setsockopt(IP_FW_ADD)");
-#endif
-        rule.fw_src = GetDestAddress(link);
-        rule.fw_dst = GetOriginalAddress(link);
-        rule.fw_uar.fw_pts[0] = ntohs(GetDestPort(link));
-        rule.fw_uar.fw_pts[1] = ntohs(GetOriginalPort(link));
-        r = setsockopt(fireWallFD, IPPROTO_IP, IP_FW_ADD, &rule, sizeof rule);
-#ifdef DEBUG
-        if (r)
-            err(1, "alias punch inbound(2) setsockopt(IP_FW_ADD)");
-#endif
-    }
-#endif /* !IPFW2 */
 /* Indicate hole applied */
     link->data.tcp->fwhole = fwhole;
     fw_setfield(fireWallField, fwhole);
@@ -2880,16 +2839,9 @@
 	    return;
 
         memset(&rule, 0, sizeof rule); /* useless for ipfw2 */
-#if IPFW2
 	while (!setsockopt(fireWallFD, IPPROTO_IP, IP_FW_DEL,
 		    &fwhole, sizeof fwhole))
 	    ;
-#else /* !IPFW2 */
-        rule.fw_number = fwhole;
-        while (!setsockopt(fireWallFD, IPPROTO_IP, IP_FW_DEL,
-		    &rule, sizeof rule))
-            ;
-#endif /* !IPFW2 */
         fw_clrfield(fireWallField, fwhole);
         link->data.tcp->fwhole = -1;
     }
@@ -2906,15 +2858,9 @@
 
     memset(&rule, 0, sizeof rule);
     for (i = fireWallBaseNum; i < fireWallBaseNum + fireWallNumNums; i++) {
-#if IPFW2
 	int r = i;
 	while (!setsockopt(fireWallFD, IPPROTO_IP, IP_FW_DEL, &r, sizeof r))
 	    ;
-#else /* !IPFW2 */
-        rule.fw_number = i;
-        while (!setsockopt(fireWallFD, IPPROTO_IP, IP_FW_DEL, &rule, sizeof rule))
-            ;
-#endif /* !IPFW2 */
     }
     memset(fireWallField, 0, fireWallNumNums);
 }
Index: sbin/ipfw/Makefile
===================================================================
RCS file: /home/dcvs/src/sbin/ipfw/Makefile,v
retrieving revision 1.2
diff -u -r1.2 Makefile
--- sbin/ipfw/Makefile	17 Jun 2003 04:27:33 -0000	1.2
+++ sbin/ipfw/Makefile	28 Jun 2006 02:29:42 -0000
@@ -4,9 +4,7 @@
 PROG=	ipfw
 MAN=	ipfw.8
 CFLAGS+=-Wall
-.if defined(IPFW2)
 SRCS=	ipfw2.c
 CFLAGS+= -DIPFW2
-.endif
 
 .include <bsd.prog.mk>
Index: sbin/ipfw/ipfw.8
===================================================================
RCS file: /home/dcvs/src/sbin/ipfw/ipfw.8,v
retrieving revision 1.8
diff -u -r1.8 ipfw.8
--- sbin/ipfw/ipfw.8	25 Jun 2006 11:02:37 -0000	1.8
+++ sbin/ipfw/ipfw.8	28 Jun 2006 02:27:09 -0000
@@ -89,13 +89,6 @@
 .Sx IPFW2 ENHANCEMENTS ,
 which you are encouraged to read to revise older rulesets and possibly
 write them more efficiently.
-See Section
-.Sx USING IPFW2 IN FreeBSD-STABLE
-for instructions on how to run
-.Nm ipfw2
-on
-.Fx
-STABLE.
 .Ed
 .Pp
 An
@@ -1625,27 +1618,6 @@
 .Nm .
 Default is no.
 .El
-.Sh USING IPFW2 IN FreeBSD-STABLE
-.Nm ipfw2
-is standard in
-.Fx
-CURRENT, whereas
-.Fx
-STABLE still uses
-.Nm ipfw1
-unless the kernel is compiled with
-.Cm options IPFW2 ,
-and
-.Nm /sbin/ipfw
-and
-.Nm /usr/lib/libalias
-are recompiled with
-.Cm -DIPFW2
-and reinstalled (the same effect can be achieved by adding
-.Cm IPFW2=TRUE
-to
-.Nm /etc/make.conf
-before a buildworld).
 .Sh IPFW2 ENHANCEMENTS
 This Section lists the features that have been introduced in
 .Nm ipfw2
Index: sys/conf/options
===================================================================
RCS file: /home/dcvs/src/sys/conf/options,v
retrieving revision 1.50
diff -u -r1.50 options
--- sys/conf/options	25 Jun 2006 11:02:37 -0000	1.50
+++ sys/conf/options	28 Jun 2006 02:13:56 -0000
@@ -283,7 +283,6 @@
 IPFILTER_LOG		opt_ipfilter.h
 IPFILTER_DEFAULT_BLOCK	opt_ipfilter.h
 IPFIREWALL		opt_ipfw.h
-IPFW2			opt_ipfw.h
 IPFIREWALL_VERBOSE	opt_ipfw.h
 IPFIREWALL_VERBOSE_LIMIT	opt_ipfw.h
 IPFIREWALL_DEFAULT_TO_ACCEPT	opt_ipfw.h
Index: sys/i386/conf/LINT
===================================================================
RCS file: /home/dcvs/src/sys/i386/conf/LINT,v
retrieving revision 1.84
diff -u -r1.84 LINT
--- sys/i386/conf/LINT	25 Jun 2006 11:02:39 -0000	1.84
+++ sys/i386/conf/LINT	28 Jun 2006 02:14:24 -0000
@@ -2650,7 +2650,6 @@
 options 	FE_8BIT_SUPPORT
 options 	I4B_SMP_WORKAROUND
 options 	I586_PMC_GUPROF=0x70000
-options 	IPFW2
 options 	KBDIO_DEBUG=2
 options 	KBD_MAXRETRY=4
 options 	KBD_MAXWAIT=6
Index: sys/net/dummynet/Makefile
===================================================================
RCS file: /home/dcvs/src/sys/net/dummynet/Makefile,v
retrieving revision 1.3
diff -u -r1.3 Makefile
--- sys/net/dummynet/Makefile	25 Jun 2006 11:02:39 -0000	1.3
+++ sys/net/dummynet/Makefile	28 Jun 2006 14:05:12 -0000
@@ -5,9 +5,7 @@
 KMOD=   dummynet
 SRCS=   ip_dummynet.c
 NOMAN=
-.if defined(IPFW2)
 CFLAGS+= -DIPFW2
-.endif
 KMODDEPS= ipfw
 
 .include <bsd.kmod.mk>
Index: sys/net/dummynet/ip_dummynet.c
===================================================================
RCS file: /home/dcvs/src/sys/net/dummynet/ip_dummynet.c,v
retrieving revision 1.18
diff -u -r1.18 ip_dummynet.c
--- sys/net/dummynet/ip_dummynet.c	25 Jun 2006 11:02:39 -0000	1.18
+++ sys/net/dummynet/ip_dummynet.c	28 Jun 2006 02:16:01 -0000
@@ -1000,7 +1000,6 @@
 struct dn_flow_set *
 locate_flowset(int pipe_nr, struct ip_fw *rule)
 {
-#if IPFW2
     struct dn_flow_set *fs;
     ipfw_insn *cmd = rule->cmd + rule->act_ofs;
 
@@ -1012,11 +1011,6 @@
 	return fs;
 
     if (cmd->opcode == O_QUEUE)
-#else /* !IPFW2 */
-    struct dn_flow_set *fs = NULL ;
-
-    if ( (rule->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_QUEUE )
-#endif /* !IPFW2 */
 	for (fs=all_flow_sets; fs && fs->fs_nr != pipe_nr; fs=fs->next)
 	    ;
     else {
@@ -1027,12 +1021,7 @@
 	    fs = &(p1->fs) ;
     }
     /* record for the future */
-#if IPFW2
     ((ipfw_insn_pipe *)cmd)->pipe_ptr = fs;
-#else
-    if (fs != NULL)
-	rule->pipe_ptr = fs;
-#endif
     return fs ;
 }
 
@@ -1062,15 +1051,11 @@
     int is_pipe;
 
     crit_enter();
-#if IPFW2
     ipfw_insn *cmd = fwa->rule->cmd + fwa->rule->act_ofs;
 
     if (cmd->opcode == O_LOG)
 	cmd += F_LEN(cmd);
     is_pipe = (cmd->opcode == O_PIPE);
-#else
-    is_pipe = (fwa->rule->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_PIPE;
-#endif
 
     pipe_nr &= 0xffff ;
 
Index: sys/net/ipfw/Makefile
===================================================================
RCS file: /home/dcvs/src/sys/net/ipfw/Makefile,v
retrieving revision 1.2
diff -u -r1.2 Makefile
--- sys/net/ipfw/Makefile	17 Jun 2003 04:28:44 -0000	1.2
+++ sys/net/ipfw/Makefile	28 Jun 2006 02:33:39 -0000
@@ -5,12 +5,8 @@
 KMOD=	ipfw
 NOMAN=
 CFLAGS+= -DIPFIREWALL
-.if defined(IPFW2)
 SRCS=	ip_fw2.c
 CFLAGS+= -DIPFW2
-.else
-SRCS=	ip_fw.c
-.endif
 #
 #If you want it verbose
 #CFLAGS+= -DIPFIREWALL_VERBOSE
Index: sys/net/ipfw/ip_fw.h
===================================================================
RCS file: /home/dcvs/src/sys/net/ipfw/ip_fw.h,v
retrieving revision 1.7
diff -u -r1.7 ip_fw.h
--- sys/net/ipfw/ip_fw.h	25 Jun 2006 11:02:39 -0000	1.7
+++ sys/net/ipfw/ip_fw.h	28 Jun 2006 02:17:51 -0000
@@ -18,358 +18,6 @@
 #ifndef _IP_FW_H
 #define _IP_FW_H
 
-#if IPFW2
 #include "ip_fw2.h"
-#else /* !IPFW2, good old ipfw */
 
-#include <sys/queue.h>
-
-/*
- * This union structure identifies an interface, either explicitly
- * by name or implicitly by IP address. The flags IP_FW_F_IIFNAME
- * and IP_FW_F_OIFNAME say how to interpret this structure. An
- * interface unit number of -1 matches any unit number, while an
- * IP address of 0.0.0.0 indicates matches any interface.
- *
- * The receive and transmit interfaces are only compared against the
- * the packet if the corresponding bit (IP_FW_F_IIFACE or IP_FW_F_OIFACE)
- * is set. Note some packets lack a receive or transmit interface
- * (in which case the missing "interface" never matches).
- */
-
-union ip_fw_if {
-	struct in_addr	fu_via_ip;	/* Specified by IP address */
-	struct {			/* Specified by interface name */
-#define FW_IFNLEN	IFNAMSIZ
-		char	name[FW_IFNLEN];
-		short	glob;
-	} fu_via_if;
-};
-
-/*
- * Format of an IP firewall descriptor
- *
- * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
- * fw_flg and fw_n*p are stored in host byte order (of course).
- * Port numbers are stored in HOST byte order.
- */
-
-struct ip_fw {
-	LIST_ENTRY(ip_fw) next;		/* bidirectional list of rules */
-	u_int32_t	fw_flg;		/* Operational Flags word */
-	u_int64_t	fw_pcnt;	/* Packet counters */
-	u_int64_t	fw_bcnt;	/* Byte counters */
-	struct in_addr	fw_src;		/* Source IP address */
-	struct in_addr	fw_dst;		/* Destination IP address */
-	struct in_addr	fw_smsk;	/* Mask for source IP address */
-	struct in_addr	fw_dmsk;	/* Mask for destination address */
-	u_short		fw_number;	/* Rule number */
-	u_char		fw_prot;	/* IP protocol */
-#if 1
-	u_char		fw_nports;	/* # of src/dst port in array */
-#define	IP_FW_GETNSRCP(rule)		((rule)->fw_nports & 0x0f)
-#define	IP_FW_SETNSRCP(rule, n)		do {				\
-					    (rule)->fw_nports &= ~0x0f;	\
-					    (rule)->fw_nports |= (n);	\
-					} while (0)
-#define	IP_FW_GETNDSTP(rule)		((rule)->fw_nports >> 4)
-#define	IP_FW_SETNDSTP(rule, n)		do {				  \
-					    (rule)->fw_nports &= ~0xf0;	  \
-					    (rule)->fw_nports |= (n) << 4;\
-					} while (0)
-#define	IP_FW_HAVEPORTS(rule)		((rule)->fw_nports != 0)
-#else
-	u_char		__pad[1];
-	u_int		_nsrcp;
-	u_int		_ndstp;
-#define	IP_FW_GETNSRCP(rule)		(rule)->_nsrcp
-#define	IP_FW_SETNSRCP(rule,n)		(rule)->_nsrcp = n
-#define	IP_FW_GETNDSTP(rule)		(rule)->_ndstp
-#define	IP_FW_SETNDSTP(rule,n)		(rule)->_ndstp = n
-#define	IP_FW_HAVEPORTS(rule)		((rule)->_ndstp + (rule)->_nsrcp != 0)
-#endif
-#define	IP_FW_MAX_PORTS	10		/* A reasonable maximum */
-    union {
-	u_short		fw_pts[IP_FW_MAX_PORTS]; /* port numbers to match */
-#define	IP_FW_ICMPTYPES_MAX	128
-#define	IP_FW_ICMPTYPES_DIM	(IP_FW_ICMPTYPES_MAX / (sizeof(unsigned) * 8))
-	unsigned	fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /*ICMP types bitmap*/
-    } fw_uar;
-
-	u_int		fw_ipflg;	/* IP flags word */
-	u_short		fw_iplen;	/* IP length XXX */
-	u_short		fw_ipid;	/* Identification XXX */
-
-	u_char		fw_ipopt;	/* IP options set */
-	u_char		fw_ipnopt;	/* IP options unset */
-	u_char		fw_iptos;	/* IP type of service set XXX */
-	u_char		fw_ipntos;	/* IP type of service unset XXX */
-
-	u_char		fw_ipttl;	/* IP time to live XXX */
-	u_char		fw_ipver:4;	/* IP version XXX */
-	u_char		fw_tcpopt;	/* TCP options set */
-	u_char		fw_tcpnopt;	/* TCP options unset */
-
-	u_char		fw_tcpf;	/* TCP flags set/unset */
-	u_char		fw_tcpnf;	/* TCP flags set/unset */
-	u_short		fw_tcpwin;	/* TCP window size XXX */
-
-	u_int32_t	fw_tcpseq;	/* TCP sequence XXX */
-	u_int32_t	fw_tcpack;	/* TCP acknowledgement XXX */
-
-	long		timestamp;	/* timestamp (tv_sec) of last match */
-	union ip_fw_if	fw_in_if;	/* Incoming interfaces */
-	union ip_fw_if	fw_out_if;	/* Outgoing interfaces */
-    union {
-	u_short		fu_divert_port;	/* Divert/tee port (options IPDIVERT) */
-	u_short		fu_pipe_nr;	/* queue number (option DUMMYNET) */
-	u_short		fu_skipto_rule;	/* SKIPTO command rule number */
-	u_short		fu_reject_code;	/* REJECT response code */
-	struct sockaddr_in fu_fwd_ip;
-    } fw_un;
-
-	/*
-	 * N'of src ports and # of dst ports in ports array (dst ports
-	 * follow src ports; max of 10 ports in all; count of 0 means
-	 * match all ports)
-	 */
-	void		*pipe_ptr;	/* flow_set ptr for dummynet pipe */
-	void		*next_rule_ptr;	/* next rule in case of match */
-	uid_t		fw_uid;		/* uid to match */
-	gid_t		fw_gid;		/* gid to match */
-	int		fw_logamount;	/* amount to log */
-	u_int64_t	fw_loghighest;	/* highest number packet to log */
-
-	long		dont_match_prob; /* 0x7fffffff means 1.0-always fail */
-	u_char		dyn_type;	/* type for dynamic rule */
-
-#define	DYN_KEEP_STATE	0	/* type for keep-state rules    */
-#define	DYN_LIMIT	1	/* type for limit connection rules */
-#define	DYN_LIMIT_PARENT 2	/* parent entry for limit connection rules */
-
-	/*
-	 * following two fields are used to limit number of connections
-	 * basing on either src, srcport, dst, dstport.
-	 */
-	u_char		limit_mask;	/* mask type for limit rule, can
-					 * have many.
-					 */
-#define	DYN_SRC_ADDR	0x1
-#define	DYN_SRC_PORT	0x2
-#define	DYN_DST_ADDR	0x4
-#define	DYN_DST_PORT	0x8
-
-	u_short		conn_limit;	/* # of connections for limit rule */
-};
-
-#define	fw_divert_port	fw_un.fu_divert_port
-#define	fw_skipto_rule	fw_un.fu_skipto_rule
-#define	fw_reject_code	fw_un.fu_reject_code
-#define	fw_pipe_nr	fw_un.fu_pipe_nr
-#define	fw_fwd_ip	fw_un.fu_fwd_ip
-
-/*
- *
- *   rule_ptr  -------------+
- *                          V
- *     [ next.le_next ]---->[ next.le_next ]---- [ next.le_next ]--->
- *     [ next.le_prev ]<----[ next.le_prev ]<----[ next.le_prev ]<---
- *     [ <ip_fw> body ]     [ <ip_fw> body ]     [ <ip_fw> body ]
- *
- */
- 
-/*
- * Flow mask/flow id for each queue.
- */
-struct ipfw_flow_id {
-	u_int32_t	dst_ip;
-	u_int32_t	src_ip;
-	u_int16_t	dst_port;
-	u_int16_t	src_port;
-	u_int8_t	proto;
-	u_int8_t	flags;	/* protocol-specific flags */
-};
-
-/*
- * dynamic ipfw rule
- */
-struct ipfw_dyn_rule {
-	struct ipfw_dyn_rule *next;
-	struct ipfw_flow_id id;		/* (masked) flow id */
-	struct ip_fw	*rule;		/* pointer to rule */
-	struct ipfw_dyn_rule *parent;	/* pointer to parent rule */
-	u_int32_t	expire;		/* expire time */
-	u_int64_t	pcnt;		/* packet match counters */
-	u_int64_t	bcnt;		/* byte match counters */
-	u_int32_t	bucket;		/* which bucket in hash table */
-	u_int32_t	state;		/* state of this rule (typically a
-					 * combination of TCP flags)
-					 */
-	u_int16_t	dyn_type;	/* rule type */
-	u_int16_t	count;		/* refcount */
-};
-
-/*
- * Values for "flags" field .
- */
-#define	IP_FW_F_COMMAND	0x000000ff	/* Mask for type of chain entry: */
-#define	IP_FW_F_DENY	0x00000000	/* This is a deny rule */
-#define	IP_FW_F_REJECT	0x00000001	/* Deny and send a response packet */
-#define	IP_FW_F_ACCEPT	0x00000002	/* This is an accept rule */
-#define	IP_FW_F_COUNT	0x00000003	/* This is a count rule */
-#define	IP_FW_F_DIVERT	0x00000004	/* This is a divert rule */
-#define	IP_FW_F_TEE	0x00000005	/* This is a tee rule */
-#define	IP_FW_F_SKIPTO	0x00000006	/* This is a skipto rule */
-#define	IP_FW_F_FWD	0x00000007	/* This is a "change forwarding
-					 * address" rule
-					 */
-#define	IP_FW_F_PIPE	0x00000008	/* This is a dummynet rule */
-#define	IP_FW_F_QUEUE	0x00000009	/* This is a dummynet queue */
-
-#define	IP_FW_F_IN	0x00000100	/* Check inbound packets */
-#define	IP_FW_F_OUT	0x00000200	/* Check outbound packets */
-#define	IP_FW_F_IIFACE	0x00000400	/* Apply inbound interface test */
-#define	IP_FW_F_OIFACE	0x00000800	/* Apply outbound interface test */
-#define	IP_FW_F_PRN	0x00001000	/* Print if this rule matches */
-#define	IP_FW_F_SRNG	0x00002000	/* The first two src ports are a min
-					 * and max range (stored in host byte
-					 * order).
-					 */
-#define	IP_FW_F_DRNG	0x00004000	/* The first two dst ports are a min
-					 * and max range (stored in host byte
-					 * order).
-					 */
-#define	IP_FW_F_FRAG	0x00008000	/* Fragment */
-#define	IP_FW_F_IIFNAME	0x00010000	/* In interface by name/unit (not IP) */
-#define	IP_FW_F_OIFNAME	0x00020000	/* Out interface by name/unit (not IP)*/
-#define	IP_FW_F_INVSRC	0x00040000	/* Invert sense of src check */
-#define	IP_FW_F_INVDST	0x00080000	/* Invert sense of dst check */
-#define	IP_FW_F_ICMPBIT	0x00100000	/* ICMP type bitmap is valid */
-#define	IP_FW_F_UID	0x00200000	/* filter by uid */
-#define	IP_FW_F_GID	0x00400000	/* filter by gid */
-#define	IP_FW_F_RND_MATCH 0x00800000	/* probabilistic rule match */
-#define	IP_FW_F_SMSK	0x01000000	/* src-port + mask */
-#define	IP_FW_F_DMSK	0x02000000	/* dst-port + mask */
-#define	IP_FW_UNUSED0	0x04000000
-#define	IP_FW_F_KEEP_S	0x08000000	/* keep state */
-#define	IP_FW_F_CHECK_S	0x10000000	/* check state */
-#define	IP_FW_F_SME	0x20000000	/* source = me */
-#define	IP_FW_F_DME	0x40000000	/* destination = me */
-
-#define	IP_FW_F_MASK	0x7FFFFFFF	/* All possible flag bits mask */
-
-/*
- * Flags for the 'fw_ipflg' field, for comparing values
- * of ip and its protocols. Not all are currently used,
- * IP_FW_IF_*MSK list the one actually used.
- */
-#define	IP_FW_IF_TCPOPT	0x00000001      /* tcp options */
-#define	IP_FW_IF_TCPFLG	0x00000002      /* tcp flags */
-#define	IP_FW_IF_TCPSEQ	0x00000004      /* tcp sequence number */
-#define	IP_FW_IF_TCPACK	0x00000008      /* tcp acknowledgement number */
-#define	IP_FW_IF_TCPWIN	0x00000010      /* tcp window size */
-#define	IP_FW_IF_TCPEST	0x00000020      /* established TCP connection */
-#define	IP_FW_IF_TCPMSK	0x00000020      /* mask of all tcp values */
-
-#define	IP_FW_IF_IPOPT	0x00000100      /* ip options */
-#define	IP_FW_IF_IPLEN	0x00000200      /* ip length */
-#define	IP_FW_IF_IPID	0x00000400      /* ip identification */
-#define	IP_FW_IF_IPTOS	0x00000800      /* ip type of service */
-#define	IP_FW_IF_IPTTL	0x00001000      /* ip time to live */
-#define	IP_FW_IF_IPVER	0x00002000      /* ip version */
-#define	IP_FW_IF_IPMSK	0x00000000      /* mask of all ip values */
-
-#define	IP_FW_IF_MSK    0x00000020      /* All possible bits mask */
- 
-/*
- * For backwards compatibility with rules specifying "via iface" but
- * not restricted to only "in" or "out" packets, we define this combination
- * of bits to represent this configuration.
- */
-
-#define	IF_FW_F_VIAHACK (IP_FW_F_IN|IP_FW_F_OUT|IP_FW_F_IIFACE|IP_FW_F_OIFACE)
-
-/*
- * Definitions for REJECT response codes.
- * Values less than 256 correspond to ICMP unreachable codes.
- */
-#define	IP_FW_REJECT_RST	0x0100	/* TCP packets: send RST */
-
-/*
- * Definitions for IP option names.
- */
-#define	IP_FW_IPOPT_LSRR	0x01
-#define	IP_FW_IPOPT_SSRR	0x02
-#define	IP_FW_IPOPT_RR		0x04
-#define	IP_FW_IPOPT_TS		0x08
-
-/*
- * Definitions for TCP option names.
- */
-#define	IP_FW_TCPOPT_MSS	0x01
-#define	IP_FW_TCPOPT_WINDOW	0x02
-#define	IP_FW_TCPOPT_SACK	0x04
-#define	IP_FW_TCPOPT_TS		0x08
-#define	IP_FW_TCPOPT_CC		0x10
-
-/*
- * Definitions for TCP flags.
- */
-#define	IP_FW_TCPF_FIN		TH_FIN
-#define	IP_FW_TCPF_SYN		TH_SYN
-#define	IP_FW_TCPF_RST		TH_RST
-#define	IP_FW_TCPF_PSH		TH_PUSH
-#define	IP_FW_TCPF_ACK		TH_ACK
-#define	IP_FW_TCPF_URG		TH_URG
-
-/*
- * Main firewall chains definitions and global var's definitions.
- */
-#ifdef _KERNEL
-
-#define	IP_FW_PORT_DYNT_FLAG	0x10000
-#define	IP_FW_PORT_TEE_FLAG	0x20000
-#define	IP_FW_PORT_DENY_FLAG	0x40000
-
-/*
- * arguments for calling ipfw_chk() and dummynet_io(). We put them
- * all into a structure because this way it is easier and more
- * efficient to pass variables around and extend the interface.
- */
-struct ip_fw_args {
-	struct mbuf	*m;		/* the mbuf chain		*/
-	struct ifnet	*oif;		/* output interface		*/
-	struct sockaddr_in *next_hop;	/* forward address		*/
-	struct ip_fw	*rule;		/* matching rule		*/
-	struct ether_header *eh;	/* for bridged packets		*/
-
-	struct route	*ro;		/* for dummynet			*/
-	struct sockaddr_in *dst;	/* for dummynet			*/
-	int flags;			/* for dummynet			*/
-
-	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/
-	u_int32_t	retval;
-};
-
-/*
- * Function definitions.
- */
-void ip_fw_init (void);
-
-/* Firewall hooks */
-struct sockopt;
-struct dn_flow_set;
-void flush_pipe_ptrs(struct dn_flow_set *match); /* used by dummynet */
-
-typedef int ip_fw_chk_t (struct ip_fw_args *args);
-typedef int ip_fw_ctl_t (struct sockopt *);
-extern ip_fw_chk_t *ip_fw_chk_ptr;
-extern ip_fw_ctl_t *ip_fw_ctl_ptr;
-extern int fw_one_pass;
-extern int fw_enable;
-extern struct ipfw_flow_id last_pkt;
-#define IPFW_LOADED	(ip_fw_chk_ptr != NULL)
-#endif /* _KERNEL */
-
-#endif /* !IPFW2 */
 #endif /* _IP_FW_H */
Index: sys/net/ipfw/ip_fw2.c
===================================================================
RCS file: /home/dcvs/src/sys/net/ipfw/ip_fw2.c,v
retrieving revision 1.19
diff -u -r1.19 ip_fw2.c
--- sys/net/ipfw/ip_fw2.c	25 Jun 2006 11:02:39 -0000	1.19
+++ sys/net/ipfw/ip_fw2.c	28 Jun 2006 02:20:23 -0000
@@ -43,7 +43,6 @@
 #endif /* INET */
 #endif
 
-#if IPFW2
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
@@ -2767,4 +2766,4 @@
 };
 DECLARE_MODULE(ipfw, ipfwmod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 MODULE_VERSION(ipfw, 1);
-#endif /* IPFW2 */
+




More information about the Submit mailing list