mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-15 10:17:20 +00:00
Code Issues Releases Activity
2c8fe19f89
freebsd/sys/netinet/ip_fw.c
Ugen J.S. Antsilevich 9870b4d2de Allocate memory as M_IPFW,now we can watch firewall memory usage 
in vmstat..
1995-03-12 13:28:13 +00:00

985 lines
22 KiB
C
Raw Blame History

/*
* Copyright (c) 1993 Daniel Boulet
* Copyright (c) 1994 Ugen J.S.Antsilevich
*
* Redistribution and use in source forms, with and without modification,
* are permitted provided that this entire comment appears intact.
*
* Redistribution in binary form may occur without any restrictions.
* Obviously, it would be nice if you gave credit where credit is due
* but requiring it would be too onerous.
*
* This software is provided ``AS IS'' without any warranties of any kind.
*/
/*
* Implement IP packet firewall
*/
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/kernel.h>
#include <net/if.h>
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <arpa/inet.h>
#include <netinet/ip_fw.h>
#ifdef IPFIREWALL_DEBUG
#define dprintf1(a) printf(a)
#define dprintf2(a1,a2) printf(a1,a2)
#define dprintf3(a1,a2,a3) printf(a1,a2,a3)
#define dprintf4(a1,a2,a3,a4) printf(a1,a2,a3,a4)
#else
#define dprintf1(a)
#define dprintf2(a1,a2)
#define dprintf3(a1,a2,a3)
#define dprintf4(a1,a2,a3,a4)
#endif
#define print_ip(a) printf("%d.%d.%d.%d",(ntohl(a.s_addr)>>24)&0xFF,\
(ntohl(a.s_addr)>>16)&0xFF,\
(ntohl(a.s_addr)>>8)&0xFF,\
(ntohl(a.s_addr))&0xFF);
#ifdef IPFIREWALL_DEBUG
#define dprint_ip(a) print_ip(a)
#else
#define dprint_ip(a)
#endif
/*
* Returns 1 if the port is matched by the vector, 0 otherwise
*/
inline
int port_match(portptr,nports,port,range_flag)
u_short *portptr;
int nports;
u_short port;
int range_flag;
{
if (!nports)
return 1;
if (range_flag) {
if (portptr[0]<=port && port<=portptr[1]) {
return 1;
}
nports-=2;
portptr+=2;
}
while (nports-->0) {
if (*portptr++==port) {
return 1;
}
}
return 0;
}
/*
* Returns 0 if packet should be dropped, 1 or more if it should be accepted
*/
#ifdef IPFIREWALL
int ip_fw_chk(ip,rif,chain)
struct ip *ip;
struct ifnet *rif;
struct ip_fw *chain;
{
register struct ip_fw *f;
struct tcphdr *tcp=(struct tcphdr *)((u_long *)ip+ip->ip_hl);
struct udphdr *udp=(struct udphdr *)((u_long *)ip+ip->ip_hl);
struct icmp *icmp=(struct icmp *)((u_long *)ip+ip->ip_hl);
struct ifaddr *ia=NULL, *ia_p;
struct in_addr src, dst, ia_i;
struct mbuf *m;
u_short src_port=0, dst_port=0;
u_short f_prt=0, prt;
char notcpsyn=1;
/*
* If the chain is empty
* allow any packet-this is equal
* to disabling firewall.
*/
if (!chain)
return(1);
/*
* This way we handle fragmented packets.
* we ignore all fragments but the first one
* so the whole packet can't be reassembled.
* This way we relay on the full info which
* stored only in first packet.
*/
if (ip->ip_off&IP_OFFMASK)
return(1);
src = ip->ip_src;
dst = ip->ip_dst;
/*
* If we got interface from
* which packet came-store
* pointer to it's first adress
*/
if (rif)
ia=rif->if_addrlist;
dprintf1("Packet ");
switch(ip->ip_p) {
case IPPROTO_TCP:
dprintf1("TCP ");
src_port=ntohs(tcp->th_sport);
dst_port=ntohs(tcp->th_dport);
if (tcp->th_flags&TH_SYN)
notcpsyn=0; /* We *DO* have SYN ,value FALSE */
prt=IP_FW_F_TCP;
break;
case IPPROTO_UDP:
dprintf1("UDP ");
src_port=ntohs(udp->uh_sport);
dst_port=ntohs(udp->uh_dport);
prt=IP_FW_F_UDP;
break;
case IPPROTO_ICMP:
dprintf2("ICMP:%u ",icmp->icmp_type);
prt=IP_FW_F_ICMP;
break;
default:
dprintf2("p=%d ",ip->ip_p);
prt=IP_FW_F_ALL;
break;
}
dprint_ip(ip->ip_src);
if (ip->ip_p==IPPROTO_TCP || ip->ip_p==IPPROTO_UDP) {
dprintf2(":%d ",src_port);
}
dprint_ip(ip->ip_dst);
if (ip->ip_p==IPPROTO_TCP || ip->ip_p==IPPROTO_UDP) {
dprintf2(":%d ",dst_port);
}
dprintf1("\n");
for (f=chain;f;f=f->fw_next)
if ((src.s_addr&f->fw_smsk.s_addr)==f->fw_src.s_addr
&& (dst.s_addr&f->fw_dmsk.s_addr)==f->fw_dst.s_addr) {
if (!rif)
goto via_match;
if (f->fw_flg&IP_FW_F_IFNAME) {
if (!f->fw_via_name[0])
goto via_match; /* No name/unit set,match any */
if (rif->if_unit==f->fw_via_unit &&
!strncmp(rif->if_name,f->fw_via_name,FW_IFNLEN))
goto via_match;
} else {
if (!f->fw_via_ip.s_addr)
goto via_match; /* No via ip set,match any */
for (ia_p=ia;ia_p;ia_p=ia_p->ifa_next) {
if (!ia_p->ifa_addr||ia_p->ifa_addr->sa_family!=AF_INET)
continue;
ia_i.s_addr=(((struct sockaddr_in *)\
(ia_p->ifa_addr))->sin_addr.s_addr);
if (ia_i.s_addr==f->fw_via_ip.s_addr)
goto via_match;
}
}
/*
* If we got here,no "via"'s matched,so
* we should continue to the next firewall entry.
*/
continue;
via_match:
f_prt=f->fw_flg&IP_FW_F_KIND;
if (f_prt==IP_FW_F_ALL) {
/* Universal frwl - we've got a match! */
goto got_match;
} else {
/*
* This is actually buggy as if you set SYN flag
* on UDp or ICMP firewall it will never work,but
* actually it is a concern of software which sets
* firewall entries.
*/
if (f->fw_flg&IP_FW_F_TCPSYN && notcpsyn)
continue;
/*
* Specific firewall - packet's
* protocol must match firewall's
*/
if (prt==f_prt) {
if (prt==IP_FW_F_ICMP ||
(port_match(&f->fw_pts[0],f->fw_nsp,src_port,
f->fw_flg&IP_FW_F_SRNG) &&
port_match(&f->fw_pts[f->fw_nsp],f->fw_ndp,dst_port,
f->fw_flg&IP_FW_F_DRNG))) {
goto got_match;
} /* Ports match */
} /* Proto matches */
} /* ALL/Specific */
} /* IP addr/mask matches */
/*
* If we get here then none of the firewalls matched.
* So now we relay on policy defined by user-unmatched packet can
* be ever accepted or rejected...
*/
f=(struct ip_fw *)NULL;
if (ip_fw_policy&IP_FW_P_DENY)
goto bad_packet;
else
goto good_packet;
got_match:
#ifdef IPFIREWALL_VERBOSE
/*
* VERY ugly piece of code which actually
* makes kernel printf for denied packets...
*/
if (f->fw_flg&IP_FW_F_PRN) {
if (f->fw_flg&IP_FW_F_ACCEPT)
printf("Accept ");
else
printf("Deny ");
switch(ip->ip_p) {
case IPPROTO_TCP:
printf("TCP ");
break;
case IPPROTO_UDP:
printf("UDP ");
break;
case IPPROTO_ICMP:
printf("ICMP:%u ",icmp->icmp_type);
break;
default:
printf("p=%d ",ip->ip_p);
break;
}
print_ip(ip->ip_src);
if (ip->ip_p==IPPROTO_TCP || ip->ip_p==IPPROTO_UDP)
printf(":%d",src_port);
printf(" ");
print_ip(ip->ip_dst);
if (ip->ip_p==IPPROTO_TCP || ip->ip_p==IPPROTO_UDP)
printf(":%d",dst_port);
printf("\n");
}
#endif
if (f->fw_flg&IP_FW_F_ACCEPT)
goto good_packet;
#ifdef noneed
else
goto bad_packet;
#endif
bad_packet:
if (f) {
/*
* Do not ICMP reply to icmp
* packets....:)
*/
if (f_prt==IP_FW_F_ICMP)
return 0;
/*
* Reply to packets rejected
* by entry with this flag
* set only.
*/
if (!(f->fw_flg&IP_FW_F_ICMPRPL))
return 0;
m = m_get(M_DONTWAIT, MT_SOOPTS);
/*
* We never retry,we don't want to
* waste time-it is not so critical
* if ICMP unsent.
*/
if (!m)
return 0;
m->m_len = sizeof(struct ip)+64;
bcopy((caddr_t)ip,mtod(m, caddr_t),(unsigned)m->m_len);
if (f_prt==IP_FW_F_ALL)
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0L, 0);
else
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0L, 0);
return 0;
} else {
/*
* If global icmp flag set we will do
* something here...later..
*/
return 0;
}
good_packet:
return 1;
}
#endif /* IPFIREWALL */
#ifdef IPACCT
void ip_acct_cnt(ip,rif,chain,nh_conv)
struct ip *ip;
struct ifnet *rif;
struct ip_fw *chain;
int nh_conv;
{
register struct ip_fw *f;
struct tcphdr *tcp=(struct tcphdr *)((u_long *)ip+ip->ip_hl);
struct udphdr *udp=(struct udphdr *)((u_long *)ip+ip->ip_hl);
struct ifaddr *ia=NULL, *ia_p;
struct in_addr src, dst, ia_i;
u_short src_port=0, dst_port=0;
u_short f_prt, prt=0;
char rev=0;
if (!chain)
return;
if (ip->ip_off&IP_OFFMASK)
return;
src = ip->ip_src;
dst = ip->ip_dst;
if (rif)
ia=rif->if_addrlist;
switch(ip->ip_p) {
case IPPROTO_TCP:
src_port=ntohs(tcp->th_sport);
dst_port=ntohs(tcp->th_dport);
prt=IP_FW_F_TCP;
break;
case IPPROTO_UDP:
src_port=ntohs(udp->uh_sport);
dst_port=ntohs(udp->uh_dport);
prt=IP_FW_F_UDP;
break;
case IPPROTO_ICMP:
prt=IP_FW_F_ICMP;
break;
default:
prt=IP_FW_F_ALL;
break;
}
for (f=chain;f;f=f->fw_next) {
if ((src.s_addr&f->fw_smsk.s_addr)==f->fw_src.s_addr
&& (dst.s_addr&f->fw_dmsk.s_addr)==f->fw_dst.s_addr) {
rev=0;
goto addr_match;
}
if ((f->fw_flg&IP_FW_F_BIDIR) &&
((src.s_addr&f->fw_smsk.s_addr)==f->fw_dst.s_addr
&& (dst.s_addr&f->fw_dmsk.s_addr)==f->fw_src.s_addr)) {
rev=1;
goto addr_match;
}
continue;
addr_match:
/*
* We use here same code for "via" matching
* as in firewall.This is wrong and does not do
* much use,because in most cases instead of interface
* passed NULL pointer.Need to be completely
* rewritten.
*/
if (!rif)
goto via_match;
if (f->fw_flg&IP_FW_F_IFNAME) {
if (!f->fw_via_name[0])
goto via_match; /* No name/unit set,match any */
if (rif->if_unit==f->fw_via_unit &&
!strncmp(rif->if_name,f->fw_via_name,FW_IFNLEN))
goto via_match;
} else {
if (!f->fw_via_ip.s_addr)
goto via_match; /* No via ip set,match any */
for (ia_p=ia;ia_p;ia_p=ia_p->ifa_next) {
if (!ia_p->ifa_addr||ia_p->ifa_addr->sa_family!=AF_INET)
continue;
ia_i.s_addr=(((struct sockaddr_in *)\
(ia_p->ifa_addr))->sin_addr.s_addr);
if (ia_i.s_addr==f->fw_via_ip.s_addr)
goto via_match;
}
}
/*
* If we got here,no "via"'s matched,so
* we should continue to the next firewall entry.
*/
continue;
via_match:
f_prt=f->fw_flg&IP_FW_F_KIND;
if (f_prt==IP_FW_F_ALL) {
/* Universal frwl - we've got a match! */
f->fw_pcnt++; /* Rise packet count */
/*
* Rise byte count,
* if need to convert from
* host to network byte
* order,do it.
*/
if (nh_conv)
f->fw_bcnt+=ntohs(ip->ip_len);
else
f->fw_bcnt+=ip->ip_len;
} else {
/*
* Specific firewall - packet's
* protocol must match firewall's
*/
if (prt==f_prt) {
if ((prt==IP_FW_F_ICMP ||
(port_match(&f->fw_pts[0],f->fw_nsp,src_port,
f->fw_flg&IP_FW_F_SRNG) &&
port_match(&f->fw_pts[f->fw_nsp],f->fw_ndp,dst_port,
f->fw_flg&IP_FW_F_DRNG)))
|| ((rev)
&& (port_match(&f->fw_pts[0],f->fw_nsp,dst_port,
f->fw_flg&IP_FW_F_SRNG)
&& port_match(&f->fw_pts[f->fw_nsp],f->fw_ndp,src_port,
f->fw_flg&IP_FW_F_DRNG))))
{
f->fw_pcnt++; /* Rise packet count */
/*
* Rise byte count,
* if need to convert from
* host to network byte
* order,do it.
*/
if (nh_conv)
f->fw_bcnt+=ntohs(ip->ip_len);
else
f->fw_bcnt+=ip->ip_len;
} /* Ports match */
} /* Proto matches */
} /* ALL/Specific */
} /* IP addr/mask matches */
} /* End of whole function */
#endif /* IPACCT */
static
void
zero_fw_chain(chainptr)
struct ip_fw *chainptr;
{
struct ip_fw *ctmp=chainptr;
while(ctmp) {
ctmp->fw_pcnt=0l;
ctmp->fw_bcnt=0l;
ctmp=ctmp->fw_next;
}
}
static
void
free_fw_chain(chainptr)
struct ip_fw **chainptr;
{
int s=splnet();
while (*chainptr) {
struct ip_fw *ftmp;
ftmp = *chainptr;
*chainptr = ftmp->fw_next;
free(ftmp,M_IPFW);
}
splx(s);
}
static
int
add_entry(chainptr,frwl)
struct ip_fw **chainptr;
struct ip_fw *frwl;
{
struct ip_fw *ftmp;
struct ip_fw *chtmp=NULL;
struct ip_fw *chtmp_prev=NULL;
int s=splnet();
u_long m_src_mask,m_dst_mask;
u_long n_sa,n_da,o_sa,o_da,o_sm,o_dm,n_sm,n_dm;
u_short n_sr,n_dr,o_sr,o_dr;
u_short oldkind,newkind;
int addb4=0;
int n_o,n_n;
ftmp = malloc(sizeof(struct ip_fw),M_IPFW,M_DONTWAIT);
if ( ftmp == NULL ) {
dprintf1("ip_fw_ctl: malloc said no\n");
splx(s);
return(ENOSPC);
}
bcopy(frwl,ftmp,sizeof(struct ip_fw));
ftmp->fw_pcnt=0L;
ftmp->fw_bcnt=0L;
ftmp->fw_next = NULL;
if (*chainptr==NULL)
{
*chainptr=ftmp;
}
else
{
chtmp_prev=NULL;
for (chtmp=*chainptr;chtmp!=NULL;chtmp=chtmp->fw_next) {
addb4=0;
newkind=ftmp->fw_flg & IP_FW_F_KIND;
oldkind=chtmp->fw_flg & IP_FW_F_KIND;
if (newkind!=IP_FW_F_ALL
&& oldkind!=IP_FW_F_ALL
&& oldkind!=newkind) {
chtmp_prev=chtmp;
continue;
}
/*
* Very very *UGLY* code...
* Sorry,but i had to do this....
*/
n_sa=ntohl(ftmp->fw_src.s_addr);
n_da=ntohl(ftmp->fw_dst.s_addr);
n_sm=ntohl(ftmp->fw_smsk.s_addr);
n_dm=ntohl(ftmp->fw_dmsk.s_addr);
o_sa=ntohl(chtmp->fw_src.s_addr);
o_da=ntohl(chtmp->fw_dst.s_addr);
o_sm=ntohl(chtmp->fw_smsk.s_addr);
o_dm=ntohl(chtmp->fw_dmsk.s_addr);
m_src_mask = o_sm & n_sm;
m_dst_mask = o_dm & n_dm;
if ((o_sa & m_src_mask) == (n_sa & m_src_mask)) {
if (n_sm > o_sm)
addb4++;
if (n_sm < o_sm)
addb4--;
}
if ((o_da & m_dst_mask) == (n_da & m_dst_mask)) {
if (n_dm > o_dm)
addb4++;
if (n_dm < o_dm)
addb4--;
}
if (((o_da & o_dm) == (n_da & n_dm))
&&((o_sa & o_sm) == (n_sa & n_sm)))
{
if (newkind!=IP_FW_F_ALL &&
oldkind==IP_FW_F_ALL)
addb4++;
if (newkind==oldkind && (oldkind==IP_FW_F_TCP
|| oldkind==IP_FW_F_UDP)) {
/*
* Here the main ide is to check the size
* of port range which the frwl covers
* We actually don't check their values but
* just the wideness of range they have
* so that less wide ranges or single ports
* go first and wide ranges go later. No ports
* at all treated as a range of maximum number
* of ports.
*/
if (ftmp->fw_flg & IP_FW_F_SRNG)
n_sr=ftmp->fw_pts[1]-ftmp->fw_pts[0];
else
n_sr=(ftmp->fw_nsp)?
ftmp->fw_nsp : USHRT_MAX;
if (chtmp->fw_flg & IP_FW_F_SRNG)
o_sr=chtmp->fw_pts[1]-chtmp->fw_pts[0];
else
o_sr=(chtmp->fw_nsp)?
chtmp->fw_nsp : USHRT_MAX;
if (n_sr<o_sr)
addb4++;
if (n_sr>o_sr)
addb4--;
n_n=ftmp->fw_nsp;
n_o=chtmp->fw_nsp;
/*
* Actually this cannot happen as the frwl control
* procedure checks for number of ports in source and
* destination range but we will try to be more safe.
*/
if ((n_n>(IP_FW_MAX_PORTS-2)) ||
(n_o>(IP_FW_MAX_PORTS-2)))
goto skip_check;
if (ftmp->fw_flg & IP_FW_F_DRNG)
n_dr=ftmp->fw_pts[n_n+1]-ftmp->fw_pts[n_n];
else
n_dr=(ftmp->fw_ndp)?
ftmp->fw_ndp : USHRT_MAX;
if (chtmp->fw_flg & IP_FW_F_DRNG)
o_dr=chtmp->fw_pts[n_o+1]-chtmp->fw_pts[n_o];
else
o_dr=(chtmp->fw_ndp)?
chtmp->fw_ndp : USHRT_MAX;
if (n_dr<o_dr)
addb4++;
if (n_dr>o_dr)
addb4--;
skip_check:
}
}
if (addb4>0) {
if (chtmp_prev) {
chtmp_prev->fw_next=ftmp;
ftmp->fw_next=chtmp;
} else {
*chainptr=ftmp;
ftmp->fw_next=chtmp;
}
splx(s);
return 0;
}
chtmp_prev=chtmp;
}
if (chtmp_prev)
chtmp_prev->fw_next=ftmp;
else
#ifdef DIAGNOSTICS
panic("Can't happen");
#else
*chainptr=ftmp;
#endif
}
splx(s);
return(0);
}
static
int
del_entry(chainptr,frwl)
struct ip_fw **chainptr;
struct ip_fw *frwl;
{
struct ip_fw *ftmp,*ltmp;
u_short tport1,tport2,tmpnum;
char matches,was_found;
int s=splnet();
ftmp=*chainptr;
if (ftmp == NULL) {
dprintf1("ip_fw_ctl: chain is empty\n");
splx(s);
return(EINVAL);
}
ltmp=NULL;
was_found=0;
while(ftmp)
{
matches=1;
if (ftmp->fw_src.s_addr!=frwl->fw_src.s_addr
|| ftmp->fw_dst.s_addr!=frwl->fw_dst.s_addr
|| ftmp->fw_smsk.s_addr!=frwl->fw_smsk.s_addr
|| ftmp->fw_dmsk.s_addr!=frwl->fw_dmsk.s_addr
|| ftmp->fw_via_ip.s_addr!=frwl->fw_via_ip.s_addr
|| ftmp->fw_flg!=frwl->fw_flg)
matches=0;
tport1=ftmp->fw_nsp+ftmp->fw_ndp;
tport2=frwl->fw_nsp+frwl->fw_ndp;
if (tport1!=tport2)
matches=0;
else
if (tport1!=0)
{
for (tmpnum=0;tmpnum < tport1 && tmpnum < IP_FW_MAX_PORTS;tmpnum++)
if (ftmp->fw_pts[tmpnum]!=frwl->fw_pts[tmpnum])
matches=0;
}
if(matches)
{
was_found=1;
if (ltmp)
{
ltmp->fw_next=ftmp->fw_next;
free(ftmp,M_IPFW);
ftmp=ltmp->fw_next;
}
else
{
*chainptr=ftmp->fw_next;
free(ftmp,M_IPFW);
ftmp=*chainptr;
}
}
else
{
ltmp = ftmp;
ftmp = ftmp->fw_next;
}
}
splx(s);
if (was_found) return 0;
else return(EINVAL);
}
static
int
clr_entry(chainptr,frwl)
struct ip_fw **chainptr;
struct ip_fw *frwl;
{
struct ip_fw *ftmp,*ltmp;
u_short tport1,tport2,tmpnum;
char matches,was_found;
ftmp=*chainptr;
if (ftmp == NULL) {
dprintf1("ip_fw_ctl: chain is empty\n");
return(EINVAL);
}
was_found=0;
while(ftmp)
{
matches=1;
if (ftmp->fw_src.s_addr!=frwl->fw_src.s_addr
|| ftmp->fw_dst.s_addr!=frwl->fw_dst.s_addr
|| ftmp->fw_smsk.s_addr!=frwl->fw_smsk.s_addr
|| ftmp->fw_dmsk.s_addr!=frwl->fw_dmsk.s_addr
|| ftmp->fw_via_ip.s_addr!=frwl->fw_via_ip.s_addr
|| ftmp->fw_flg!=frwl->fw_flg)
matches=0;
tport1=ftmp->fw_nsp+ftmp->fw_ndp;
tport2=frwl->fw_nsp+frwl->fw_ndp;
if (tport1!=tport2)
matches=0;
else
if (tport1!=0)
{
for (tmpnum=0;tmpnum < tport1 && tmpnum < IP_FW_MAX_PORTS;tmpnum++)
if (ftmp->fw_pts[tmpnum]!=frwl->fw_pts[tmpnum])
matches=0;
}
if(matches)
{
was_found=1;
ftmp->fw_pcnt=0L;
ftmp->fw_bcnt=0L;
}
ftmp=ftmp->fw_next;
}
if (was_found) return 0;
else return(EINVAL);
}
struct ip_fw *
check_ipfw_struct(m)
struct mbuf *m;
{
struct ip_fw *frwl;
if ( m->m_len != sizeof(struct ip_fw) ) {
dprintf3("ip_fw_ctl: len=%d, want %d\n",m->m_len,
sizeof(struct ip_fw));
return(NULL);
}
frwl = mtod(m,struct ip_fw*);
if ( (frwl->fw_flg & ~IP_FW_F_MASK) != 0 ) {
dprintf2("ip_fw_ctl: undefined flag bits set (flags=%x)\n",
frwl->fw_flg);
return(NULL);
}
if ( (frwl->fw_flg & IP_FW_F_SRNG) && frwl->fw_nsp < 2 ) {
dprintf2("ip_fw_ctl: src range set but n_src_p=%d\n",
frwl->fw_nsp);
return(NULL);
}
if ( (frwl->fw_flg & IP_FW_F_DRNG) && frwl->fw_ndp < 2 ) {
dprintf2("ip_fw_ctl: dst range set but n_dst_p=%d\n",
frwl->fw_ndp);
return(NULL);
}
if ( frwl->fw_nsp + frwl->fw_ndp > IP_FW_MAX_PORTS ) {
dprintf3("ip_fw_ctl: too many ports (%d+%d)\n",
frwl->fw_nsp,frwl->fw_ndp);
return(NULL);
}
#if 0
if ( (frwl->fw_flg & IP_FW_F_KIND) == IP_FW_F_ICMP ) {
dprintf1("ip_fw_ctl: request for unsupported ICMP frwling\n");
return(NULL);
}
#endif
return frwl;
}
#ifdef IPACCT
int
ip_acct_ctl(stage,m)
int stage;
struct mbuf *m;
{
if ( stage == IP_ACCT_FLUSH )
{
free_fw_chain(&ip_acct_chain);
return(0);
}
if ( stage == IP_ACCT_ZERO )
{
zero_fw_chain(ip_acct_chain);
return(0);
}
if ( stage == IP_ACCT_ADD
|| stage == IP_ACCT_DEL
|| stage == IP_ACCT_CLR
) {
struct ip_fw *frwl;
if (!(frwl=check_ipfw_struct(m)))
return (EINVAL);
switch (stage) {
case IP_ACCT_ADD:
return( add_entry(&ip_acct_chain,frwl));
case IP_ACCT_DEL:
return( del_entry(&ip_acct_chain,frwl));
case IP_ACCT_CLR:
return( clr_entry(&ip_acct_chain,frwl));
default:
#ifdef DIAGNOSTICS
panic("Can't happen");
#else
dprintf2("ip_acct_ctl: unknown request %d\n",stage);
return(EINVAL);
#endif
}
}
dprintf2("ip_acct_ctl: unknown request %d\n",stage);
return(EINVAL);
}
#endif
#ifdef IPFIREWALL
int
ip_fw_ctl(stage,m)
int stage;
struct mbuf *m;
{
if ( stage == IP_FW_FLUSH )
{
free_fw_chain(&ip_fw_chain);
return(0);
}
if ( m == 0 )
{
printf("ip_fw_ctl: NULL mbuf ptr\n");
return(EINVAL);
}
if ( stage == IP_FW_POLICY )
{
u_short *tmp_policy_ptr;
tmp_policy_ptr=mtod(m,u_short *);
if ((*tmp_policy_ptr)&~IP_FW_P_MASK)
return (EINVAL);
ip_fw_policy=*tmp_policy_ptr;
return 0;
}
/*
* Here we really working hard-adding new elements
* to firewall chain or deleting'em
*/
if ( stage == IP_FW_ADD ||
stage == IP_FW_DEL ) {
struct ip_fw *frwl;
if (!(frwl=check_ipfw_struct(m)))
return (EINVAL);
switch (stage) {
case IP_FW_ADD:
return(add_entry(&ip_fw_chain,frwl));
case IP_FW_DEL:
return(del_entry(&ip_fw_chain,frwl));
default:
#ifdef DIAGNOSTICS
panic("Can't happen");
#else
dprintf2("ip_fw_ctl: unknown request %d\n",stage);
return(EINVAL);
#endif
}
}
dprintf2("ip_fw_ctl: unknown request %d\n",stage);
return(EINVAL);
}
#endif /* IPFIREWALL */
Reference in New Issue View Git Blame Copy Permalink