1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-23 11:18:54 +00:00
Mirror of the FreeBSD src repository https://git.FreeBSD.org/src.git .
Go to file
Luigi Rizzo 9758b77ff1 The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.

The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).

The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c .  Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw).  The old files are still there, and will be removed
in due time.

I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.

In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.

On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like

ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any

This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.

Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:

        10.20.30.0/26{18,44,33,22,9}

which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).

Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.

The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
bin Document addition of RLIMIT_VMEM support, added in rev 1.26 of miscbltin.c. 2002-06-27 16:56:45 +00:00
contrib Warnings fixes. Sort out some variable types. 2002-06-26 17:06:14 +00:00
crypto Forcibly revert to mainline. 2002-06-27 22:42:11 +00:00
etc Revert previous delta, setting the system immutable flag on /var/empty 2002-06-26 17:05:48 +00:00
games Use varargs for syserr(). 2002-06-23 18:30:29 +00:00
gnu NO_GDB while it is being upgraded. 2002-06-27 22:59:11 +00:00
include The thread-safe time functions appear to have been introduced as of 2002-06-27 20:18:45 +00:00
kerberos5 Make this -j safe. 2002-05-14 15:27:13 +00:00
kerberosIV This code is no longer WARNS level 2 OK. 2002-05-15 06:32:29 +00:00
lib The new ipfw code. 2002-06-27 23:02:18 +00:00
libexec When the -p flag is specified, set an environment variable to the name 2002-06-26 21:46:56 +00:00
release Arrgh. Forgot to note that fixes for SA-02:28 have been MFC-ed. 2002-06-27 16:47:31 +00:00
sbin The new ipfw code. 2002-06-27 23:02:18 +00:00
secure No guts, no glory. Switch to OpenSSH-portable. 2002-06-25 19:10:09 +00:00
share If CLEANFILES is nil or not defined, do not try to remove it. This happens 2002-06-26 08:41:00 +00:00
sys The new ipfw code. 2002-06-27 23:02:18 +00:00
tools The wrong y/// output got spammed into this file; from green@ indirectly. 2002-06-27 16:07:51 +00:00
usr.bin Increment morefiles, balance braces. This should really be using getopt(3). 2002-06-27 21:11:19 +00:00
usr.sbin In the SUPPORT_DOT case, warn that seperation with a period is deprecated. 2002-06-27 21:23:16 +00:00
COPYRIGHT
MAINTAINERS I hope I won't regret this too much. 2002-06-24 12:33:19 +00:00
Makefile correct syntax in last commit 2002-06-24 20:13:09 +00:00
Makefile.inc1 Make NO_OPENSSL actually imply NO_OPENSSH, as documented in make.conf(5). 2002-06-21 08:54:03 +00:00
Makefile.upgrade
README Spell "FreeBSD" correctly. 2002-03-26 12:35:49 +00:00
UPDATING Slightly modify the UPDATING text to indicate that -gstabs+ is a gcc 2002-06-05 20:21:40 +00:00

This is the top level of the FreeBSD source directory.  This file
was last revised on:
$FreeBSD$

For copyright information, please see the file COPYRIGHT in this
directory (additional copyright information also exists for some
sources in this tree - please see the specific source directories for
more information).

The Makefile in this directory supports a number of targets for
building components (or all) of the FreeBSD source tree, the most
commonly used one being ``world'', which rebuilds and installs
everything in the FreeBSD system from the source tree except the
kernel, the kernel-modules and the contents of /etc.  The
``buildkernel'' and ``installkernel'' targets build and install
the kernel and the modules (see below).  Please see the top of
the Makefile in this directory for more information on the
standard build targets and compile-time flags.

Building a kernel is a somewhat more involved process, documentation
for which can be found at:
   http://www.FreeBSD.org/handbook/kernelconfig.html
And in the config(8) man page.
Note: If you want to build and install the kernel with the
``buildkernel'' and ``installkernel'' targets, you might need to build
world before.  More information is available in the handbook.

The sample kernel configuration files reside in the sys/<arch>/conf
sub-directory (assuming that you've installed the kernel sources), the
file named GENERIC being the one used to build your initial installation
kernel.  The file NOTES contains entries and documentation for all possible
devices, not just those commonly used.  It is the successor of the ancient
LINT file, but in contrast to LINT, it is not buildable as a kernel but a
pure reference and documentation file.


Source Roadmap:
---------------
bin		System/user commands.

contrib		Packages contributed by 3rd parties.

crypto		Cryptography stuff (see crypto/README).

etc		Template files for /etc.

games		Amusements.

gnu		Various commands and libraries under the GNU Public License.
		Please see gnu/COPYING* for more information.

include		System include files.

kerberos5	Kerberos5 (Heimdal) package.

kerberosIV	KerberosIV (eBones) package.

lib		System libraries.

libexec		System daemons.

release		Release building Makefile & associated tools.

sbin		System commands.

secure		Cryptographic libraries and commands.

share		Shared resources.

sys		Kernel sources.

tools		Utilities for regression testing and miscellaneous tasks.

usr.bin		User commands.

usr.sbin	System administration commands.


For information on synchronizing your source tree with one or more of
the FreeBSD Project's development branches, please see:

  http://www.FreeBSD.org/handbook/synching.html