1 1.1 christos # 2 1.1 christos # NOTE: Quite a few patches and suggestions come from other sources, to whom 3 1.1 christos # I'm greatly indebted, even if no names are mentioned. 4 1.1 christos # 5 1.1 christos # Thanks to the Coombs Computing Unit at the ANU for their continued support 6 1.1 christos # in providing a very available location for the IP Filter home page and 7 1.1 christos # distribution center. 8 1.1 christos # 9 1.1 christos # Thanks also to all those who have contributed patches and other code, 10 1.1 christos # and especially those who have found the time to port IP Filter to new 11 1.1 christos # platforms. 12 1.1 christos # 13 1.1.1.2 darrenr 5.1.2 - RELEASED - 22 Jul 2012 14 1.1.1.2 darrenr 15 1.1.1.2 darrenr 3546266 macro letters could be more consistent 16 1.1.1.2 darrenr 3546265 not all of the state statistics are displayed 17 1.1.1.2 darrenr 3546261 scripts for updating BSD environment out of date 18 1.1.1.2 darrenr 3546260 compiler warnings about non-integer array subscript 19 1.1.1.2 darrenr 3546259 asserting numdereflists == 0 is not correct 20 1.1.1.2 darrenr 3546258 expression matching does not see IPF_EXP_END 21 1.1.1.2 darrenr 3544317 ipnat/ipfstat are not using ipfexp_t 22 1.1.1.2 darrenr 3545324 proxy checksum calculation is not hardware aware 23 1.1.1.2 darrenr 3545321 FTP sequence number adjustment incorrectly applied 24 1.1.1.2 darrenr 3545320 EPSV is not recognised 25 1.1.1.2 darrenr 3545319 move nat rule creation to ip_proxy.c 26 1.1.1.2 darrenr 3545317 better feedback of checksum requirements for proxies 27 1.1.1.2 darrenr 3545314 ftp proxy levels do not make sense 28 1.1.1.2 darrenr 3545312 EPRT is not supported by ftp proxy 29 1.1.1.2 darrenr 3544318 ipnat.conf parsing ignores LHS address family 30 1.1.1.2 darrenr 3545309 non-ipv6 safe proxies do not fail with ipv6 31 1.1.1.2 darrenr 3545323 NAT updates the source port twice 32 1.1.1.2 darrenr 3545322 ipv6 nat rules cannot start proxies 33 1.1.1.2 darrenr 3544314 bucket copyout tries to copy too much data 34 1.1.1.2 darrenr 3544313 remove nat encap feature 35 1.1.1.2 darrenr 3546248 compat rule pointer type mismatch 36 1.1.1.2 darrenr 3546247 UDP hardware checksum offload not recognised 37 1.1.1.2 darrenr 3545311 ifp_ifaddr does not find the first set address 38 1.1.1.2 darrenr 3545310 ipmon needs ipl_sec on 64bit boundary 39 1.1.1.2 darrenr 3545326 reference count changes made without lock 40 1.1.1.2 darrenr 3544315 stateful matching does not use ipfexp_t 41 1.1.1.2 darrenr 3543493 tokens are not flushed when disabled 42 1.1.1.2 darrenr 3543487 NAT rules do not always release lookup objects 43 1.1.1.2 darrenr 3543491 function comments in ip_state.c are old 44 1.1.1.2 darrenr 3543404 ipnat.conf parsing uses family/ip version badly 45 1.1.1.2 darrenr 3543403 incorrect line number printed in ipnat parsing errors 46 1.1.1.2 darrenr 3543402 Not all NAT statistics are printed 47 1.1.1.2 darrenr 3542979 NAT session list management is too simple 48 1.1.1.2 darrenr 3542978 ipv4 and ipv6 nat insert have common hash insertion 49 1.1.1.2 darrenr 3542977 ipnat_t refence tracking incomplete 50 1.1.1.2 darrenr 3542975 proxies must use ipnat_t separately 51 1.1.1.2 darrenr 3542980 printing ipv6 expressions is wrong 52 1.1.1.2 darrenr 3542983 ippool cannot handle more than one ipv6 address 53 1.1.1.2 darrenr 3543018 mask array shifted incorrectly. 54 1.1.1.2 darrenr 3542974 reason for dropping packet is lost 55 1.1.1.2 darrenr 3542982 line numbers not recorded/displayed correctly by ipf 56 1.1.1.2 darrenr 3542981 exclamation mark cuases trouble with pools 57 1.1.1.2 darrenr 3541655 test suite checksums incorrect 58 1.1.1.2 darrenr 3541653 display proxy fail status correctly 59 1.1.1.2 darrenr 3540993 IP header offset excluded in pullup calculations 60 1.1.1.2 darrenr 3540994 pullupmsg does not work as required 61 1.1.1.2 darrenr 3540992 pointer to ipv6 frag header not updated on pullup 62 1.1.1.2 darrenr 3541645 netmask management adds /32 for /0 63 1.1.1.2 darrenr 3541637 ipnat parser does not zero port fields for non-port protocol 64 1.1.1.2 darrenr 3541635 pool names cannot by numbers 65 1.1.1.2 darrenr 3540995 IPv6 fragment tracking does not always work 66 1.1.1.2 darrenr 3540996 printing of nextip for ipv6 nat rules is wrong 67 1.1.1.2 darrenr 3540999 ipnat.conf parsing has trouble with icmpidmap for ipv6 68 1.1.1.2 darrenr 3540825 whois output parsing error for ipv6 69 1.1.1.2 darrenr 3540814 ipfd_lock serves no purpose 70 1.1.1.2 darrenr 3540810 lookup objects need tail pointers 71 1.1.1.2 darrenr 3540809 refactor hash table lookups for nat 72 1.1.1.2 darrenr 3540819 radix tree does not work with ipv6 73 1.1.1.2 darrenr 3540820 mutex emulation should be logged 74 1.1.1.2 darrenr 3540828 ipfstat filtering with -m fails tests 75 1.1.1.2 darrenr 3536480 ippool could be more like the others 76 1.1.1.2 darrenr 3536477 pool printing not uniform 77 1.1.1.2 darrenr 3536483 flushing empty destination lists causes panic 78 1.1.1.2 darrenr 3536481 more use of bzero after KMALLOC required 79 1.1.1.2 darrenr 3536479 ipnat.conf line numbers not stored 80 1.1.1.2 darrenr 3536484 Makefile missing dependency for ippool 81 1.1.1.2 darrenr 3536199 TFTP proxy requires something extra 82 1.1.1.2 darrenr 3536198 ICMP checksum out by one 83 1.1.1.2 darrenr 3536203 ipnat does not return an error 84 1.1.1.2 darrenr 3536201 ipf.conf parsing too address friendly 85 1.1.1.2 darrenr 3536200 printing of bytes/packets not indented 86 1.1.1.2 darrenr 3497941 ipv4 multicast detection incorrect on little endian 87 1.1.1.2 darrenr 3535361 to interfaces printed out of order 88 1.1.1.2 darrenr 3535363 ipf parser is inconsistent 89 1.1.1.2 darrenr 3532306 deleting ipnat rules does not work 90 1.1.1.2 darrenr 3532054 new error required for ipf_rx_create 91 1.1.1.2 darrenr 3532053 icmp6 checksums wrong 92 1.1.1.2 darrenr 3532052 icmpv6 state check with incorrect length 93 1.1.1.2 darrenr 3531871 checksum verification wants too many icmp6 bytes 94 1.1.1.2 darrenr 3531870 ipnat.conf parsing needs to support inet6 95 1.1.1.2 darrenr 3532048 error in ipf group parsing 96 1.1.1.2 darrenr 3531868 ICMPV6 checksum not validated 97 1.1.1.2 darrenr 3531893 ipftest exits without error for bad input 98 1.1.1.2 darrenr 3531890 whois pool parsing builds bad structures 99 1.1.1.2 darrenr 3531891 icmpv6 text parsing ignorant of icmp types 100 1.1.1.2 darrenr 3531653 rewrite with icmp does not work 101 1.1.1.2 darrenr 3530563 NAT operations fail with EPERM 102 1.1.1.2 darrenr 3530544 first pass at gcc -Wextra cleanup 103 1.1.1.2 darrenr 3530540 lookup create functions do not set error properly 104 1.1.1.2 darrenr 3530539 ipf_main_soft_destroy doesn't need 2nd arg 105 1.1.1.2 darrenr 3530541 reorder structure for better packing 106 1.1.1.2 darrenr 3530543 ipnat purge needs documentation 107 1.1.1.2 darrenr 3530515 BSD upgrade script required 108 1.1.1.2 darrenr 3528029 ipmon bad-mutex panic 109 1.1.1.2 darrenr 3530247 loading address pools light on input validation 110 1.1.1.2 darrenr 3530255 radix tree delete uses wrong lookup 111 1.1.1.2 darrenr 3530254 radix tree allocation support wrong 112 1.1.1.2 darrenr 3530264 ipmon prints qd for some 64bit numbers 113 1.1.1.2 darrenr 3530260 decapsulate rules not printed correctly. 114 1.1.1.2 darrenr 3530266 ipfstat -v/-d flags confused 115 1.1.1.2 darrenr 2939220 why a packet is blocked is not discernable 116 1.1.1.2 darrenr 2939218 output interface not recorded 117 1.1.1.2 darrenr 2941850 use of destination lists with to/dup-to beneficial 118 1.1.1.2 darrenr 3457747 build errors introduced with radix change 119 1.1.1.2 darrenr 3535360 timeout groups leak 120 1.1.1.2 darrenr 3535359 memory leak with tokens 121 1.1.1.2 darrenr 3535358 listing rules in groups requires tracking groups 122 1.1.1.2 darrenr 3535357 rule head removal is problematic 123 1.1.1.2 darrenr 3530259 not all ioctl error checked wth SIOCIPFINTERROR 124 1.1.1.2 darrenr 3530258 error routine that uses fd required 125 1.1.1.2 darrenr 3530253 inadequate function comment blocks 126 1.1.1.2 darrenr 3530249 walking lookup tables leaks memory 127 1.1.1.2 darrenr 3530241 extra lock padding required for freebsd 128 1.1.1.2 darrenr 3529901 ipf returns 0 when rules fail to load 129 1.1.1.2 darrenr 3529491 checksum validation could be better 130 1.1.1.2 darrenr 3529486 tcp checksum wrong for ipv6 131 1.1.1.2 darrenr 3533779 ipv6 nat rules missing inet6 keyword 132 1.1.1.2 darrenr 3532693 ipnat.conf rejects some ipv6 addresses 133 1.1.1.2 darrenr 3532691 ipv4 should not be forced for icmp 134 1.1.1.2 darrenr 3532689 ipv6 nat rules do not print inet6 135 1.1.1.2 darrenr 3532688 ipv6 address always printed with "to <if>" 136 1.1.1.2 darrenr 3532687 with v6hdrs not supported like with ipopts 137 1.1.1.2 darrenr 3532686 ipf expressions do not work with ipv6 138 1.1.1.2 darrenr 3540825 whois output parsing error for ipv6 139 1.1.1.2 darrenr 3540818 NAT for certain IPv6 ICMP packets should not be allowed 140 1.1.1.2 darrenr 3540815 memory leak with destination lists 141 1.1.1.2 darrenr 3540814 ipfd_lock serves no purpose 142 1.1.1.2 darrenr 3540810 lookup objects need tail pointers 143 1.1.1.2 darrenr 3540809 refactor hash table lookups for nat 144 1.1.1.2 darrenr 3540808 completed tokens do not stop iteration 145 1.1.1.2 darrenr 3530492 address hash table name not used 146 1.1.1.2 darrenr 3528029 ipmon bad-mutex panic 147 1.1.1.2 darrenr 3530256 hook memory leaked 148 1.1.1.2 darrenr 3530271 pools parsing produces badly formed address structures 149 1.1.1.2 darrenr 3488061 cleanup for illumos build 150 1.1.1.2 darrenr 3484434 SIOCIPFINTERROR must work for all devices 151 1.1.1.2 darrenr 3484067 mandoc -Tlint warnings to be fixed 152 1.1.1.2 darrenr 3483343 compile warning in ipfcomp.c 153 1.1.1.2 darrenr 3482893 building without IPFILTER_LOG fails 154 1.1.1.2 darrenr 3482765 building netbsd kernel without inet6 fails 155 1.1.1.2 darrenr 3482116 ipf_check frees packet from ipftest 156 1.1.1.2 darrenr 3481663 does not compile on solaris 11 157 1.1.1.2 darrenr 158 1.1.1.2 darrenr 5.1.1 - RELEASED - 9 May 2012 159 1.1.1.2 darrenr 160 1.1.1.2 darrenr 3481322 ip_fil_compat.c needs a cleanup 161 1.1.1.2 darrenr 3481211 add user errors to dtrace 162 1.1.1.2 darrenr 3481152 compatibility for 4.1 needs more work 163 1.1.1.2 darrenr 3481153 PRIu64 problems on FreeBSD 164 1.1.1.2 darrenr 3481155 ipnat listing incorrect 165 1.1.1.2 darrenr 3480543 change leads to compat problems 166 1.1.1.2 darrenr 3480538 compiler errors from earlier patch 167 1.1.1.2 darrenr 3480537 ipf_instance_destroy is incomplete 168 1.1.1.2 darrenr 3480536 _fini order leads to panic 169 1.1.1.2 darrenr 3479991 compiler warnings about size mismatches 170 1.1.1.2 darrenr 3479974 copyright dates are wrong (fix) 171 1.1.1.2 darrenr 3479464 add support for leaks testing 172 1.1.1.2 darrenr 3479457 %qu is not the prefered way 173 1.1.1.2 darrenr 3479451 iterators leak memory 174 1.1.1.2 darrenr 3479453 nat rules with pools leak 175 1.1.1.2 darrenr 3479454 memory leak in hostmap table 176 1.1.1.2 darrenr 3479461 load_hash uses memory after free 177 1.1.1.2 darrenr 3479462 printpool leaks memory 178 1.1.1.2 darrenr 3479452 missing FREE_MB_T to freembt leaks 179 1.1.1.2 darrenr 3479450 ipfdetach is called when detached 180 1.1.1.2 darrenr 3479448 group mapping rules memory leak 181 1.1.1.2 darrenr 3479455 memory leak from tuning 182 1.1.1.2 darrenr 3479458 ipf must be running in global zone 183 1.1.1.2 darrenr 3479460 driver replace is wrong 184 1.1.1.2 darrenr 3479459 radix tree tries to free null pointer 185 1.1.1.2 darrenr 3479463 rwlock emulation does not free memory 186 1.1.1.2 darrenr 3479465 parser leaks memory 187 1.1.1.2 darrenr 3475959 hardware checksum not correctly used 188 1.1.1.2 darrenr 3475426 ip pseudo checksum wrong 189 1.1.1.2 darrenr 3473566 radix tree does not delete dups right 190 1.1.1.2 darrenr 3472987 compile is not clean 191 1.1.1.2 darrenr 3472337 not everything is zero'd 192 1.1.1.2 darrenr 3472344 interface setup needs to be after insert 193 1.1.1.2 darrenr 3472340 wildcard counter drops twice 194 1.1.1.2 darrenr 3472338 change fastroute interface 195 1.1.1.2 darrenr 3472335 kernel lock defines not placed correctly 196 1.1.1.2 darrenr 3472324 ICMP INFOREQ/REPLY not handled 197 1.1.1.2 darrenr 3472330 multicast packets tagged by address 198 1.1.1.2 darrenr 3472333 ipf_deliverlocal called incorrectly 199 1.1.1.2 darrenr 3472345 mutex debug could be more granular 200 1.1.1.2 darrenr 3472761 building i19 regression is flawed 201 1.1.1.2 darrenr 3456457 use of bsd tree.h needs to be removed 202 1.1.1.2 darrenr 3460522 code cleanup required for building on freebsd 203 1.1.1.2 darrenr 3459734 trade some cpu for memory 204 1.1.1.2 darrenr 3457747 build errors introduced with radix change 205 1.1.1.2 darrenr 3457804 build errors from removal of pcap-int,h 206 1.1.1.2 darrenr 3440163 rewrite radix tree 207 1.1.1.2 darrenr 3428004 snoop, tcpdump, etherfind readers are unused 208 1.1.1.2 darrenr 3439495 ipf_rand_push never called (fix brackets) 209 1.1.1.2 darrenr 3437732 getnattype does not need to use ipnat_t (fix variable name) 210 1.1.1.2 darrenr 3437696 fr_cksum is a nightmare 211 1.1.1.2 darrenr 3439061 ipf_send_ip doesn't need 3rd arg 212 1.1.1.2 darrenr 3439059 ipid needs to be file local 213 1.1.1.2 darrenr 3437740 complete buildout of fnew 214 1.1.1.2 darrenr 3438575 add dtrace probes to block events 215 1.1.1.2 darrenr 3438347 comment blocks missing softc 216 1.1.1.2 darrenr 3437687 description of ipf_makefrip wrong 217 1.1.1.2 darrenr 3438340 more stats as dtrace probes 218 1.1.1.2 darrenr 3438316 free on nat structure uses fixed size 219 1.1.1.2 darrenr 3437745 nat iterator using the wrong size 220 1.1.1.2 darrenr 3437710 fail checksum verification if packet is short 221 1.1.1.2 darrenr 3437696 fr_cksum is a nightmare 222 1.1.1.2 darrenr 3437732 getnattype does not need to use ipnat_t 223 1.1.1.2 darrenr 3437735 rename ipf_allocmbt to allocmbt 224 1.1.1.2 darrenr 3437697 fr_family to version assignment is wrong 225 1.1.1.2 darrenr 3437746 ap_session_t has unused fields 226 1.1.1.2 darrenr 3437747 move softc structure to .h file (ip_state.c) 227 1.1.1.2 darrenr 3437704 there is no DTRACE_PROBE5 228 1.1.1.2 darrenr 3437748 wrong interface in qpktinfo_t 229 1.1.1.2 darrenr 3437729 create function to hexdump mb_t 230 1.1.1.2 darrenr 3438273 msgdsize should be easier to read 231 1.1.1.2 darrenr 3437683 object direction not set for 32bit 232 1.1.1.2 darrenr 3433767 calling ip_cksum could be easier 233 1.1.1.2 darrenr 3433764 left over locking 234 1.1.1.2 darrenr 3428015 printing proxy data size is useless 235 1.1.1.2 darrenr 3428013 add M_ADJ to hide adjmsg/m_adj 236 1.1.1.2 darrenr 3428012 interface name is not always returned correctly 237 1.1.1.2 darrenr 3428002 ip_ttl is too low 238 1.1.1.2 darrenr 3427997 ipft readers do not set buffer length 239 1.1.1.2 darrenr 3426558 resistence is futile 240 1.1.1.2 darrenr 3424495 various copy-paste errors 241 1.1.1.2 darrenr 1826936 shall we allow ipf to be as dumb as its admin 242 1.1.1.2 darrenr 3424477 specfuncs needs to go 243 1.1.1.2 darrenr 3424484 missing fr_checkv6sum 244 1.1.1.2 darrenr 3424478 one entry at a time 245 1.1.1.2 darrenr 2998760 auth rules do not mix well with to/dup-to/fastroute 246 1.1.1.2 darrenr 3424195 add ctfmerge to sunos5 makefile 247 1.1.1.2 darrenr 3424132 some dtrace probes to start with 248 1.1.1.2 darrenr 3423812 makefile needs ip_frag.h for some files 249 1.1.1.2 darrenr 3423817 reference count useful in verbose output 250 1.1.1.2 darrenr 3423800 walking lists does not drop reference 251 1.1.1.2 darrenr 3423805 fragmentation stats not reported correclty 252 1.1.1.2 darrenr 3423808 ip addresses reportied incorrectly with ipfstat -f 253 1.1.1.2 darrenr 3423821 track packets and bytes for fragmentation 254 1.1.1.2 darrenr 3423803 attempt to double free rule 255 1.1.1.2 darrenr 3423805 fragmentation stats not reported correctly 256 1.1.1.2 darrenr 3422712 system panic with ipfstat -f 257 1.1.1.2 darrenr 3422619 pullup counter bumped for every packet 258 1.1.1.2 darrenr 3422608 dummy rtentry required to build 259 1.1.1.2 darrenr 3422018 frflush next to ipf_fini_all is redundant 260 1.1.1.2 darrenr 3422012 instance cleanup is not clean 261 1.1.1.2 darrenr 3421845 instance name not set 262 1.1.1.2 darrenr 3005622 ip_fil5.1.0 does not load on Solaris 10 U8 263 1.1.1.2 darrenr 2976332 stateful filtering is incompatible with ipv4 options 264 1.1.1.2 darrenr 3387509 ipftest needs help construction ip packets with options 265 1.1.1.2 darrenr 2998746 passp can never be null 266 1.1.1.2 darrenr 3064034 mbuf clobbering problem with ipv6 267 1.1.1.2 darrenr 3105725 ipnat divide by zero panic 268 1.1.1.2 darrenr 2998750 ipf_htent_insert can leak memory 269 1.1.1.2 darrenr 3064034 mbuf clobbering problem with ipv6 270 1.1.1.2 darrenr 3105725 ipnat divie by zero panic 271 1.1.1.2 darrenr 272 1.1 christos 5.1 - RELEASED - 9 May 2010 273 1.1 christos 274 1.1 christos * See WhatsNew50.txt 275 1.1 christos 276 1.1 christos 4.1 - RELEASED - 12 February 2004 277 1.1 christos 278 1.1 christos 4.0-BETA1 20 August 2003 279 1.1 christos 280 1.1 christos support 0/32 and 0/0 on the RHS in redirect rules 281 1.1 christos 282 1.1 christos where LHS and RHS netmasks are the same size for redirect, do 1:1 mapping 283 1.1 christos for bimap rules. 284 1.1 christos 285 1.1 christos allow NAT rule to match 'all' interfaces with * as interface name 286 1.1 christos 287 1.1 christos do mapping of ICMP sequence id#'s in pings 288 1.1 christos 289 1.1 christos allow default age for NAT entries to be set per NAT rule 290 1.1 christos 291 1.1 christos provide round robin selection of destination addresses for redirect 292 1.1 christos 293 1.1 christos ipmon can load a configuration file with instructions on actions 294 1.1 christos to take when a matching log entry is received 295 1.1 christos 296 1.1 christos now requires pfil to work on Solaris & HP-UX 297 1.1 christos 298 1.1 christos supports mapping outbound connections to a specific address/port 299 1.1 christos 300 1.1 christos support toggling of logging per ipfilter 'device' 301 1.1 christos 302 1.1 christos use queues to expire data rather than lists 303 1.1 christos 304 1.1 christos add MSN RPC proxy 305 1.1 christos 306 1.1 christos add IRC proxy 307 1.1 christos 308 1.1 christos support rules with dynamic ip addresses 309 1.1 christos 310 1.1 christos add ability to define a pool of addresses & networks which can then 311 1.1 christos be placed in a single rule 312 1.1 christos 313 1.1 christos support passing entire packet back to user program for authentication 314 1.1 christos 315 1.1 christos support master/slave for state information sharing 316 1.1 christos 317 1.1 christos reorganise generic code into a lib directory and make libipf.a 318 1.1 christos 319 1.1 christos user programs enforce version matching with the kernel 320 1.1 christos 321 1.1 christos supports window scaling if seen at TCP session setup 322 1.1 christos 323 1.1 christos generates C code from filter rules to compile in or load as native 324 1.1 christos machine code. 325 1.1 christos 326 1.1 christos supports loading rules comprised of BPF bytecode statements 327 1.1 christos 328 1.1 christos HP-UX 11 port completed 329 1.1 christos 330 1.1 christos and packets-per-second filtering 331 1.1 christos 332 1.1 christos add numerical tags to rules for filtering and display in ipmon output 333 1.1 christos 334 1.1 christos 3.4.4 23/05/2000 - Released 335 1.1 christos 336 1.1 christos don't add TCP state if it is an RST packet and (attempt) to send out 337 1.1 christos RST/ICMP packets in a manner that bypasses IP Filter. 338 1.1 christos 339 1.1 christos add patch to work with 4.0_STABLE delayed checksums 340 1.1 christos 341 1.1 christos 3.4.3 20/05/2000 - Released 342 1.1 christos 343 1.1 christos fix ipmon -F 344 1.1 christos 345 1.1 christos don't truncate IPv6 packets on Solaris 346 1.1 christos 347 1.1 christos fix keep state for ICMP ECHO 348 1.1 christos 349 1.1 christos add some NAT stats and use def_nat_age rather than DEF_NAT_AGE 350 1.1 christos 351 1.1 christos don't make ftp proxy drop packets 352 1.1 christos 353 1.1 christos use MCLISREFERENCED() in tandem with M_EXT to check if IP fields need to be 354 1.1 christos swapped back. 355 1.1 christos 356 1.1 christos fix up RST generation for non-Solaris 357 1.1 christos 358 1.1 christos get "short" flag right for IPv6 359 1.1 christos 360 1.1 christos 3.4.2 - 10/5/2000 - Released 361 1.1 christos 362 1.1 christos Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun 363 1.1 christos 364 1.1 christos ignore previous NAT mappings for 0/0 and 0/32 rules 365 1.1 christos 366 1.1 christos bring in a completely new ftp proxy 367 1.1 christos 368 1.1 christos allow NAT to cause packets to be dropped. 369 1.1 christos 370 1.1 christos add NetBSD callout support for 1.4-current 371 1.1 christos 372 1.1 christos 3.4.1 - 30/4/2000 - Released 373 1.1 christos 374 1.1 christos add ratoui() and fix parsing of group numbers to allow 0 - UINT_MAX 375 1.1 christos 376 1.1 christos don't include opt_inet6.h for FreeBSD if KLD_MODULE is defined 377 1.1 christos 378 1.1 christos Solaris must use copyin() for all types of ioctl() args 379 1.1 christos 380 1.1 christos fix up screen/tty when leaving "top mode" of ipfstat 381 1.1 christos 382 1.1 christos linked list for maptable not setup correctly in nat_hostmap() 383 1.1 christos 384 1.1 christos check for maptable rather than nat_table[1] to see if malloc for maptable 385 1.1 christos succeeded in nat_init 386 1.1 christos 387 1.1 christos fix handling of map NAT rules with "from/to" host specs 388 1.1 christos 389 1.1 christos fix printout out of source address when using "from/to" with map rules 390 1.1 christos 391 1.1 christos convert ip_len back to network byte order, not plen, for solaris as ip_len 392 1.1 christos may have been changed by NAT and plen won't reflect this 393 1.1 christos 394 1.1 christos 3.4 - 27/4/2000 - Released 395 1.1 christos 396 1.1 christos source address spoofing can be turned on (fr_chksrc) without using 397 1.1 christos filter rules 398 1.1 christos 399 1.1 christos group numbers are now 32bits in size, up from 16bits 400 1.1 christos 401 1.1 christos IPv6 filtering available 402 1.1 christos 403 1.1 christos add frank volf's state-top patches 404 1.1 christos 405 1.1 christos add load splitting and round-robin attribute to redirect rules 406 1.1 christos 407 1.1 christos FreeBSD-4.0 support (including KLD) 408 1.1 christos 409 1.1 christos add top-style operation mode for ipfstat (-t) 410 1.1 christos 411 1.1 christos add save/restore of IP Filter state/NAT information (ipfs) 412 1.1 christos 413 1.1 christos further ftp proxy security checks 414 1.1 christos 415 1.1 christos support for adding and removing proxies at runtime 416 1.1 christos 417 1.1 christos 3.3.13 26/04/2000 - Released 418 1.1 christos 419 1.1 christos Fix parsing of "range" with "portmap" 420 1.1 christos 421 1.1 christos Relax checking of ftp replies, slightly. 422 1.1 christos 423 1.1 christos Fix NAT timeouts for ICMP packets 424 1.1 christos 425 1.1 christos SunOS4 patches for ICMP redirects from Jurgen Keil (jk@tools.de) 426 1.1 christos 427 1.1 christos 3.3.12 16/03/2000 - Released 428 1.1 christos 429 1.1 christos tighten up ftp proxy behaviour. sigh. yuck. hate. 430 1.1 christos 431 1.1 christos fix bug in range check for NAT where the last IP# was not used. 432 1.1 christos 433 1.1 christos fix problem with icmp codes > 127 in filter rules caused bad things to 434 1.1 christos happen and in particular, where #18 caused the rule to be printed 435 1.1 christos erroneously. 436 1.1 christos 437 1.1 christos fix bug with the spl level not being reset when returning EIO from 438 1.1 christos iplioctl due to ipfilter not being initialized yet. 439 1.1 christos 440 1.1 christos 3.3.11 04/03/2000 - Released 441 1.1 christos 442 1.1 christos make "or-block" work with lines that start with "log" 443 1.1 christos 444 1.1 christos fix up parsing and printing of rules with syslog levels in them 445 1.1 christos 446 1.1 christos fix from Cy Schubert for calling of apr_fini only if non-null 447 1.1 christos 448 1.1 christos 449 1.1 christos 3.3.10 24/02/2000 - Released 450 1.1 christos 451 1.1 christos * fix back from guido for state tracking interfaces 452 1.1 christos 453 1.1 christos * update for NetBSD pfil interface changes 454 1.1 christos 455 1.1 christos * if attaching fails and we can abort, then cleanup when doing so. 456 1.1 christos 457 1.1 christos julian@computer.org: 458 1.1 christos * solaris.c (fr_precheck): After calling freemsg on mt, set it point to *mp. 459 1.1 christos * ipf.c (packetlogon): use flag to store the return value from get_flags. 460 1.1 christos * ipmon.c (init_tabs): General cleanup so we do not have to cast 461 1.1 christos an int s->s_port to u_int port and try to check if the u_int port 462 1.1 christos is less than zero. 463 1.1 christos 464 1.1 christos 3.3.9 15/02/2000 - Released 465 1.1 christos 466 1.1 christos fix scheduling of bad locking in fr_addstate() used when we attach onto 467 1.1 christos a filter rule. 468 1.1 christos 469 1.1 christos fix up ip_statesync() with storing interface names in ipstate_t 470 1.1 christos 471 1.1 christos fix fr_running for LKM's - Eugene Polovnikov 472 1.1 christos 473 1.1 christos junk using pullupmsg() for solaris - it's next to useless for what we 474 1.1 christos need to do here anyway - and implement what we require. 475 1.1 christos 476 1.1 christos don't call fr_delstate() in fr_checkstate(), when compiled for a user 477 1.1 christos program, early but when we're finished with it (got fr & pass) 478 1.1 christos 479 1.1 christos ipnat(5) fix from Guido 480 1.1 christos 481 1.1 christos on solaris2, copy message and use that with filter if there is another 482 1.1 christos copy if it being used (db_ref > 1). bad for performance, but better 483 1.1 christos than causing a crash. 484 1.1 christos 485 1.1 christos patch for solaris8-fcs compile from Casper Dik 486 1.1 christos 487 1.1 christos 3.3.8 01/02/2000 - Released 488 1.1 christos 489 1.1 christos fix state handling of SYN packets. 490 1.1 christos 491 1.1 christos add parsing recognition of extra icmp types/codes and fix handling of 492 1.1 christos icmp time stamps and mask requests - Frank volf 493 1.1 christos 494 1.1 christos 3.3.7 25/01/2000 - Released 495 1.1 christos 496 1.1 christos sync on state information as well as NAT information when required 497 1.1 christos 498 1.1 christos record nat protocol in all nat log records 499 1.1 christos 500 1.1 christos don't reuse the IP# from an active NAT session if the IP# in the rule 501 1.1 christos has changed dynamically. 502 1.1 christos 503 1.1 christos lookup the protocol for NAT log information in ipmon and pass that to 504 1.1 christos portname. 505 1.1 christos 506 1.1 christos fix the bug with changing the outbound interface of a packet where it 507 1.1 christos would lead to a panic. 508 1.1 christos 509 1.1 christos use fr_running instead of ipl_inited. (sysctl name change on freebsd) 510 1.1 christos 511 1.1 christos return EIO if someone attempts an ioctl on state/nat if ipfilter is not 512 1.1 christos enabled. 513 1.1 christos 514 1.1 christos fix rule insertion bug 515 1.1 christos 516 1.1 christos make state flushing clean anything that's not fully established (4/4) 517 1.1 christos 518 1.1 christos call fr_state_flush() after we've released ipf_state so we don't generate 519 1.1 christos a recursive mutex acquisition panic 520 1.1 christos 521 1.1 christos fix parsing of icmp code after return-icmp/return-icmp-as-dest and add 522 1.1 christos some patches to enhance parsing strength 523 1.1 christos 524 1.1 christos 3.3.6 28/12/1999 - Released 525 1.1 christos 526 1.1 christos add in missing rwlock release in fr_checkicmpmatchingstate() and fix check 527 1.1 christos for ICMP_ECHO to only be for packet, not state entry which we don't have yet. 528 1.1 christos 529 1.1 christos handle SIOCIPFFB in nat_ioctl() and fr_state_ioctl() 530 1.1 christos 531 1.1 christos fix size of friostat for SunOS4 532 1.1 christos 533 1.1 christos fix bug in running off the end of a buffer in real audio proxy 534 1.1 christos 535 1.1 christos 3.3.5 11/12/1999 - Released 536 1.1 christos 537 1.1 christos fix parsing of "log level" and printing it back out too 538 1.1 christos 539 1.1 christos <net/if_types.h> is only present on Solaris2.6/7/8 540 1.1 christos 541 1.1 christos use send_icmp_err rather than icmp_error to send back a frag-needed error 542 1.1 christos when doing PMTU 543 1.1 christos 544 1.1 christos do not use -b with add_drv on Solaris unless $BASEDIR is set. 545 1.1 christos 546 1.1 christos fix problem where source address in icmp replies is reversed 547 1.1 christos 548 1.1 christos fix yet another problem with real audio. 549 1.1 christos 550 1.1 christos 3.3.4 4/12/1999 - Released 551 1.1 christos 552 1.1 christos fix up the real audio proxy to properly setup state information and NAT 553 1.1 christos entries, thanks to Laine Stump for testing/advice/fixes. 554 1.1 christos 555 1.1 christos fix ipfr_fastroute to set dst->sin_addr (Sean Farley - appears to prevent 556 1.1 christos FreeBSD 3.3 from panic'ing) as this had been removed in prior hacks to this 557 1.1 christos routine. 558 1.1 christos 559 1.1 christos fix kinstall for BSDI 560 1.1 christos 561 1.1 christos support ICMP errors being allowed through for ICMP packets going out with 562 1.1 christos keep state enabled 563 1.1 christos 564 1.1 christos support hardware checksumming (gigabit ethernet cards) on Solaris thanks to 565 1.1 christos Tel.Net Media for providing hardware for testing. 566 1.1 christos 567 1.1 christos patched from Frank Volf for ipmon (ICMP & fragmented packets) and allowing 568 1.1 christos ICMP responses to ICMP packets in the keep state table. 569 1.1 christos 570 1.1 christos add in patches for hardware checksumming under solaris 571 1.1 christos 572 1.1 christos Solaris install scripts now use $BASEDIR as appropriate. 573 1.1 christos 574 1.1 christos add Solaris8 support 575 1.1 christos 576 1.1 christos fix "ipf -y" on solaris so that it rescans rules also for changes in 577 1.1 christos interface pointers 578 1.1 christos 579 1.1 christos let ipmon become a daemon with -D if it is using syslog 580 1.1 christos 581 1.1 christos fix parsing of return-icmp-as-dest(foo) 582 1.1 christos 583 1.1 christos add reference to ipfstat -g to ipfstat.8 584 1.1 christos 585 1.1 christos ipf_mutex needs to be declared for irix in ip_fil.c 586 1.1 christos 587 1.1 christos 3.3.3 22/10/1999 - Released 588 1.1 christos 589 1.1 christos add -g command line option to ipfstat to show groups still define. 590 1.1 christos 591 1.1 christos fix problem with fragment table not recording rule pointer when called 592 1.1 christos from state functions (fin_fr not set). 593 1.1 christos 594 1.1 christos fixup fastroute problems with keep state rules. 595 1.1 christos 596 1.1 christos load rules into inactive set first, so we don't disable things like NIS 597 1.1 christos lookups half way through processing - found by Kevin Littlejohn 598 1.1 christos 599 1.1 christos fix handling of unaligned ip pointer for solaris 600 1.1 christos 601 1.1 christos patch for fr_newauth from Rudi Sluijtman 602 1.1 christos 603 1.1 christos fixed htons() bug in fr_tcpsum() where ip_p wasn't cast to u_short 604 1.1 christos 605 1.1 christos 3.3.2 23/09/1999 - Released 606 1.1 christos 607 1.1 christos patches from Scott Presnell to fix rcmd proxy 608 1.1 christos 609 1.1 christos patches from Greg to fix Solaris detachment of interfaces 610 1.1 christos 611 1.1 christos add openbsd compatibility fixes 612 1.1 christos 613 1.1 christos fix free'ing already freed memory in ipfr_slowtimer() 614 1.1 christos 615 1.1 christos fix for deferencing invalid memory in cleaning up after a device disappears 616 1.1 christos 617 1.1 christos 3.3.1 14/8/1999 - Released 618 1.1 christos 619 1.1 christos remove include file sys/user.h for irix 620 1.1 christos 621 1.1 christos prevent people from running buildsunos directly 622 1.1 christos 623 1.1 christos fix up some problems with the saving of rule pointers so that NAT saves 624 1.1 christos that information in case it should need to call fr_addstate() from a proxy. 625 1.1 christos 626 1.1 christos fix up scanning for the end of FTP messages 627 1.1 christos 628 1.1 christos don't remove /etc/opt/ipf in postremove 629 1.1 christos 630 1.1 christos attempt to prevent people running buildsolaris script without doing a 631 1.1 christos "make solaris" 632 1.1 christos 633 1.1 christos fix timeout losing on freebsd3 634 1.1 christos 635 1.1 christos 3.3 7/8/1999 - Released 636 1.1 christos 637 1.1 christos NAT: information (rules, mappings) are stored in hash tables; setup some 638 1.1 christos basic NAT regression testing. 639 1.1 christos 640 1.1 christos display version name of installed kernel code when initializing. 641 1.1 christos 642 1.1 christos add -V command line option to ipf, showing version (program and kernel 643 1.1 christos module) as well as the run-status of the kernel code. 644 1.1 christos 645 1.1 christos fix problem with "log" rules actually affecting result of filtering. 646 1.1 christos 647 1.1 christos automatically use SUNWspro if available and on a 64bit Solaris system for 648 1.1 christos compiling. 649 1.1 christos 650 1.1 christos add kernel proxies for rcmd(3) and RealAudio (PNA) 651 1.1 christos 652 1.1 christos use timeout/untimeout on SunOS4/BSD platforms too rather than hijacking 653 1.1 christos ip_slowtimo 654 1.1 christos 655 1.1 christos fix IP headers generated through parsing of text information 656 1.1 christos 657 1.1 christos fix NAT rules to be in the correct order again. 658 1.1 christos 659 1.1 christos make keep-state work with to/fastroute keywords and enforce usage of those 660 1.1 christos interfaces. 661 1.1 christos 662 1.1 christos update keep-state code with new algorithm from Guido 663 1.1 christos 664 1.1 christos add FreeBSD-3 support 665 1.1 christos 666 1.1 christos add return-icmp-as-dest option to retrun an ICMP packet using the original 667 1.1 christos destination as the source rather than a local IP address 668 1.1 christos 669 1.1 christos add "level [facility.]<priority>" option to filter language 670 1.1 christos 671 1.1 christos add changes from Guido to state code. 672 1.1 christos 673 1.1 christos add code to return EPERM if the device is opened for writing and we're 674 1.1 christos in securelevel 2 or greater. 675 1.1 christos 676 1.1 christos authentication code patches from Guido 677 1.1 christos 678 1.1 christos fix real audio proxy 679 1.1 christos 680 1.1 christos fix ipmon rule printing of interfaces and add IN/OUT to the end of ipmon 681 1.1 christos log output. 682 1.1 christos 683 1.1 christos fix bimap rules with hash tables 684 1.1 christos 685 1.1 christos update addresses used in NAT mappings for 0/32 rules for any protocol but TCP 686 1.1 christos if it changes on the interface - check every ip_natexpire() 687 1.1 christos 688 1.1 christos add redirect regression test 689 1.1 christos 690 1.1 christos count buckets used in the state hash table. 691 1.1 christos 692 1.1 christos fix sending of RST's with return-rst to use the ack number provided in 693 1.1 christos the packet being replied to in addition to the sequence number. 694 1.1 christos 695 1.1 christos fix to compile as a 64bit application on solaris7-64bit 696 1.1 christos 697 1.1 christos add NAT IP mapping to ranges of IP addresses that aren't CIDR specified 698 1.1 christos 699 1.1 christos fix calculation of in_space parameter for NAT 700 1.1 christos 701 1.1 christos fix `wrapping' when incrementing the next ip address for use in NAT 702 1.1 christos 703 1.1 christos fix free'ing of kernel memory in ip_natunload on solaris 704 1.1 christos 705 1.1 christos fix -l/-U command line options from interfering with each other 706 1.1 christos 707 1.1 christos fix fastroute under solaris2 and cleanup compilation for solaris7 708 1.1 christos 709 1.1 christos add install scripts and compile cleanly on BSD/OS 4.0 710 1.1 christos 711 1.1 christos safely open files in /tmp for writing device output when testing. 712 1.1 christos 713 1.1 christos fix uninitialized pointer bug in NAT 714 1.1 christos 715 1.1 christos fix SIOCZRLST (zero list rule stats) bug with groups 716 1.1 christos 717 1.1 christos change some usage of u_short to u_int in function calling 718 1.1 christos 719 1.1 christos fix compilation for Solaris7 (SUNWspro) 720 1.1 christos 721 1.1 christos change solaris makefiles to build for either sparc or i386 rather than 722 1.1 christos per-cpu (sun4u, etc). 723 1.1 christos 724 1.1 christos fixed bug in ipllog 725 1.1 christos 726 1.1 christos add patches from George Michaelson for FreeBSD 3.0 727 1.1 christos 728 1.1 christos add patch from Guido to provide ICMP checking for known state in the same 729 1.1 christos manner as is done for NAT. 730 1.1 christos 731 1.1 christos enable FTP PASV proxying and enable wildcarding in NAT/state code for ports 732 1.1 christos for better PORT/PASV support with FTP. 733 1.1 christos 734 1.1 christos bring into main tree static nat features: map-block and "auto" portmapping. 735 1.1 christos 736 1.1 christos add in source host filtering for redirects (alan jones) 737 1.1 christos 738 1.1 christos 3.2.10 22/11/98 - Released 739 1.1 christos 740 1.1 christos 3.2.10beta9 17/11/98 - Released 741 1.1 christos 742 1.1 christos fix fr_tcpsum problems in handling mbufs with an odd number of bytes 743 1.1 christos and/or split across an mbuf boundary 744 1.1 christos 745 1.1 christos fix NAT list entry comparisons and allow multiple entries for the same 746 1.1 christos proxy (but on different ports). 747 1.1 christos 748 1.1 christos don't create duplicate NAT entries for repeated PORT commands. 749 1.1 christos 750 1.1 christos 3.2.10beta8 14/11/98 - Released 751 1.1 christos 752 1.1 christos always exit an rwlock before expecting to enter it again on solaris 753 1.1 christos 754 1.1 christos fix loop in nat_new for pre-existing nat 755 1.1 christos 756 1.1 christos don't setup state for an ftp connection if creating nat fails. 757 1.1 christos 758 1.1 christos 3.2.10beta7 05/11/98 - Released 759 1.1 christos 760 1.1 christos set fake window in ipft_tx.c to ensure code passes tests. 761 1.1 christos 762 1.1 christos cleaned up/enhanced ipnat -l/ipnat -lv output 763 1.1 christos 764 1.1 christos fixed NAT handling of non-TCP/UDP packets, esp. for ICMP errors returned. 765 1.1 christos 766 1.1 christos Solaris recusive mutex on icmp-error/tcp-reset - requires rwlock's rather 767 1.1 christos than mutexes. 768 1.1 christos 769 1.1 christos 3.2.10beta6 03/11/98 - Released 770 1.1 christos 771 1.1 christos fix mixed use of krwlock_t and kmutex_t on Solaris2 772 1.1 christos 773 1.1 christos fix FTP proxy back up, splitting pasv code out of port code. 774 1.1 christos 775 1.1 christos 3.2.10beta5 02/11/98 - Released 776 1.1 christos 777 1.1 christos fixed port translation in ICMP reply handling 778 1.1 christos 779 1.1 christos 3.2.10beta4 01/11/98 - Released 780 1.1 christos 781 1.1 christos increase useful statistic collection on solaris 782 1.1 christos 783 1.1 christos filter DL_UNITDATA_REQ as well as DL_UNITDATA_IND on solaris 784 1.1 christos 785 1.1 christos disable PASV reply translation for now 786 1.1 christos 787 1.1 christos fail with an error if we try to load a NAT rule with a non-existant 788 1.1 christos proxy name - Guido 789 1.1 christos 790 1.1 christos fix portmap usage with 0/0 and 0/32 map rules 791 1.1 christos 792 1.1 christos remove ap_unload/ap_expire - automatically done when NAT is cleaned up 793 1.1 christos 794 1.1 christos print "STATE:CLOSED" from ipmon if the connection progresses past established 795 1.1 christos rather than "STATE:EXPIRED" 796 1.1 christos 797 1.1 christos 3.2.10beta3 26/10/98 - Released 798 1.1 christos 799 1.1 christos fixed traceroute/nat problem 800 1.1 christos 801 1.1 christos rewrote nat/proxy interface 802 1.1 christos 803 1.1 christos ipnat now lists associated proxy sessions for each NAT where applicable 804 1.1 christos 805 1.1 christos 3.2.10beta2 13/10/98 - Released 806 1.1 christos 807 1.1 christos use KRWLOCK_T in place of krwlock_t for solaris as well as irix 808 1.1 christos 809 1.1 christos disable use of read-write lock acquisition by default 810 1.1 christos 811 1.1 christos add in mb_t for linux, non-kernel 812 1.1 christos 813 1.1 christos some changes to progress compilation on linux with glibc 814 1.1 christos 815 1.1 christos change PASV as well as PORT when passed through kernel ftp proxy. 816 1.1 christos 817 1.1 christos don't allow window to become 0 in tcp state code 818 1.1 christos 819 1.1 christos make ipmon compile cleaner 820 1.1 christos 821 1.1 christos irix patches 822 1.1 christos 823 1.1 christos 3.2.10beta 11/09/98 - Released 824 1.1 christos 825 1.1 christos stop fr_tcpsum() thinking it has run out of data when it hasn't. 826 1.1 christos 827 1.1 christos stop solaris panics due to fin_dp being something wild. 828 1.1 christos 829 1.1 christos revisit usage of ATOMIC_*() 830 1.1 christos 831 1.1 christos log closing state of TCP connection in "keep state" 832 1.1 christos 833 1.1 christos fix fake-arp table code for ipsend. 834 1.1 christos 835 1.1 christos ipmon now writes pid to a file. 836 1.1 christos 837 1.1 christos fix "ipmon -a" to actually activate all logging devices. 838 1.1 christos 839 1.1 christos add patches for BSDOS4. 840 1.1 christos 841 1.1 christos perl scripts for log analysis donated. 842 1.1 christos 843 1.1 christos 3.2.9 22/06/98 - Released 844 1.1 christos 845 1.1 christos fix byte order for ICMP packets generated on Solaris 846 1.1 christos 847 1.1 christos fix some locking problems. 848 1.1 christos 849 1.1 christos fix malloc bug in NAT (introduced in 3.2.8). 850 1.1 christos 851 1.1 christos patch from guido for state connections that get fragmented 852 1.1 christos 853 1.1 christos 3.2.8 08/06/98 - Released 854 1.1 christos 855 1.1 christos use readers/writers locks in Solaris2 in place of some mutexes. 856 1.1 christos 857 1.1 christos Solaris2 installation enhancements - Martin Forssen (maf@carlstedt.se) 858 1.1 christos 859 1.1 christos 3.2.7 24/05/98 - Released 860 1.1 christos 861 1.1 christos u_long -> u_32_t conversions 862 1.1 christos 863 1.1 christos patches from Bernd Ernesti for NetBSD 864 1.1 christos 865 1.1 christos fixup ipmon to actually handle HUP's. 866 1.1 christos 867 1.1 christos Linux fixes from Michael H. Warfield (mhw (at] wittsend.com) 868 1.1 christos 869 1.1 christos update for keep state patch (not security related) - Guido 870 1.1 christos 871 1.1 christos dumphex() uses stdout rather than log 872 1.1 christos 873 1.1 christos 3.2.6 18/05/98 - Released 874 1.1 christos 875 1.1 christos fix potential security loop hole in keep state code. 876 1.1 christos 877 1.1 christos update examples. 878 1.1 christos 879 1.1 christos 3.2.5 09/05/98 - Released 880 1.1 christos 881 1.1 christos BSD/OS 3.1 .o files added for the kernel. 882 1.1 christos 883 1.1 christos fix sequence # skew vs window size check. 884 1.1 christos 885 1.1 christos fix minimum ICMP header size check. 886 1.1 christos 887 1.1 christos remove references to Cybersource. 888 1.1 christos 889 1.1 christos fix my email address. 890 1.1 christos 891 1.1 christos remove ntohl in ipnat - Thomas Tornblom 892 1.1 christos 893 1.1 christos 3.2.4 09/04/98 - Released 894 1.1 christos 895 1.1 christos add script to make devices for /dev on BSD boxes 896 1.1 christos 897 1.1 christos fixup building into the kernel for FreeBSD 2.2.5 898 1.1 christos 899 1.1 christos add -D command line option to ipmon to make it a daemon and SIGHUP causes 900 1.1 christos it to close and reopen the logfile 901 1.1 christos 902 1.1 christos fixup make clean and make package for SunOS5 - Marc Boucher 903 1.1 christos 904 1.1 christos postinstall keeps adding "minor=ipf ipl" - George Ross <gdmr (at] dcs.ed.ac.uk> 905 1.1 christos 906 1.1 christos protected by IP Filter gif - Sergey Solyanik <solik (at] atom.ru> 907 1.1 christos 908 1.1 christos 3.2.3 10/11/97 - Released 909 1.1 christos 910 1.1 christos fix some iplang bugs 911 1.1 christos 912 1.1 christos fix tcp checksum data overrun, sgi #define changes, 913 1.1 christos avoid infinite loop when nat'ing to single IP# - Marc Boucher 914 1.1 christos 915 1.1 christos fixup DEVFS usage for FreeBSD 916 1.1 christos 917 1.1 christos fix sunos5 "make clean" cleaning up too much 918 1.1 christos 919 1.1 christos 3.2.2 28/11/97 - Released 920 1.1 christos 921 1.1 christos change packet matching to return actual error, if bad packet, to facilitate 922 1.1 christos ECONNRESET for TCP. 923 1.1 christos 924 1.1 christos allow ip:netmask in grammar too now - Guido 925 1.1 christos 926 1.1 christos assume IRIX has u_int32_t in sys/types.h (needed for R10000) 927 1.1 christos 928 1.1 christos rewrite parts of command line options for ipmon 929 1.1 christos 930 1.1 christos fix TCP urgent packet & offset testing and add LAND attack test for iptest 931 1.1 christos 932 1.1 christos fix grammar error in yacc grammar for iplang 933 1.1 christos 934 1.1 christos redirect (rdr) destination port bytes-wapped when it shouldn't be. 935 1.1 christos 936 1.1 christos general: fr_check now returns error code, such as EHOSTUNREACH or 937 1.1 christos ECONNRESET (attempt to make ECONNRESET work for locally outbound 938 1.1 christos packets). 939 1.1 christos 940 1.1 christos linux: enable return-rst, need to filter tcp retransmits which are sent 941 1.1 christos separately from normal packets 942 1.1 christos 943 1.1 christos memory leak plugged in ip_proxy.c 944 1.1 christos 945 1.1 christos BSDI compatibility patches from Guido 946 1.1 christos 947 1.1 christos tcp checksum fix - Marc Boucher 948 1.1 christos 949 1.1 christos recursive mutex and ioctl param fix - Marc Boucher 950 1.1 christos 951 1.1 christos 3.2.1 12/11/97 - Released 952 1.1 christos 953 1.1 christos port to BSD/OS 3.0 954 1.1 christos 955 1.1 christos port to Linux 2.0.31 956 1.1 christos 957 1.1 christos patches to make "map a/m -> 0/0" work with ftp proxying properly - Marc Boucher 958 1.1 christos 959 1.1 christos add "ipf -F s" and "ipf -F S" to flush state table entries. 960 1.1 christos 961 1.1 christos announce if logging is on or off when ip filter initializes. 962 1.1 christos 963 1.1 christos "ipf -F a" doesn't flush groups properly for Solaris. 964 1.1 christos 965 1.1 christos 3.2 30/10/97 - Released 966 1.1 christos 967 1.1 christos ipnat doesn't successfully remove proxy mappings with "-rf" - 968 1.1 christos Alexander Romanyu 969 1.1 christos 970 1.1 christos use K&R C function style for solaris kernel code 971 1.1 christos 972 1.1 christos use m_adj() to decrease packet size in ftp proxy 973 1.1 christos 974 1.1 christos use mbufchainlen rather than msgdsize, 975 1.1 christos IRIX update - Marc Boucher 976 1.1 christos 977 1.1 christos fix NetBSD modunload bug (pfil_add_hook done twice) 978 1.1 christos 979 1.1 christos patches for OpenBSD 2.1 - Craig Bevins <craigb (at] bitcom.net.au> 980 1.1 christos 981 1.1 christos 3.2beta10 24/10/97 - Released 982 1.1 christos 983 1.1 christos fix fragment table entries allocated for NAT. 984 1.1 christos 985 1.1 christos fix tcp checksum calculations over mbuf/mblk boundaries 986 1.1 christos 987 1.1 christos fix panic for blen < 0 in ftp kernel proxy - marc boucher 988 1.1 christos 989 1.1 christos fix flushing of rules which have been grouped. 990 1.1 christos 991 1.1 christos 3.2beta9 20/10/97 - Released 992 1.1 christos 993 1.1 christos some nit picking on solaris2 with SUNWspro - Michael Lyle <mrl (at] rpnet.net> 994 1.1 christos 995 1.1 christos ftp kernel proxy patches from Marc Boucher 996 1.1 christos 997 1.1 christos 3.2beta8 13/10/97 - Released 998 1.1 christos 999 1.1 christos add support for passing ICMP errors back through NAT. 1000 1.1 christos 1001 1.1 christos IRIX port update - Marc Boucher 1002 1.1 christos 1003 1.1 christos calculate correct MIN size of packet to log for UDP - Marc Boucher 1004 1.1 christos 1005 1.1 christos need htons(ETHERTYPE_x) on little endian BSD boxes - Dave Huang 1006 1.1 christos 1007 1.1 christos copyright header fixups 1008 1.1 christos 1009 1.1 christos 3.2beta7 23/09/97 - Released 1010 1.1 christos 1011 1.1 christos fickup problems introduced by prior merges & changes. 1012 1.1 christos 1013 1.1 christos 3.2beta6 23/09/97 - Released 1014 1.1 christos 1015 1.1 christos patch for spin-reading race condition - Marc Boucher. 1016 1.1 christos 1017 1.1 christos IRIX port by Marc Boucher. 1018 1.1 christos 1019 1.1 christos compatibility updates for Linux to ipsend 1020 1.1 christos 1021 1.1 christos 3.2beta5 13/09/97 - Released 1022 1.1 christos 1023 1.1 christos patches from Bernd Ernesti for NetBSD integration (mostly prototyping and 1024 1.1 christos compiler warning things) 1025 1.1 christos 1026 1.1 christos ipf -y will resync IP#'s allocated with 0/32 in NAT to match interface if it 1027 1.1 christos changes. 1028 1.1 christos 1029 1.1 christos update manual pages and other documentation updates. 1030 1.1 christos 1031 1.1 christos 3.2beta4 27/8/97 - Released 1032 1.1 christos 1033 1.1 christos enable setting IP and TCP options for iplang/ 1034 1.1 christos 1035 1.1 christos Solaris2 patches from Marc Boucher. 1036 1.1 christos 1037 1.1 christos add groups for filter rules. 1038 1.1 christos 1039 1.1 christos 3.2beta3 21/8/97 - Released 1040 1.1 christos 1041 1.1 christos patches for Solaris2 (interface panic solution ?): fix FIONREAD and 1042 1.1 christos replacing q_qinfo points - Marc Boucher <marc@CAM.ORG> 1043 1.1 christos 1044 1.1 christos change ipsend/* and ipsd/* copyright notices to be the same as ip filter's 1045 1.1 christos 1046 1.1 christos patch for SYN-ACK skew testing fix from Eric V. Smith <EricSmith (at] windsor.com> 1047 1.1 christos 1048 1.1 christos 3.2beta2 6/8/97 - Released 1049 1.1 christos 1050 1.1 christos make it load on Solaris 2.3 1051 1.1 christos 1052 1.1 christos rewrote logging to remove solaris errors, introduced checking to see if the 1053 1.1 christos same packet is logged successively. 1054 1.1 christos 1055 1.1 christos fix filter cache to work when there are no rules loaded. 1056 1.1 christos 1057 1.1 christos add "raw" option to ipresend to send entire ethernet frames. 1058 1.1 christos 1059 1.1 christos nat list corruption bug - NetBSD - Klaus Klein 1060 1.1 christos 1061 1.1 christos 3.2beta1 5/7/97 - Released 1062 1.1 christos 1063 1.1 christos patches from Jason Thorpe fixing: UNSIGNED_CHAR lossage, off_t being 64bits 1064 1.1 christos lossage, and other NetBSD bits. 1065 1.1 christos 1066 1.1 christos NetBSD 1.2G update. 1067 1.1 christos 1068 1.1 christos fixup fwtk patches and add protocol field for SIOCGNATL. 1069 1.1 christos 1070 1.1 christos rdr bugs reported by Alexander Romanyu (alexr (at] aix.krid.crimea.ua), with 1071 1.1 christos fixes: 1072 1.1 christos * rdr matched all packets of a given protocol (ignored ports). 1073 1.1 christos * severe bug in nat_delete which caused system crash/freeze. 1074 1.1 christos 1075 1.1 christos change Makefile so that CC isn't passed on for FreeBSD/NetBSD (will use 1076 1.1 christos the default CC - cc, not gcc) 1077 1.1 christos 1078 1.1 christos 3.2alpha9 16/6/97 - Released 1079 1.1 christos 1080 1.1 christos added "skip" keyword. 1081 1.1 christos 1082 1.1 christos implement preauthentication of packets, as outlined by Guido. 1083 1.1 christos 1084 1.1 christos Make it compile as cleanly as possible with -Wall & general code cleanup 1085 1.1 christos 1086 1.1 christos getopt returns int, not char. Bernd Ernesti 1087 1.1 christos 1088 1.1 christos 3.2alpha8 13/6/97 - Released 1089 1.1 christos 1090 1.1 christos code added to support "auth" rules which require a user program to allow them 1091 1.1 christos through. First revision and much of the code came from Guido. 1092 1.1 christos 1093 1.1 christos hex output from ipmon doesn't goto syslog when recovering from out of sync 1094 1.1 christos error. Luke Mewburn (lukem (at] connect.com.au) 1095 1.1 christos 1096 1.1 christos fix solaris2.6 lookup of destination ire's. 1097 1.1 christos 1098 1.1 christos ipnat doesn't throw away unused bits (after masking), causing it to 1099 1.1 christos behave incorrectly. Carson Gaspar 1100 1.1 christos 1101 1.1 christos NAT code doesn't include inteface name when matching - Alexey Mavrin 1102 1.1 christos <lha@elco.spb.ru> 1103 1.1 christos 1104 1.1 christos replace old SunOS tcpip.h with new tcpip.h (from 4.4BSD) - Jason Thorpe. 1105 1.1 christos 1106 1.1 christos update install procedures to include ip_proxy.c 1107 1.1 christos 1108 1.1 christos mask out unused bits in NAT/RDR rules. 1109 1.1 christos 1110 1.1 christos use a generic type (u_32_t) for 32bit variables, rather than rely on 1111 1.1 christos u_long being such - Jason Thorpe. 1112 1.1 christos 1113 1.1 christos create a local "netinet" directory and include from ~netinet/*" rather than 1114 1.1 christos just "*" to make keeping the code working on ports easier. 1115 1.1 christos 1116 1.1 christos add an m_copydata and m_copyback for SunOS4 (based on 4.4BSD-Lite versions) 1117 1.1 christos 1118 1.1 christos documentation updates. 1119 1.1 christos 1120 1.1 christos NetBSD update from Jason Thorpe <thorpej (at] netbsd.org> 1121 1.1 christos 1122 1.1 christos allow RST's through with a matching SEQ # and 0 ACK. Guido Van Rooij 1123 1.1 christos 1124 1.1 christos ipmon uses excessive amounts of CPU on Solaris2 - Reinhard Bertram 1125 1.1 christos <Reinhard.Bertram (at] KOM.th-darmstadt.de> 1126 1.1 christos 1127 1.1 christos 3.2alpha7 25/5/97 - Released 1128 1.1 christos 1129 1.1 christos add strlen for pre-2.2 kernels - Doug Kite <dkite (at] websgi.icomnet.com> 1130 1.1 christos 1131 1.1 christos setup bits and pieces for compiling into a FreeBSD-2.2 kernel. 1132 1.1 christos 1133 1.1 christos split up "bsd" targets. Now a separate netbsd/freebsd/bsd target. 1134 1.1 christos mln_ipl.c has been split up into itself and mlf_ipl.c (for freebsd). 1135 1.1 christos 1136 1.1 christos fix (negative) host matching in filtering. 1137 1.1 christos 1138 1.1 christos add sysctl interface for some variables when compiled into FreeBSD-2.2 kernels 1139 1.1 christos or later. 1140 1.1 christos 1141 1.1 christos make all the candidates for kernel compiling include "netinet/..." and build 1142 1.1 christos a subdirectory "netinet" when compiling and symlink all .h files into this. 1143 1.1 christos 1144 1.1 christos add install make target to Makefile.ipsend 1145 1.1 christos 1146 1.1 christos 3.2alpha6 8/5/97 - Released 1147 1.1 christos 1148 1.1 christos Add "!" (not) to hostname/ip matching. 1149 1.1 christos 1150 1.1 christos Automatically add packet info to the fragment cache if it is a fragment 1151 1.1 christos and we're translating addreses for. 1152 1.1 christos 1153 1.1 christos Automatically add packet info to the fragment cache if it is a fragment 1154 1.1 christos and we're "keeping state" for the packet. 1155 1.1 christos 1156 1.1 christos Solaris2 patches - Anthony Baxter (arb (at] connect.com.au) 1157 1.1 christos 1158 1.1 christos change install procedure for FreeBSD 2.2 to allow building to a kernel 1159 1.1 christos which is different to the running kernel. 1160 1.1 christos 1161 1.1 christos add FIONREAD for Solaris2! 1162 1.1 christos 1163 1.1 christos when expiring NAT table entries, if we would set a time to fr_tcpclosed 1164 1.1 christos (which is 1), make it fr_tcplaskack(20) so that the state tables have a 1165 1.1 christos chance to clear up. 1166 1.1 christos 1167 1.1 christos 3.2alpha5 1168 1.1 christos 1169 1.1 christos add proxying skeleton support and sample ftp transparent proxy code. 1170 1.1 christos 1171 1.1 christos add printfs at startup to tell user what is happening. 1172 1.1 christos 1173 1.1 christos add packets & bytes for EXPIRE NAT log records. 1174 1.1 christos 1175 1.1 christos fix the "install-bsd" target in the root Makefile. Chris Williams 1176 1.1 christos <psion (at] mv.mv.com> 1177 1.1 christos 1178 1.1 christos Fixes for FreeBSD 2.2 (and later revs) to prevent panics. Julian Assange. 1179 1.1 christos 1180 1.1 christos 3.2alpha4 2/4/97 - Released 1181 1.1 christos 1182 1.1 christos Some compiler warnings cleaned up. 1183 1.1 christos 1184 1.1 christos FreeBSD-2.2 patches for LKM completed. 1185 1.1 christos 1186 1.1 christos 3.2alpha3 31/3/97 - Released 1187 1.1 christos 1188 1.1 christos ipmon changes: -N for reading NAT logfile, -S for reading state logfile. 1189 1.1 christos -a for reading all. -n now toggles hostname resolution. 1190 1.1 christos 1191 1.1 christos Add logging of new state entries and expiration of old state entries. 1192 1.1 christos count log successes and failures. 1193 1.1 christos 1194 1.1 christos Add logging of new NAT entries and expiration of old NAT entries. 1195 1.1 christos count log successes and failures. 1196 1.1 christos 1197 1.1 christos Use u_quad_t for records of bytes & packets where kept 1198 1.1 christos (IP Accounting: fr_hits, fr_bytes; IP state: is_pkts, is_bytes). 1199 1.1 christos 1200 1.1 christos Fixup use of CPU and DCPU in Makefiles. 1201 1.1 christos 1202 1.1 christos Fix broken 0/32 NAT mapping. Carl Makin <cmakin (at] nla.gov.au> 1203 1.1 christos 1204 1.1 christos 3.2alpha2 1205 1.1 christos 1206 1.1 christos Implement mapping to 0/32 as being an alias for automatically using the 1207 1.1 christos interface's first IP address. 1208 1.1 christos 1209 1.1 christos Implement separate minor devices for both NAT and IP state code. 1210 1.1 christos 1211 1.1 christos Fully prototype all functions. 1212 1.1 christos 1213 1.1 christos Fix Makefile problem due to attempt to fix Sun compiling problems. 1214 1.1 christos 1215 1.1 christos 3.1.10 23/3/97 - Released 1216 1.1 christos 1217 1.1 christos ipfstat -a requires a -i or -o command line option too. Print an error 1218 1.1 christos when not present rather than attempt to do something. 1219 1.1 christos 1220 1.1 christos patch updates for SunOS4 for kernel compiling. 1221 1.1 christos patch for ipmon -s (flush's syslog file which isn't good). Andrew J. Schorr 1222 1.1 christos <schorr (at] ead.dsa.com> 1223 1.1 christos 1224 1.1 christos too many people hit their heads hard when compiling code into the kernel 1225 1.1 christos that doesn't let any packets through. (fil.c - IPF_NOMATCH) 1226 1.1 christos 1227 1.1 christos icmp-type parsing doesn't return any errors when it isn't constructed 1228 1.1 christos correctly. Neil Readwin 1229 1.1 christos 1230 1.1 christos Using "-conf" with modload on SunOS4 doesn't work. 1231 1.1 christos Timothy Demarest <demarest (at] arraycomm.com> 1232 1.1 christos 1233 1.1 christos Need to define ARCH in makefile for SunOS4 building. "make sunos4" 1234 1.1 christos in INSTALL.SunOS is incorrect. James R Grinter <jrg (at] blodwen.demon.co.uk> 1235 1.1 christos [all SunOS targets now run buildsunos] 1236 1.1 christos 1237 1.1 christos NAT lookups are still incorrect, matching non-TCP/UDP with TCP/UDP 1238 1.1 christos information. ArkanoiD <ark (at] paranoid.convey.ru> 1239 1.1 christos 1240 1.1 christos Need to check for __FreeBSD_version being 199511 rather than 199607 1241 1.1 christos in mln_ipl.c. Eric Feillant <Eric.Feillant (at] EUnet.fr> 1242 1.1 christos 1243 1.1 christos 3.1.9 8/3/97 - Released 1244 1.1 christos 1245 1.1 christos fixed incorrect lookup of active NAT entries. 1246 1.1 christos 1247 1.1 christos patch for ip_deq() wrong for pre 2.1.6 FreeBSD. 1248 1.1 christos fyeung (at] fyeung8.netific.com (Francis Yeung) 1249 1.1 christos 1250 1.1 christos check for out with return-rst/return-icmp at wrong place - Erkki Ritoniemi 1251 1.1 christos (erkki (at] vlsi.fi) 1252 1.1 christos 1253 1.1 christos text_readip returns the interface pointer pointing to text on stack - 1254 1.1 christos Neil Readwin 1255 1.1 christos 1256 1.1 christos fix from Pradeep Krishnan for printout rules "with not opt sec". 1257 1.1 christos 1258 1.1 christos 3.1.8 18/2/97 - Released 1259 1.1 christos 1260 1.1 christos Diffs for ip_output.c and ip_input.c updated to fix bug with fastroute and 1261 1.1 christos compiling warnings about reuse of m0. 1262 1.1 christos 1263 1.1 christos prevent use of return-rst and return-icmp with rules blocking packets going 1264 1.1 christos out, preventing panics in certain situations. 1265 1.1 christos 1266 1.1 christos loop forms in frag cache table - Yury Pshenychny <yura (at] rd.zgik.zaporizhzhe.ua> 1267 1.1 christos 1268 1.1 christos should use SPLNET/SPLX around expire routines in NAT/frag/state code. 1269 1.1 christos 1270 1.1 christos redeclared malloc in 44arp.c - 1271 1.1 christos 1272 1.1 christos 3.1.7 8/2/97 - Released 1273 1.1 christos 1274 1.1 christos Macros used for ntohs/htons supplied with gcc don't always work very well 1275 1.1 christos when the assignment is the same variable being converted. 1276 1.1 christos 1277 1.1 christos Filter matching doesn't not match rule which checks tcp flags on packets 1278 1.1 christos which are fragments - David Wilson 1279 1.1 christos 1280 1.1 christos 3.1.7beta 30/1/97 - Released 1281 1.1 christos 1282 1.1 christos Fix up NAT bugs introduced in last major change (now tested), including 1283 1.1 christos nat_delete(), nat_lookupredir(), checksum changes, etc. 1284 1.1 christos 1285 1.1 christos 3.1.7alpha 30/1/97 - Released 1286 1.1 christos 1287 1.1 christos Many changes to NAT code, including contributions from Laurent Joncheray 1288 1.1 christos <lpj (at] ans.net> 1289 1.1 christos 1290 1.1 christos Use "NO_SLEEP" when allocating memory under SunOS. 1291 1.1 christos 1292 1.1 christos Make kernel printf's nicer for BSD/SunOS4 1293 1.1 christos 1294 1.1 christos Always do a checksum for packets being filtered going out and being 1295 1.1 christos processed by fastroute. 1296 1.1 christos 1297 1.1 christos Leave kernel to play with cdevsw on *BSD systems with LKM's. 1298 1.1 christos 1299 1.1 christos ipnat.1 man page fixes. 1300 1.1 christos 1301 1.1 christos 3.1.6 21/1/97 - Released 1302 1.1 christos 1303 1.1 christos Allow NAT to work on BSD systems in conjunction with "pass .. to ifname" 1304 1.1 christos 1305 1.1 christos Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried 1306 1.1 christos to free memory twice. 1307 1.1 christos 1308 1.1 christos NAT recalculates IP header checksum based on difference between IP#'s and 1309 1.1 christos port numbers - should be just IP#'s (Solaris2 only) 1310 1.1 christos 1311 1.1 christos 3.1.5 13/1/97 - Released 1312 1.1 christos 1313 1.1 christos fixed setting of NAT timeouts and use different timeouts for concurrent 1314 1.1 christos TCP sessions using the same IP# mapping (when port mapping isn't used) 1315 1.1 christos 1316 1.1 christos multiple loading/unloading of LKM's doesn't clean up cdevsw properly for 1317 1.1 christos *BSD systems. 1318 1.1 christos 1319 1.1 christos 3.1.4 10/1/97 - Released 1320 1.1 christos 1321 1.1 christos add command line options -C and -F to ipnat to flush NAT list and table 1322 1.1 christos 1323 1.1 christos ipnat -l loops on output - Neil Readwin (nreadwin (at] nysales.micrognosis.com) 1324 1.1 christos 1325 1.1 christos NetBSD/FreeBSD kernel malloc changes - Daniel Carosone 1326 1.1 christos 1327 1.1 christos 3.1.3 10/1/97 - Released 1328 1.1 christos 1329 1.1 christos NAT chains not constructed correctly in hash tables - Antony Y.R Lu 1330 1.1 christos (antony (at] hawk.ee.ncku.edu.tw) 1331 1.1 christos 1332 1.1 christos Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2 1333 1.1 christos 1334 1.1 christos man page update (ipf.5) from Daniel Carosone (dan (at] geek.com.au) 1335 1.1 christos 1336 1.1 christos ICMP header checksum update now included in NAT. 1337 1.1 christos 1338 1.1 christos Solaris2 needs to modify IP header checksums in ip_natin and ip_natout. 1339 1.1 christos 1340 1.1 christos 3.1.2 4/12/96 - Released 1341 1.1 christos 1342 1.1 christos ipmon doesn't use syslog all the time when given -s option 1343 1.1 christos 1344 1.1 christos fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro 1345 1.1 christos 1346 1.1 christos check the results of hostname resolution in ipnat 1347 1.1 christos 1348 1.1 christos "make *install" fixed for subdirectories. 1349 1.1 christos 1350 1.1 christos problems with "ARCH:=" and gnu make resolved 1351 1.1 christos 1352 1.1 christos parser reports an error for lines with whitespaces only rather than skipping 1353 1.1 christos them. D.Carosone (at] abm.com.au (Daniel Carosone) 1354 1.1 christos 1355 1.1 christos patches for integration into NetBSD-current (post 1.2). 1356 1.1 christos 1357 1.1 christos add an option to allow non-IP packets going up/down the stream on Solaris2 1358 1.1 christos to be dropped. John Bass. 1359 1.1 christos 1360 1.1 christos 3.1.2beta 21/11/96 - Released 1361 1.1 christos 1362 1.1 christos make ipsend compile on Linux 2.0.24 1363 1.1 christos 1364 1.1 christos changes to TCP kept state algorithm, making it watch state on TCP 1365 1.1 christos connections in both directions. Also use the same algorithm for NAT TCP. 1366 1.1 christos 1367 1.1 christos -Wall cleanup - Bernd Ernesti 1368 1.1 christos 1369 1.1 christos added "or-block" for "pass .. log or-block" after a suggestion from 1370 1.1 christos David Oppenheim (davido (at] optimation.com.au) 1371 1.1 christos 1372 1.1 christos added subdirectories for building IP Filter in SunOS5/BSD for different 1373 1.1 christos cpu architecures 1374 1.1 christos 1375 1.1 christos Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2 1376 1.1 christos 1377 1.1 christos mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96 1378 1.1 christos 1379 1.1 christos 3.1.1 28/10/96 - Released 1380 1.1 christos 1381 1.1 christos Installation script fixes and deinstall scripts for IP Filter on: 1382 1.1 christos SunOS4/FreeBSD/NetBSD 1383 1.1 christos 1384 1.1 christos Man page fixes - Paul Dubois (dubois (at] primate.wisc.edu) 1385 1.1 christos 1386 1.1 christos Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!) 1387 1.1 christos 1388 1.1 christos parsing isn't completely case insensitive - David Wilson 1389 1.1 christos (davidw (at] optimation.com.au) 1390 1.1 christos 1391 1.1 christos Release ipl_mutex across uiomove() calls 1392 1.1 christos 1393 1.1 christos print entire rule entries out for "ipf -z" when zero'ing per-rule stats. 1394 1.1 christos 1395 1.1 christos ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik 1396 1.1 christos (ts (at] polynet.lviv.ua) 1397 1.1 christos 1398 1.1 christos New algorithm for setting timeouts for TCP connection (more closely follow 1399 1.1 christos TCP FSM) - Pradeep Krishnan (pkrishna (at] netcom.com) 1400 1.1 christos 1401 1.1 christos Track both window sizes for TCP connections through "keep state". 1402 1.1 christos 1403 1.1 christos Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel 1404 1.1 christos (wezel (at] bio.vu.nl) 1405 1.1 christos 1406 1.1 christos 3.1.1-beta2 6/10/96 - Released 1407 1.1 christos 1408 1.1 christos Solaris2 fastroute/dup-to/to now works 1409 1.1 christos 1410 1.1 christos ipmon `record' reading rewritten 1411 1.1 christos 1412 1.1 christos Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg (at] eterna.com.au) 1413 1.1 christos 1414 1.1 christos Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson 1415 1.1 christos (davidw (at] optimation.com.au) 1416 1.1 christos 1417 1.1 christos Michael Ryan (mike (at] NetworX.ie) reports the following: 1418 1.1 christos * The Trumpet WinSock under Windows always sends its SYN packet with an ACK 1419 1.1 christos value of 1, unlike any other implementation I've seen, which would set it 1420 1.1 christos to zero. The "keep state" feature of IP Filter doesn't work when receiving 1421 1.1 christos non-zero ACK values on new connection requests. 1422 1.1 christos * */Makefile install rule doesn't install all the binaries/man pages 1423 1.1 christos * Make ipnat use "tcp/udp" instead of "tcpudp" 1424 1.1 christos * Print out "tcp/udp" properly 1425 1.1 christos * ipnat "portmap tcp" matches "portmap udp" when adding/removing 1426 1.1 christos * NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't 1427 1.1 christos 1428 1.1 christos 3.1.1-beta 1/9/96 - Released 1429 1.1 christos 1430 1.1 christos add better detection of TCP connections closing to TCP state monitoring. 1431 1.1 christos 1432 1.1 christos fr_addstate() not called correctly for fragments. "keep state" and 1433 1.1 christos "keep frag" code don't work together 100% - Songqing Cai 1434 1.1 christos (songqing_cai (at] sterling.com) 1435 1.1 christos 1436 1.1 christos call to fr_addstate() incorrect for adding state in combination with keeping 1437 1.1 christos fragment information - Songqing Cai (songqing_cai (at] sterling.com) 1438 1.1 christos 1439 1.1 christos KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood 1440 1.1 christos (cgull (at] smoke.marlboro.vt.us) 1441 1.1 christos 1442 1.1 christos make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban 1443 1.1 christos (dima@best.net) 1444 1.1 christos 1445 1.1 christos 3.1.1-alpha 23/8/96 - Released 1446 1.1 christos 1447 1.1 christos kernel panic's when ICMP packets go through NAT code 1448 1.1 christos 1449 1.1 christos stats aren't zero'd properly with ipf -Z 1450 1.1 christos 1451 1.1 christos ipnat doesn't show port numbers correctly all the time and also add the 1452 1.1 christos protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com) 1453 1.1 christos 1454 1.1 christos fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com) 1455 1.1 christos 1456 1.1 christos NetBSD-1.2 patches from - VaX#n8 <vax (at] linkdead.paranoia.com> 1457 1.1 christos 1458 1.1 christos Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu) 1459 1.1 christos 1460 1.1 christos ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall 1461 1.1 christos (nrh@tardis.ed.ac.uk) 1462 1.1 christos 1463 1.1 christos 3.1.0 7/7/96 - Released 1464 1.1 christos 1465 1.1 christos Reformatted ipnat output to be compatible with it's input, so that 1466 1.1 christos "ipnat -l | ipnat -rf -" is possible. 1467 1.1 christos 1468 1.1 christos 3.1.0beta 30/6/96 - Released 1469 1.1 christos 1470 1.1 christos NetBSD-1.2 patches from Greg Woods (woods (at] most.weird.com) 1471 1.1 christos 1472 1.1 christos kernel module must not be installed stripped (Solaris2), as created by 1473 1.1 christos "make package" for Solaris2 - Peter Heimann 1474 1.1 christos (peter (at] i3.informatik.rwth-aachen.de) 1475 1.1 christos 1476 1.1 christos 3.1.0alpha 5/6/96 - Released 1477 1.1 christos 1478 1.1 christos include examples in package for solaris2 1479 1.1 christos 1480 1.1 christos patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS) 1481 1.1 christos 1482 1.1 christos removed trailing space from printouts of rules in ipf. 1483 1.1 christos 1484 1.1 christos ipresend supports the same range of inputs that ipftest does. 1485 1.1 christos 1486 1.1 christos sending a duplicate copy of a packet to another network devices is now 1487 1.1 christos supported. ("dup-to") 1488 1.1 christos 1489 1.1 christos sending a packet to an arbitary interface is now supported, irrespective 1490 1.1 christos of its actual route, with no ttl decrement. Can also be routed without 1491 1.1 christos the ttl being decremented. ("to" and "fastroute"). 1492 1.1 christos 1493 1.1 christos "call" option added to support calling a generic function if a packet is 1494 1.1 christos matched. 1495 1.1 christos 1496 1.1 christos show all (upto 4) recorded bytes from the interface name in logging from 1497 1.1 christos ipmon. 1498 1.1 christos 1499 1.1 christos support for using unix file permissions for read/write access on the device 1500 1.1 christos is now in place. 1501 1.1 christos 1502 1.1 christos recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per (at] stibo.dk> 1503 1.1 christos 1504 1.1 christos ipftest doesn't call initparse() for THISHOST - Catherine Allen 1505 1.1 christos (cla@connect.com.au) 1506 1.1 christos 1507 1.1 christos Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au) 1508 1.1 christos 1509 1.1 christos 3.0.4 10/4/96 - Released 1510 1.1 christos 1511 1.1 christos looop in `parsing' IP packets with optlen 0 for ip options. 1512 1.1 christos 1513 1.1 christos rule number not initialized and resulted in unexpected results for state 1514 1.1 christos maching. 1515 1.1 christos 1516 1.1 christos option parsing and printing bugs - Pradeep Krishnan 1517 1.1 christos 1518 1.1 christos 3.0.4beta 25/3/96 - Released 1519 1.1 christos 1520 1.1 christos wouldn't parse "keep flags keep state" correctly. 1521 1.1 christos 1522 1.1 christos SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon 1523 1.1 christos 1524 1.1 christos patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems 1525 1.1 christos from Thorsten Lockert <tholo (at] tetherless.com> 1526 1.1 christos 1527 1.1 christos b* functions in fil.c on Solaris 2.4 1528 1.1 christos 1529 1.1 christos 3.0.3 17/3/96 - Released 1530 1.1 christos 1531 1.1 christos added patches to support IP Filter initialisation when compiled into the 1532 1.1 christos kernel. 1533 1.1 christos 1534 1.1 christos added -x option to ipmon to display hex dumps of logged packets. 1535 1.1 christos 1536 1.1 christos added -H option to ipftest to allow ascii-hex formatted input to specify 1537 1.1 christos arbitary IP packets. 1538 1.1 christos 1539 1.1 christos Sending TCP RSTs as a response now work for Solaris2 x86 1540 1.1 christos 1541 1.1 christos add patches to make IP Filter compile into NetBSD kernels properly. 1542 1.1 christos 1543 1.1 christos patch to stop SunOS 4.1.x kernels panicing with "data traps". 1544 1.1 christos 1545 1.1 christos ipfboot script unloads and reloads ipf module on Solaris2 if it is already 1546 1.1 christos loaded into the kernel. 1547 1.1 christos 1548 1.1 christos Installation of IP Filter as a Solaris2 package is now supported. 1549 1.1 christos 1550 1.1 christos Man pages for ipnat.4, ipnat.5 added. 1551 1.1 christos 1552 1.1 christos added some more regression tests and fixed up IP Filter to pass the new tests 1553 1.1 christos (previous versions failed some of the tests in set 12). 1554 1.1 christos 1555 1.1 christos IP option filter processing has changed so that saying "with opt lsrr" will 1556 1.1 christos check only for that one, but not mask out other options, so a packet with 1557 1.1 christos strict source routing, along with loose source routing will match all of 1558 1.1 christos "with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr". 1559 1.1 christos 1560 1.1 christos IPL_NAME needed in ipnat.c - Kelly (kelly (at] count04.mry.scruznet.com) 1561 1.1 christos 1562 1.1 christos patches for clean NetBSD compilation from Bernd Ernesti (bernd (at] arresum.inka.de) 1563 1.1 christos 1564 1.1 christos make install is incorrect - Julian Briggs (julian (at] lightwork.co.uk) 1565 1.1 christos 1566 1.1 christos strtol() returns 0x7fffffff for all negative numbers, 1567 1.1 christos printfr() generates incorrect output for "opt sec-class *", 1568 1.1 christos handling of "not opt xxx opt yyy" incorrect. 1569 1.1 christos - Minh Tonthat (minht (at] sbei.com)/Pradeep Krishnan (pradeepk (at] sbei.com) 1570 1.1 christos 1571 1.1 christos m_pullup() called only for input and not output; caused problems 1572 1.1 christos with filtering icmp - Nigel Verdon (verdenn (at] gb.swissbank.com) 1573 1.1 christos 1574 1.1 christos parsing problem for "port 1" and NetBSD patches incorrect - 1575 1.1 christos Andreas Gustafsson (gson (at] guava.araneus.fi) 1576 1.1 christos 1577 1.1 christos 3.0.2 4/2/96 - Released 1578 1.1 christos 1579 1.1 christos Corrected bug where NAT recalculates checksums for fragments. 1580 1.1 christos 1581 1.1 christos make NAT recalculate UDP checksums (rather than setting them to 0), 1582 1.1 christos if they're non-zero. 1583 1.1 christos 1584 1.1 christos DNS patches - Real Page (Real.Page (at] Matrox.com) 1585 1.1 christos 1586 1.1 christos alteration of checksum recalculations in NAT code and addition of 1587 1.1 christos redirection with NAT - Mike Neuman 1588 1.1 christos 1589 1.1 christos core dump, if tcp/udp is used with a port number and not service name, 1590 1.1 christos in ipf - Mike Neuman (mcn (at] engarde.com) 1591 1.1 christos 1592 1.1 christos initparse() call, missing to prime "<thishost>" hook - Craig Bishop 1593 1.1 christos 1594 1.1 christos 3.0.1 14/1/96 - Released 1595 1.1 christos 1596 1.1 christos miscellaneous patches for Solaris2 1597 1.1 christos 1598 1.1 christos 3.0 14/1/96 - Released 1599 1.1 christos 1600 1.1 christos Patch included for FDDI, from Richard Ohnemus 1601 1.1 christos (Richard_Ohnemus (at] dallas.csd.sterling.com) 1602 1.1 christos 1603 1.1 christos Code cleanup for release. 1604 1.1 christos 1605 1.1 christos 3.0beta4 10/1/96 1606 1.1 christos 1607 1.1 christos recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop 1608 1.1 christos 1609 1.1 christos recursive mutex in sending TCP RSTs fixed, reported by Tony Becker 1610 1.1 christos 1611 1.1 christos 3.0beta3 9/1/96 1612 1.1 christos 1613 1.1 christos FIxup for Solaris2.5 install and interface name bug in ipftest from 1614 1.1 christos Julian Briggs (julian (at] lightwork.co.uk) 1615 1.1 christos 1616 1.1 christos Byte order patches for ipmon from Tony Becker (tony (at] mcrsys.com) 1617 1.1 christos 1618 1.1 christos 3.0beta2 7/1/96 1619 1.1 christos 1620 1.1 christos Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD. 1621 1.1 christos Note, this isn't really what one would call IP account, when compared to 1622 1.1 christos process accounting, sigh. 1623 1.1 christos 1624 1.1 christos Split up ipresend into iptest/ipresend/ipsend 1625 1.1 christos 1626 1.1 christos Added another m_pullup() inside fr_check() for BSD style kernels and 1627 1.1 christos added some checks to ipllog() to not log more than is present (for short 1628 1.1 christos packets). 1629 1.1 christos 1630 1.1 christos Fixed bug where failed hostname/netname resolution goes undetecte and 1631 1.1 christos becomes 0.0.0.0 (any) (reported Guido van Rooij) 1632 1.1 christos 1633 1.1 christos 3.0beta 11/11/95 - Released 1634 1.1 christos 1635 1.1 christos Rewrote the way rule testing is done, reducing the number of files needed and 1636 1.1 christos generated. 1637 1.1 christos 1638 1.1 christos SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green) 1639 1.1 christos 1640 1.1 christos Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3 1641 1.1 christos BSD based Unixes (panic'd) 1642 1.1 christos 1643 1.1 christos Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku (at] tequila.nixu.fi> 1644 1.1 christos (I think someone else already told me about these but they got lost :-/) 1645 1.1 christos 1646 1.1 christos Changed Makefile structure to build object files for different operating 1647 1.1 christos systems in separate directories by default. 1648 1.1 christos 1649 1.1 christos BSDI has ef0 for first ethernet interface 1650 1.1 christos 1651 1.1 christos Allow for a "not" operator before optional keywords. 1652 1.1 christos 1653 1.1 christos The "rule number" was being incorrectly incremented every time it went through 1654 1.1 christos the loop rather than when it matched a rule. 1655 1.1 christos 1656 1.1 christos 2.8.2 24/10/95 - Released 1657 1.1 christos 1658 1.1 christos Fixed up problems with "textip" for doing lots of testing. 1659 1.1 christos 1660 1.1 christos Fixed bug in detection of "short" tcp/ip packets (all reported as being short). 1661 1.1 christos 1662 1.1 christos Solaris 2.4 port now works 100%. 1663 1.1 christos 1664 1.1 christos Man page errors reported and fixed. 1665 1.1 christos 1666 1.1 christos Removed duplicate entry in etc/services for login on port 49 (Craig Bishop). 1667 1.1 christos 1668 1.1 christos Fixed ipmon output to put a space after the log-letter. 1669 1.1 christos 1670 1.1 christos Patch from Guido van Rooij to fix parsing problem. 1671 1.1 christos 1672 1.1 christos 2.8.1 15/10/95 - Released 1673 1.1 christos 1674 1.1 christos Added ttl and tos filtering. 1675 1.1 christos 1676 1.1 christos Patches for fixing up compilation and port problems (little endian) 1677 1.1 christos from Guido van Rooij <guido (at] IAEhv.nl>. 1678 1.1 christos 1679 1.1 christos Man page problems reported and fixed by Carson Gaspar <carson (at] lehman.com>. 1680 1.1 christos 1681 1.1 christos ipsend doesn't compile properly on Solaris2.4 1682 1.1 christos 1683 1.1 christos Lots of work done for Solaris2.4 to make it MT/MP safe and work. 1684 1.1 christos 1685 1.1 christos 2.8 15/9/95 - Released 1686 1.1 christos 1687 1.1 christos ipmon can now send messages to syslogd (-s) and use names instead of 1688 1.1 christos numbers (-N). 1689 1.1 christos 1690 1.1 christos IP packets are now "compiled" into a structure only containing filterable 1691 1.1 christos bits. 1692 1.1 christos 1693 1.1 christos Added regression testing in the test/ subdirectory, using a new option 1694 1.1 christos (-b) with the ipftest program. 1695 1.1 christos 1696 1.1 christos Added "nomatch" return to filter results. These are counted and show 1697 1.1 christos up in reports from ipfstat. 1698 1.1 christos 1699 1.1 christos Moved filter code out of ip_fil.c and into fil.c - there is now only one 1700 1.1 christos instance of it in the package. 1701 1.1 christos 1702 1.1 christos Added Solaris 2.4 support. 1703 1.1 christos 1704 1.1 christos Added IPSO basic security option filtering. 1705 1.1 christos 1706 1.1 christos Added name support for filtering on all 19 named IP options. 1707 1.1 christos 1708 1.1 christos Patches from Ivan Brawley to log packet contents as well as packet headers. 1709 1.1 christos 1710 1.1 christos Update for sun/conf.c.diff from Ivan Brawley <ibrawley (at] awadi.com.AU> 1711 1.1 christos 1712 1.1 christos Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf, 1713 1.1 christos along with a new ioctl, SIOCFRENB. 1714 1.1 christos From: Dieter Dworkin Muller <dworkin (at] village.org> 1715 1.1 christos 1716 1.1 christos 2.7.3 31/7.95 - Released 1717 1.1 christos 1718 1.1 christos Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green). 1719 1.1 christos 1720 1.1 christos ipftest now deals with tcpdump3 binary output files (from libpcap) with -P. 1721 1.1 christos 1722 1.1 christos Brought ipftest program upto date with actual filter code. 1723 1.1 christos 1724 1.1 christos Filter would cause a match to occur when it wasn't meant to if the packet 1725 1.1 christos had short headers and was missing portions that should have been there. 1726 1.1 christos Err, it would rightly not match on them, but their absence caused a match 1727 1.1 christos when it shouldn't have been. 1728 1.1 christos 1729 1.1 christos 2.7.2 26/7/95 - Released 1730 1.1 christos 1731 1.1 christos Problem with filtering just SYN flagged packets reported by 1732 1.1 christos Dieter Dworkin Muller <dworkin (at] village.org>. To solve this 1733 1.1 christos problem, added support for masking TCP flags for comparison "flags X/Y". 1734 1.1 christos 1735 1.1 christos 2.7.1 9/7/95 - Released 1736 1.1 christos 1737 1.1 christos Added ip_dirbroadcast support for Sun ip_input.c 1738 1.1 christos 1739 1.1 christos Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are 1740 1.1 christos better. 1741 1.1 christos 1742 1.1 christos 2.7 7/7/95 - Released 1743 1.1 christos 1744 1.1 christos Added "return-rst" to return TCP RST's to TCP packets. 1745 1.1 christos 1746 1.1 christos Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now. 1747 1.1 christos 1748 1.1 christos Added insertion of filter rules. Use "@<#>" at the beginning of a filter 1749 1.1 christos to insert a rule at row #. 1750 1.1 christos 1751 1.1 christos Filter keeps track of how many times each rule is matched. 1752 1.1 christos 1753 1.1 christos Changed compile time things to match kernel option (IPFILTER_LKM & 1754 1.1 christos IPFILTER_LOG). 1755 1.1 christos 1756 1.1 christos Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP. 1757 1.1 christos (No change required for 3.6) 1758 1.1 christos 1759 1.1 christos Now includes TCP fragments which start inside the TCP header as being short. 1760 1.1 christos Added counting the number of times each rule is matched. 1761 1.1 christos 1762 1.1 christos 1763 1.1 christos 2.6 11/5/95 - Released 1764 1.1 christos 1765 1.1 christos Added -n option to ipf: when supplied, no changes are made to the kernel. 1766 1.1 christos 1767 1.1 christos Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI. 1768 1.1 christos 1769 1.1 christos Rewrote filtering to use a more generic mask & match procedure for 1770 1.1 christos checking if a packet matches a rule. 1771 1.1 christos 1772 1.1 christos 2.5.2 27/4/95 - Released 1773 1.1 christos 1774 1.1 christos "tcp/udp" and a non-initialised pointer caused the "proto" to become 1775 1.1 christos a `random' value; added "ip#/dotted.mask" notation to the BNF. 1776 1.1 christos From Adam W. Feigin <feigin (at] iis.ee.ethz.ch> 1777 1.1 christos 1778 1.1 christos 2.5.1 22/3/95 - Released 1779 1.1 christos 1780 1.1 christos "tcp/udp" had a strange effect (undesired) on getserv*() functions, 1781 1.1 christos causing protocol/service lookups to fail. Reported by Matthew Green. 1782 1.1 christos 1783 1.1 christos 2.5 17/3/95 - Released 1784 1.1 christos 1785 1.1 christos Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop 1786 1.1 christos output through the ipftest program. Suggestions from: 1787 1.1 christos Michael Ciavarella (mikec (at] phyto.apana.org.au) 1788 1.1 christos 1789 1.1 christos Conflicts occur when "general" filter rules are used for ports and the 1790 1.1 christos lack of a "proto" when used with "port" matches other packets when only 1791 1.1 christos TCP/UDP are implied. 1792 1.1 christos Reported Matthew Green (mrg (at] fulcom.com.au); 1793 1.1 christos reported & fixed 6-8/3/95 1794 1.1 christos 1795 1.1 christos Added filtering of short TCP packets using "with short" 28/2/95 1796 1.1 christos (These can possibly slip by checks for the various flags). Short UDP 1797 1.1 christos or ICMP are dropped to the floor and logged. 1798 1.1 christos 1799 1.1 christos Added filtering of fragmented packets using "with frag" 24/2/95 1800 1.1 christos 1801 1.1 christos Port to NetBSD-current completed 20/2/95, using LKM. 1802 1.1 christos 1803 1.1 christos Added logging of the rule # which caused the logging to happen and the 1804 1.1 christos interface on which the packet is currently as suggested by 1805 1.1 christos Andreas Greulich (greulich (at] math-stat.unibe.ch) 10/2/95 1806 1.1 christos 1807 1.1 christos 2.4 9/2/95 - Released 1808 1.1 christos Fixed saving of IP headers in ICMP packets. 1809 1.1 christos 1810 1.1 christos 2.3 29/1/95 1811 1.1 christos Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL). 1812 1.1 christos Fixed iplread() and iplsave() with help from Marc Huber. 1813 1.1 christos 1814 1.1 christos 2.2 7/1/95 - Released 1815 1.1 christos Added code from Marc Huber <huber (at] fzi.de> to allow it to allocate 1816 1.1 christos its own major char number dynamically when modload'ing. Fixed up 1817 1.1 christos use of <, >, <=, >= and >< for ports. 1818 1.1 christos 1819 1.1 christos 2.1 21/12/94 - Released 1820 1.1 christos repackaged to include the correct ip_output.c and ip_input.c *goof* 1821 1.1 christos 1822 1.1 christos 2.0 18/12/94 - Released 1823 1.1 christos added code to check for port ranges - complete. 1824 1.1 christos rewrote to work as a loadable kernel module - complete. 1825 1.1 christos 1826 1.1 christos 1.1 1827 1.1 christos added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers. 1828 1.1 christos 1829 1.1 christos 1.0 22/04/93 - Released 1830 1.1 christos First release cut. 1831
Indexes created Sat Sep 19 00:25:42 UTC 2026