HISTORY revision 1.1.1.1.2.3
1 1.1.1.1.2.2 yamt # 2 1.1.1.1.2.2 yamt # NOTE: Quite a few patches and suggestions come from other sources, to whom 3 1.1.1.1.2.2 yamt # I'm greatly indebted, even if no names are mentioned. 4 1.1.1.1.2.2 yamt # 5 1.1.1.1.2.2 yamt # Thanks to the Coombs Computing Unit at the ANU for their continued support 6 1.1.1.1.2.2 yamt # in providing a very available location for the IP Filter home page and 7 1.1.1.1.2.2 yamt # distribution center. 8 1.1.1.1.2.2 yamt # 9 1.1.1.1.2.2 yamt # Thanks also to all those who have contributed patches and other code, 10 1.1.1.1.2.2 yamt # and especially those who have found the time to port IP Filter to new 11 1.1.1.1.2.2 yamt # platforms. 12 1.1.1.1.2.2 yamt # 13 1.1.1.1.2.3 yamt 5.1.2 - RELEASED - 22 Jul 2012 14 1.1.1.1.2.3 yamt 15 1.1.1.1.2.3 yamt 3546266 macro letters could be more consistent 16 1.1.1.1.2.3 yamt 3546265 not all of the state statistics are displayed 17 1.1.1.1.2.3 yamt 3546261 scripts for updating BSD environment out of date 18 1.1.1.1.2.3 yamt 3546260 compiler warnings about non-integer array subscript 19 1.1.1.1.2.3 yamt 3546259 asserting numdereflists == 0 is not correct 20 1.1.1.1.2.3 yamt 3546258 expression matching does not see IPF_EXP_END 21 1.1.1.1.2.3 yamt 3544317 ipnat/ipfstat are not using ipfexp_t 22 1.1.1.1.2.3 yamt 3545324 proxy checksum calculation is not hardware aware 23 1.1.1.1.2.3 yamt 3545321 FTP sequence number adjustment incorrectly applied 24 1.1.1.1.2.3 yamt 3545320 EPSV is not recognised 25 1.1.1.1.2.3 yamt 3545319 move nat rule creation to ip_proxy.c 26 1.1.1.1.2.3 yamt 3545317 better feedback of checksum requirements for proxies 27 1.1.1.1.2.3 yamt 3545314 ftp proxy levels do not make sense 28 1.1.1.1.2.3 yamt 3545312 EPRT is not supported by ftp proxy 29 1.1.1.1.2.3 yamt 3544318 ipnat.conf parsing ignores LHS address family 30 1.1.1.1.2.3 yamt 3545309 non-ipv6 safe proxies do not fail with ipv6 31 1.1.1.1.2.3 yamt 3545323 NAT updates the source port twice 32 1.1.1.1.2.3 yamt 3545322 ipv6 nat rules cannot start proxies 33 1.1.1.1.2.3 yamt 3544314 bucket copyout tries to copy too much data 34 1.1.1.1.2.3 yamt 3544313 remove nat encap feature 35 1.1.1.1.2.3 yamt 3546248 compat rule pointer type mismatch 36 1.1.1.1.2.3 yamt 3546247 UDP hardware checksum offload not recognised 37 1.1.1.1.2.3 yamt 3545311 ifp_ifaddr does not find the first set address 38 1.1.1.1.2.3 yamt 3545310 ipmon needs ipl_sec on 64bit boundary 39 1.1.1.1.2.3 yamt 3545326 reference count changes made without lock 40 1.1.1.1.2.3 yamt 3544315 stateful matching does not use ipfexp_t 41 1.1.1.1.2.3 yamt 3543493 tokens are not flushed when disabled 42 1.1.1.1.2.3 yamt 3543487 NAT rules do not always release lookup objects 43 1.1.1.1.2.3 yamt 3543491 function comments in ip_state.c are old 44 1.1.1.1.2.3 yamt 3543404 ipnat.conf parsing uses family/ip version badly 45 1.1.1.1.2.3 yamt 3543403 incorrect line number printed in ipnat parsing errors 46 1.1.1.1.2.3 yamt 3543402 Not all NAT statistics are printed 47 1.1.1.1.2.3 yamt 3542979 NAT session list management is too simple 48 1.1.1.1.2.3 yamt 3542978 ipv4 and ipv6 nat insert have common hash insertion 49 1.1.1.1.2.3 yamt 3542977 ipnat_t refence tracking incomplete 50 1.1.1.1.2.3 yamt 3542975 proxies must use ipnat_t separately 51 1.1.1.1.2.3 yamt 3542980 printing ipv6 expressions is wrong 52 1.1.1.1.2.3 yamt 3542983 ippool cannot handle more than one ipv6 address 53 1.1.1.1.2.3 yamt 3543018 mask array shifted incorrectly. 54 1.1.1.1.2.3 yamt 3542974 reason for dropping packet is lost 55 1.1.1.1.2.3 yamt 3542982 line numbers not recorded/displayed correctly by ipf 56 1.1.1.1.2.3 yamt 3542981 exclamation mark cuases trouble with pools 57 1.1.1.1.2.3 yamt 3541655 test suite checksums incorrect 58 1.1.1.1.2.3 yamt 3541653 display proxy fail status correctly 59 1.1.1.1.2.3 yamt 3540993 IP header offset excluded in pullup calculations 60 1.1.1.1.2.3 yamt 3540994 pullupmsg does not work as required 61 1.1.1.1.2.3 yamt 3540992 pointer to ipv6 frag header not updated on pullup 62 1.1.1.1.2.3 yamt 3541645 netmask management adds /32 for /0 63 1.1.1.1.2.3 yamt 3541637 ipnat parser does not zero port fields for non-port protocol 64 1.1.1.1.2.3 yamt 3541635 pool names cannot by numbers 65 1.1.1.1.2.3 yamt 3540995 IPv6 fragment tracking does not always work 66 1.1.1.1.2.3 yamt 3540996 printing of nextip for ipv6 nat rules is wrong 67 1.1.1.1.2.3 yamt 3540999 ipnat.conf parsing has trouble with icmpidmap for ipv6 68 1.1.1.1.2.3 yamt 3540825 whois output parsing error for ipv6 69 1.1.1.1.2.3 yamt 3540814 ipfd_lock serves no purpose 70 1.1.1.1.2.3 yamt 3540810 lookup objects need tail pointers 71 1.1.1.1.2.3 yamt 3540809 refactor hash table lookups for nat 72 1.1.1.1.2.3 yamt 3540819 radix tree does not work with ipv6 73 1.1.1.1.2.3 yamt 3540820 mutex emulation should be logged 74 1.1.1.1.2.3 yamt 3540828 ipfstat filtering with -m fails tests 75 1.1.1.1.2.3 yamt 3536480 ippool could be more like the others 76 1.1.1.1.2.3 yamt 3536477 pool printing not uniform 77 1.1.1.1.2.3 yamt 3536483 flushing empty destination lists causes panic 78 1.1.1.1.2.3 yamt 3536481 more use of bzero after KMALLOC required 79 1.1.1.1.2.3 yamt 3536479 ipnat.conf line numbers not stored 80 1.1.1.1.2.3 yamt 3536484 Makefile missing dependency for ippool 81 1.1.1.1.2.3 yamt 3536199 TFTP proxy requires something extra 82 1.1.1.1.2.3 yamt 3536198 ICMP checksum out by one 83 1.1.1.1.2.3 yamt 3536203 ipnat does not return an error 84 1.1.1.1.2.3 yamt 3536201 ipf.conf parsing too address friendly 85 1.1.1.1.2.3 yamt 3536200 printing of bytes/packets not indented 86 1.1.1.1.2.3 yamt 3497941 ipv4 multicast detection incorrect on little endian 87 1.1.1.1.2.3 yamt 3535361 to interfaces printed out of order 88 1.1.1.1.2.3 yamt 3535363 ipf parser is inconsistent 89 1.1.1.1.2.3 yamt 3532306 deleting ipnat rules does not work 90 1.1.1.1.2.3 yamt 3532054 new error required for ipf_rx_create 91 1.1.1.1.2.3 yamt 3532053 icmp6 checksums wrong 92 1.1.1.1.2.3 yamt 3532052 icmpv6 state check with incorrect length 93 1.1.1.1.2.3 yamt 3531871 checksum verification wants too many icmp6 bytes 94 1.1.1.1.2.3 yamt 3531870 ipnat.conf parsing needs to support inet6 95 1.1.1.1.2.3 yamt 3532048 error in ipf group parsing 96 1.1.1.1.2.3 yamt 3531868 ICMPV6 checksum not validated 97 1.1.1.1.2.3 yamt 3531893 ipftest exits without error for bad input 98 1.1.1.1.2.3 yamt 3531890 whois pool parsing builds bad structures 99 1.1.1.1.2.3 yamt 3531891 icmpv6 text parsing ignorant of icmp types 100 1.1.1.1.2.3 yamt 3531653 rewrite with icmp does not work 101 1.1.1.1.2.3 yamt 3530563 NAT operations fail with EPERM 102 1.1.1.1.2.3 yamt 3530544 first pass at gcc -Wextra cleanup 103 1.1.1.1.2.3 yamt 3530540 lookup create functions do not set error properly 104 1.1.1.1.2.3 yamt 3530539 ipf_main_soft_destroy doesn't need 2nd arg 105 1.1.1.1.2.3 yamt 3530541 reorder structure for better packing 106 1.1.1.1.2.3 yamt 3530543 ipnat purge needs documentation 107 1.1.1.1.2.3 yamt 3530515 BSD upgrade script required 108 1.1.1.1.2.3 yamt 3528029 ipmon bad-mutex panic 109 1.1.1.1.2.3 yamt 3530247 loading address pools light on input validation 110 1.1.1.1.2.3 yamt 3530255 radix tree delete uses wrong lookup 111 1.1.1.1.2.3 yamt 3530254 radix tree allocation support wrong 112 1.1.1.1.2.3 yamt 3530264 ipmon prints qd for some 64bit numbers 113 1.1.1.1.2.3 yamt 3530260 decapsulate rules not printed correctly. 114 1.1.1.1.2.3 yamt 3530266 ipfstat -v/-d flags confused 115 1.1.1.1.2.3 yamt 2939220 why a packet is blocked is not discernable 116 1.1.1.1.2.3 yamt 2939218 output interface not recorded 117 1.1.1.1.2.3 yamt 2941850 use of destination lists with to/dup-to beneficial 118 1.1.1.1.2.3 yamt 3457747 build errors introduced with radix change 119 1.1.1.1.2.3 yamt 3535360 timeout groups leak 120 1.1.1.1.2.3 yamt 3535359 memory leak with tokens 121 1.1.1.1.2.3 yamt 3535358 listing rules in groups requires tracking groups 122 1.1.1.1.2.3 yamt 3535357 rule head removal is problematic 123 1.1.1.1.2.3 yamt 3530259 not all ioctl error checked wth SIOCIPFINTERROR 124 1.1.1.1.2.3 yamt 3530258 error routine that uses fd required 125 1.1.1.1.2.3 yamt 3530253 inadequate function comment blocks 126 1.1.1.1.2.3 yamt 3530249 walking lookup tables leaks memory 127 1.1.1.1.2.3 yamt 3530241 extra lock padding required for freebsd 128 1.1.1.1.2.3 yamt 3529901 ipf returns 0 when rules fail to load 129 1.1.1.1.2.3 yamt 3529491 checksum validation could be better 130 1.1.1.1.2.3 yamt 3529486 tcp checksum wrong for ipv6 131 1.1.1.1.2.3 yamt 3533779 ipv6 nat rules missing inet6 keyword 132 1.1.1.1.2.3 yamt 3532693 ipnat.conf rejects some ipv6 addresses 133 1.1.1.1.2.3 yamt 3532691 ipv4 should not be forced for icmp 134 1.1.1.1.2.3 yamt 3532689 ipv6 nat rules do not print inet6 135 1.1.1.1.2.3 yamt 3532688 ipv6 address always printed with "to <if>" 136 1.1.1.1.2.3 yamt 3532687 with v6hdrs not supported like with ipopts 137 1.1.1.1.2.3 yamt 3532686 ipf expressions do not work with ipv6 138 1.1.1.1.2.3 yamt 3540825 whois output parsing error for ipv6 139 1.1.1.1.2.3 yamt 3540818 NAT for certain IPv6 ICMP packets should not be allowed 140 1.1.1.1.2.3 yamt 3540815 memory leak with destination lists 141 1.1.1.1.2.3 yamt 3540814 ipfd_lock serves no purpose 142 1.1.1.1.2.3 yamt 3540810 lookup objects need tail pointers 143 1.1.1.1.2.3 yamt 3540809 refactor hash table lookups for nat 144 1.1.1.1.2.3 yamt 3540808 completed tokens do not stop iteration 145 1.1.1.1.2.3 yamt 3530492 address hash table name not used 146 1.1.1.1.2.3 yamt 3528029 ipmon bad-mutex panic 147 1.1.1.1.2.3 yamt 3530256 hook memory leaked 148 1.1.1.1.2.3 yamt 3530271 pools parsing produces badly formed address structures 149 1.1.1.1.2.3 yamt 3488061 cleanup for illumos build 150 1.1.1.1.2.3 yamt 3484434 SIOCIPFINTERROR must work for all devices 151 1.1.1.1.2.3 yamt 3484067 mandoc -Tlint warnings to be fixed 152 1.1.1.1.2.3 yamt 3483343 compile warning in ipfcomp.c 153 1.1.1.1.2.3 yamt 3482893 building without IPFILTER_LOG fails 154 1.1.1.1.2.3 yamt 3482765 building netbsd kernel without inet6 fails 155 1.1.1.1.2.3 yamt 3482116 ipf_check frees packet from ipftest 156 1.1.1.1.2.3 yamt 3481663 does not compile on solaris 11 157 1.1.1.1.2.3 yamt 158 1.1.1.1.2.3 yamt 5.1.1 - RELEASED - 9 May 2012 159 1.1.1.1.2.3 yamt 160 1.1.1.1.2.3 yamt 3481322 ip_fil_compat.c needs a cleanup 161 1.1.1.1.2.3 yamt 3481211 add user errors to dtrace 162 1.1.1.1.2.3 yamt 3481152 compatibility for 4.1 needs more work 163 1.1.1.1.2.3 yamt 3481153 PRIu64 problems on FreeBSD 164 1.1.1.1.2.3 yamt 3481155 ipnat listing incorrect 165 1.1.1.1.2.3 yamt 3480543 change leads to compat problems 166 1.1.1.1.2.3 yamt 3480538 compiler errors from earlier patch 167 1.1.1.1.2.3 yamt 3480537 ipf_instance_destroy is incomplete 168 1.1.1.1.2.3 yamt 3480536 _fini order leads to panic 169 1.1.1.1.2.3 yamt 3479991 compiler warnings about size mismatches 170 1.1.1.1.2.3 yamt 3479974 copyright dates are wrong (fix) 171 1.1.1.1.2.3 yamt 3479464 add support for leaks testing 172 1.1.1.1.2.3 yamt 3479457 %qu is not the prefered way 173 1.1.1.1.2.3 yamt 3479451 iterators leak memory 174 1.1.1.1.2.3 yamt 3479453 nat rules with pools leak 175 1.1.1.1.2.3 yamt 3479454 memory leak in hostmap table 176 1.1.1.1.2.3 yamt 3479461 load_hash uses memory after free 177 1.1.1.1.2.3 yamt 3479462 printpool leaks memory 178 1.1.1.1.2.3 yamt 3479452 missing FREE_MB_T to freembt leaks 179 1.1.1.1.2.3 yamt 3479450 ipfdetach is called when detached 180 1.1.1.1.2.3 yamt 3479448 group mapping rules memory leak 181 1.1.1.1.2.3 yamt 3479455 memory leak from tuning 182 1.1.1.1.2.3 yamt 3479458 ipf must be running in global zone 183 1.1.1.1.2.3 yamt 3479460 driver replace is wrong 184 1.1.1.1.2.3 yamt 3479459 radix tree tries to free null pointer 185 1.1.1.1.2.3 yamt 3479463 rwlock emulation does not free memory 186 1.1.1.1.2.3 yamt 3479465 parser leaks memory 187 1.1.1.1.2.3 yamt 3475959 hardware checksum not correctly used 188 1.1.1.1.2.3 yamt 3475426 ip pseudo checksum wrong 189 1.1.1.1.2.3 yamt 3473566 radix tree does not delete dups right 190 1.1.1.1.2.3 yamt 3472987 compile is not clean 191 1.1.1.1.2.3 yamt 3472337 not everything is zero'd 192 1.1.1.1.2.3 yamt 3472344 interface setup needs to be after insert 193 1.1.1.1.2.3 yamt 3472340 wildcard counter drops twice 194 1.1.1.1.2.3 yamt 3472338 change fastroute interface 195 1.1.1.1.2.3 yamt 3472335 kernel lock defines not placed correctly 196 1.1.1.1.2.3 yamt 3472324 ICMP INFOREQ/REPLY not handled 197 1.1.1.1.2.3 yamt 3472330 multicast packets tagged by address 198 1.1.1.1.2.3 yamt 3472333 ipf_deliverlocal called incorrectly 199 1.1.1.1.2.3 yamt 3472345 mutex debug could be more granular 200 1.1.1.1.2.3 yamt 3472761 building i19 regression is flawed 201 1.1.1.1.2.3 yamt 3456457 use of bsd tree.h needs to be removed 202 1.1.1.1.2.3 yamt 3460522 code cleanup required for building on freebsd 203 1.1.1.1.2.3 yamt 3459734 trade some cpu for memory 204 1.1.1.1.2.3 yamt 3457747 build errors introduced with radix change 205 1.1.1.1.2.3 yamt 3457804 build errors from removal of pcap-int,h 206 1.1.1.1.2.3 yamt 3440163 rewrite radix tree 207 1.1.1.1.2.3 yamt 3428004 snoop, tcpdump, etherfind readers are unused 208 1.1.1.1.2.3 yamt 3439495 ipf_rand_push never called (fix brackets) 209 1.1.1.1.2.3 yamt 3437732 getnattype does not need to use ipnat_t (fix variable name) 210 1.1.1.1.2.3 yamt 3437696 fr_cksum is a nightmare 211 1.1.1.1.2.3 yamt 3439061 ipf_send_ip doesn't need 3rd arg 212 1.1.1.1.2.3 yamt 3439059 ipid needs to be file local 213 1.1.1.1.2.3 yamt 3437740 complete buildout of fnew 214 1.1.1.1.2.3 yamt 3438575 add dtrace probes to block events 215 1.1.1.1.2.3 yamt 3438347 comment blocks missing softc 216 1.1.1.1.2.3 yamt 3437687 description of ipf_makefrip wrong 217 1.1.1.1.2.3 yamt 3438340 more stats as dtrace probes 218 1.1.1.1.2.3 yamt 3438316 free on nat structure uses fixed size 219 1.1.1.1.2.3 yamt 3437745 nat iterator using the wrong size 220 1.1.1.1.2.3 yamt 3437710 fail checksum verification if packet is short 221 1.1.1.1.2.3 yamt 3437696 fr_cksum is a nightmare 222 1.1.1.1.2.3 yamt 3437732 getnattype does not need to use ipnat_t 223 1.1.1.1.2.3 yamt 3437735 rename ipf_allocmbt to allocmbt 224 1.1.1.1.2.3 yamt 3437697 fr_family to version assignment is wrong 225 1.1.1.1.2.3 yamt 3437746 ap_session_t has unused fields 226 1.1.1.1.2.3 yamt 3437747 move softc structure to .h file (ip_state.c) 227 1.1.1.1.2.3 yamt 3437704 there is no DTRACE_PROBE5 228 1.1.1.1.2.3 yamt 3437748 wrong interface in qpktinfo_t 229 1.1.1.1.2.3 yamt 3437729 create function to hexdump mb_t 230 1.1.1.1.2.3 yamt 3438273 msgdsize should be easier to read 231 1.1.1.1.2.3 yamt 3437683 object direction not set for 32bit 232 1.1.1.1.2.3 yamt 3433767 calling ip_cksum could be easier 233 1.1.1.1.2.3 yamt 3433764 left over locking 234 1.1.1.1.2.3 yamt 3428015 printing proxy data size is useless 235 1.1.1.1.2.3 yamt 3428013 add M_ADJ to hide adjmsg/m_adj 236 1.1.1.1.2.3 yamt 3428012 interface name is not always returned correctly 237 1.1.1.1.2.3 yamt 3428002 ip_ttl is too low 238 1.1.1.1.2.3 yamt 3427997 ipft readers do not set buffer length 239 1.1.1.1.2.3 yamt 3426558 resistence is futile 240 1.1.1.1.2.3 yamt 3424495 various copy-paste errors 241 1.1.1.1.2.3 yamt 1826936 shall we allow ipf to be as dumb as its admin 242 1.1.1.1.2.3 yamt 3424477 specfuncs needs to go 243 1.1.1.1.2.3 yamt 3424484 missing fr_checkv6sum 244 1.1.1.1.2.3 yamt 3424478 one entry at a time 245 1.1.1.1.2.3 yamt 2998760 auth rules do not mix well with to/dup-to/fastroute 246 1.1.1.1.2.3 yamt 3424195 add ctfmerge to sunos5 makefile 247 1.1.1.1.2.3 yamt 3424132 some dtrace probes to start with 248 1.1.1.1.2.3 yamt 3423812 makefile needs ip_frag.h for some files 249 1.1.1.1.2.3 yamt 3423817 reference count useful in verbose output 250 1.1.1.1.2.3 yamt 3423800 walking lists does not drop reference 251 1.1.1.1.2.3 yamt 3423805 fragmentation stats not reported correclty 252 1.1.1.1.2.3 yamt 3423808 ip addresses reportied incorrectly with ipfstat -f 253 1.1.1.1.2.3 yamt 3423821 track packets and bytes for fragmentation 254 1.1.1.1.2.3 yamt 3423803 attempt to double free rule 255 1.1.1.1.2.3 yamt 3423805 fragmentation stats not reported correctly 256 1.1.1.1.2.3 yamt 3422712 system panic with ipfstat -f 257 1.1.1.1.2.3 yamt 3422619 pullup counter bumped for every packet 258 1.1.1.1.2.3 yamt 3422608 dummy rtentry required to build 259 1.1.1.1.2.3 yamt 3422018 frflush next to ipf_fini_all is redundant 260 1.1.1.1.2.3 yamt 3422012 instance cleanup is not clean 261 1.1.1.1.2.3 yamt 3421845 instance name not set 262 1.1.1.1.2.3 yamt 3005622 ip_fil5.1.0 does not load on Solaris 10 U8 263 1.1.1.1.2.3 yamt 2976332 stateful filtering is incompatible with ipv4 options 264 1.1.1.1.2.3 yamt 3387509 ipftest needs help construction ip packets with options 265 1.1.1.1.2.3 yamt 2998746 passp can never be null 266 1.1.1.1.2.3 yamt 3064034 mbuf clobbering problem with ipv6 267 1.1.1.1.2.3 yamt 3105725 ipnat divide by zero panic 268 1.1.1.1.2.3 yamt 2998750 ipf_htent_insert can leak memory 269 1.1.1.1.2.3 yamt 3064034 mbuf clobbering problem with ipv6 270 1.1.1.1.2.3 yamt 3105725 ipnat divie by zero panic 271 1.1.1.1.2.3 yamt 272 1.1.1.1.2.2 yamt 5.1 - RELEASED - 9 May 2010 273 1.1.1.1.2.2 yamt 274 1.1.1.1.2.2 yamt * See WhatsNew50.txt 275 1.1.1.1.2.2 yamt 276 1.1.1.1.2.2 yamt 4.1 - RELEASED - 12 February 2004 277 1.1.1.1.2.2 yamt 278 1.1.1.1.2.2 yamt 4.0-BETA1 20 August 2003 279 1.1.1.1.2.2 yamt 280 1.1.1.1.2.2 yamt support 0/32 and 0/0 on the RHS in redirect rules 281 1.1.1.1.2.2 yamt 282 1.1.1.1.2.2 yamt where LHS and RHS netmasks are the same size for redirect, do 1:1 mapping 283 1.1.1.1.2.2 yamt for bimap rules. 284 1.1.1.1.2.2 yamt 285 1.1.1.1.2.2 yamt allow NAT rule to match 'all' interfaces with * as interface name 286 1.1.1.1.2.2 yamt 287 1.1.1.1.2.2 yamt do mapping of ICMP sequence id#'s in pings 288 1.1.1.1.2.2 yamt 289 1.1.1.1.2.2 yamt allow default age for NAT entries to be set per NAT rule 290 1.1.1.1.2.2 yamt 291 1.1.1.1.2.2 yamt provide round robin selection of destination addresses for redirect 292 1.1.1.1.2.2 yamt 293 1.1.1.1.2.2 yamt ipmon can load a configuration file with instructions on actions 294 1.1.1.1.2.2 yamt to take when a matching log entry is received 295 1.1.1.1.2.2 yamt 296 1.1.1.1.2.2 yamt now requires pfil to work on Solaris & HP-UX 297 1.1.1.1.2.2 yamt 298 1.1.1.1.2.2 yamt supports mapping outbound connections to a specific address/port 299 1.1.1.1.2.2 yamt 300 1.1.1.1.2.2 yamt support toggling of logging per ipfilter 'device' 301 1.1.1.1.2.2 yamt 302 1.1.1.1.2.2 yamt use queues to expire data rather than lists 303 1.1.1.1.2.2 yamt 304 1.1.1.1.2.2 yamt add MSN RPC proxy 305 1.1.1.1.2.2 yamt 306 1.1.1.1.2.2 yamt add IRC proxy 307 1.1.1.1.2.2 yamt 308 1.1.1.1.2.2 yamt support rules with dynamic ip addresses 309 1.1.1.1.2.2 yamt 310 1.1.1.1.2.2 yamt add ability to define a pool of addresses & networks which can then 311 1.1.1.1.2.2 yamt be placed in a single rule 312 1.1.1.1.2.2 yamt 313 1.1.1.1.2.2 yamt support passing entire packet back to user program for authentication 314 1.1.1.1.2.2 yamt 315 1.1.1.1.2.2 yamt support master/slave for state information sharing 316 1.1.1.1.2.2 yamt 317 1.1.1.1.2.2 yamt reorganise generic code into a lib directory and make libipf.a 318 1.1.1.1.2.2 yamt 319 1.1.1.1.2.2 yamt user programs enforce version matching with the kernel 320 1.1.1.1.2.2 yamt 321 1.1.1.1.2.2 yamt supports window scaling if seen at TCP session setup 322 1.1.1.1.2.2 yamt 323 1.1.1.1.2.2 yamt generates C code from filter rules to compile in or load as native 324 1.1.1.1.2.2 yamt machine code. 325 1.1.1.1.2.2 yamt 326 1.1.1.1.2.2 yamt supports loading rules comprised of BPF bytecode statements 327 1.1.1.1.2.2 yamt 328 1.1.1.1.2.2 yamt HP-UX 11 port completed 329 1.1.1.1.2.2 yamt 330 1.1.1.1.2.2 yamt and packets-per-second filtering 331 1.1.1.1.2.2 yamt 332 1.1.1.1.2.2 yamt add numerical tags to rules for filtering and display in ipmon output 333 1.1.1.1.2.2 yamt 334 1.1.1.1.2.2 yamt 3.4.4 23/05/2000 - Released 335 1.1.1.1.2.2 yamt 336 1.1.1.1.2.2 yamt don't add TCP state if it is an RST packet and (attempt) to send out 337 1.1.1.1.2.2 yamt RST/ICMP packets in a manner that bypasses IP Filter. 338 1.1.1.1.2.2 yamt 339 1.1.1.1.2.2 yamt add patch to work with 4.0_STABLE delayed checksums 340 1.1.1.1.2.2 yamt 341 1.1.1.1.2.2 yamt 3.4.3 20/05/2000 - Released 342 1.1.1.1.2.2 yamt 343 1.1.1.1.2.2 yamt fix ipmon -F 344 1.1.1.1.2.2 yamt 345 1.1.1.1.2.2 yamt don't truncate IPv6 packets on Solaris 346 1.1.1.1.2.2 yamt 347 1.1.1.1.2.2 yamt fix keep state for ICMP ECHO 348 1.1.1.1.2.2 yamt 349 1.1.1.1.2.2 yamt add some NAT stats and use def_nat_age rather than DEF_NAT_AGE 350 1.1.1.1.2.2 yamt 351 1.1.1.1.2.2 yamt don't make ftp proxy drop packets 352 1.1.1.1.2.2 yamt 353 1.1.1.1.2.2 yamt use MCLISREFERENCED() in tandem with M_EXT to check if IP fields need to be 354 1.1.1.1.2.2 yamt swapped back. 355 1.1.1.1.2.2 yamt 356 1.1.1.1.2.2 yamt fix up RST generation for non-Solaris 357 1.1.1.1.2.2 yamt 358 1.1.1.1.2.2 yamt get "short" flag right for IPv6 359 1.1.1.1.2.2 yamt 360 1.1.1.1.2.2 yamt 3.4.2 - 10/5/2000 - Released 361 1.1.1.1.2.2 yamt 362 1.1.1.1.2.2 yamt Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun 363 1.1.1.1.2.2 yamt 364 1.1.1.1.2.2 yamt ignore previous NAT mappings for 0/0 and 0/32 rules 365 1.1.1.1.2.2 yamt 366 1.1.1.1.2.2 yamt bring in a completely new ftp proxy 367 1.1.1.1.2.2 yamt 368 1.1.1.1.2.2 yamt allow NAT to cause packets to be dropped. 369 1.1.1.1.2.2 yamt 370 1.1.1.1.2.2 yamt add NetBSD callout support for 1.4-current 371 1.1.1.1.2.2 yamt 372 1.1.1.1.2.2 yamt 3.4.1 - 30/4/2000 - Released 373 1.1.1.1.2.2 yamt 374 1.1.1.1.2.2 yamt add ratoui() and fix parsing of group numbers to allow 0 - UINT_MAX 375 1.1.1.1.2.2 yamt 376 1.1.1.1.2.2 yamt don't include opt_inet6.h for FreeBSD if KLD_MODULE is defined 377 1.1.1.1.2.2 yamt 378 1.1.1.1.2.2 yamt Solaris must use copyin() for all types of ioctl() args 379 1.1.1.1.2.2 yamt 380 1.1.1.1.2.2 yamt fix up screen/tty when leaving "top mode" of ipfstat 381 1.1.1.1.2.2 yamt 382 1.1.1.1.2.2 yamt linked list for maptable not setup correctly in nat_hostmap() 383 1.1.1.1.2.2 yamt 384 1.1.1.1.2.2 yamt check for maptable rather than nat_table[1] to see if malloc for maptable 385 1.1.1.1.2.2 yamt succeeded in nat_init 386 1.1.1.1.2.2 yamt 387 1.1.1.1.2.2 yamt fix handling of map NAT rules with "from/to" host specs 388 1.1.1.1.2.2 yamt 389 1.1.1.1.2.2 yamt fix printout out of source address when using "from/to" with map rules 390 1.1.1.1.2.2 yamt 391 1.1.1.1.2.2 yamt convert ip_len back to network byte order, not plen, for solaris as ip_len 392 1.1.1.1.2.2 yamt may have been changed by NAT and plen won't reflect this 393 1.1.1.1.2.2 yamt 394 1.1.1.1.2.2 yamt 3.4 - 27/4/2000 - Released 395 1.1.1.1.2.2 yamt 396 1.1.1.1.2.2 yamt source address spoofing can be turned on (fr_chksrc) without using 397 1.1.1.1.2.2 yamt filter rules 398 1.1.1.1.2.2 yamt 399 1.1.1.1.2.2 yamt group numbers are now 32bits in size, up from 16bits 400 1.1.1.1.2.2 yamt 401 1.1.1.1.2.2 yamt IPv6 filtering available 402 1.1.1.1.2.2 yamt 403 1.1.1.1.2.2 yamt add frank volf's state-top patches 404 1.1.1.1.2.2 yamt 405 1.1.1.1.2.2 yamt add load splitting and round-robin attribute to redirect rules 406 1.1.1.1.2.2 yamt 407 1.1.1.1.2.2 yamt FreeBSD-4.0 support (including KLD) 408 1.1.1.1.2.2 yamt 409 1.1.1.1.2.2 yamt add top-style operation mode for ipfstat (-t) 410 1.1.1.1.2.2 yamt 411 1.1.1.1.2.2 yamt add save/restore of IP Filter state/NAT information (ipfs) 412 1.1.1.1.2.2 yamt 413 1.1.1.1.2.2 yamt further ftp proxy security checks 414 1.1.1.1.2.2 yamt 415 1.1.1.1.2.2 yamt support for adding and removing proxies at runtime 416 1.1.1.1.2.2 yamt 417 1.1.1.1.2.2 yamt 3.3.13 26/04/2000 - Released 418 1.1.1.1.2.2 yamt 419 1.1.1.1.2.2 yamt Fix parsing of "range" with "portmap" 420 1.1.1.1.2.2 yamt 421 1.1.1.1.2.2 yamt Relax checking of ftp replies, slightly. 422 1.1.1.1.2.2 yamt 423 1.1.1.1.2.2 yamt Fix NAT timeouts for ICMP packets 424 1.1.1.1.2.2 yamt 425 1.1.1.1.2.2 yamt SunOS4 patches for ICMP redirects from Jurgen Keil (jk@tools.de) 426 1.1.1.1.2.2 yamt 427 1.1.1.1.2.2 yamt 3.3.12 16/03/2000 - Released 428 1.1.1.1.2.2 yamt 429 1.1.1.1.2.2 yamt tighten up ftp proxy behaviour. sigh. yuck. hate. 430 1.1.1.1.2.2 yamt 431 1.1.1.1.2.2 yamt fix bug in range check for NAT where the last IP# was not used. 432 1.1.1.1.2.2 yamt 433 1.1.1.1.2.2 yamt fix problem with icmp codes > 127 in filter rules caused bad things to 434 1.1.1.1.2.2 yamt happen and in particular, where #18 caused the rule to be printed 435 1.1.1.1.2.2 yamt erroneously. 436 1.1.1.1.2.2 yamt 437 1.1.1.1.2.2 yamt fix bug with the spl level not being reset when returning EIO from 438 1.1.1.1.2.2 yamt iplioctl due to ipfilter not being initialized yet. 439 1.1.1.1.2.2 yamt 440 1.1.1.1.2.2 yamt 3.3.11 04/03/2000 - Released 441 1.1.1.1.2.2 yamt 442 1.1.1.1.2.2 yamt make "or-block" work with lines that start with "log" 443 1.1.1.1.2.2 yamt 444 1.1.1.1.2.2 yamt fix up parsing and printing of rules with syslog levels in them 445 1.1.1.1.2.2 yamt 446 1.1.1.1.2.2 yamt fix from Cy Schubert for calling of apr_fini only if non-null 447 1.1.1.1.2.2 yamt 448 1.1.1.1.2.2 yamt 449 1.1.1.1.2.2 yamt 3.3.10 24/02/2000 - Released 450 1.1.1.1.2.2 yamt 451 1.1.1.1.2.2 yamt * fix back from guido for state tracking interfaces 452 1.1.1.1.2.2 yamt 453 1.1.1.1.2.2 yamt * update for NetBSD pfil interface changes 454 1.1.1.1.2.2 yamt 455 1.1.1.1.2.2 yamt * if attaching fails and we can abort, then cleanup when doing so. 456 1.1.1.1.2.2 yamt 457 1.1.1.1.2.2 yamt julian@computer.org: 458 1.1.1.1.2.2 yamt * solaris.c (fr_precheck): After calling freemsg on mt, set it point to *mp. 459 1.1.1.1.2.2 yamt * ipf.c (packetlogon): use flag to store the return value from get_flags. 460 1.1.1.1.2.2 yamt * ipmon.c (init_tabs): General cleanup so we do not have to cast 461 1.1.1.1.2.2 yamt an int s->s_port to u_int port and try to check if the u_int port 462 1.1.1.1.2.2 yamt is less than zero. 463 1.1.1.1.2.2 yamt 464 1.1.1.1.2.2 yamt 3.3.9 15/02/2000 - Released 465 1.1.1.1.2.2 yamt 466 1.1.1.1.2.2 yamt fix scheduling of bad locking in fr_addstate() used when we attach onto 467 1.1.1.1.2.2 yamt a filter rule. 468 1.1.1.1.2.2 yamt 469 1.1.1.1.2.2 yamt fix up ip_statesync() with storing interface names in ipstate_t 470 1.1.1.1.2.2 yamt 471 1.1.1.1.2.2 yamt fix fr_running for LKM's - Eugene Polovnikov 472 1.1.1.1.2.2 yamt 473 1.1.1.1.2.2 yamt junk using pullupmsg() for solaris - it's next to useless for what we 474 1.1.1.1.2.2 yamt need to do here anyway - and implement what we require. 475 1.1.1.1.2.2 yamt 476 1.1.1.1.2.2 yamt don't call fr_delstate() in fr_checkstate(), when compiled for a user 477 1.1.1.1.2.2 yamt program, early but when we're finished with it (got fr & pass) 478 1.1.1.1.2.2 yamt 479 1.1.1.1.2.2 yamt ipnat(5) fix from Guido 480 1.1.1.1.2.2 yamt 481 1.1.1.1.2.2 yamt on solaris2, copy message and use that with filter if there is another 482 1.1.1.1.2.2 yamt copy if it being used (db_ref > 1). bad for performance, but better 483 1.1.1.1.2.2 yamt than causing a crash. 484 1.1.1.1.2.2 yamt 485 1.1.1.1.2.2 yamt patch for solaris8-fcs compile from Casper Dik 486 1.1.1.1.2.2 yamt 487 1.1.1.1.2.2 yamt 3.3.8 01/02/2000 - Released 488 1.1.1.1.2.2 yamt 489 1.1.1.1.2.2 yamt fix state handling of SYN packets. 490 1.1.1.1.2.2 yamt 491 1.1.1.1.2.2 yamt add parsing recognition of extra icmp types/codes and fix handling of 492 1.1.1.1.2.2 yamt icmp time stamps and mask requests - Frank volf 493 1.1.1.1.2.2 yamt 494 1.1.1.1.2.2 yamt 3.3.7 25/01/2000 - Released 495 1.1.1.1.2.2 yamt 496 1.1.1.1.2.2 yamt sync on state information as well as NAT information when required 497 1.1.1.1.2.2 yamt 498 1.1.1.1.2.2 yamt record nat protocol in all nat log records 499 1.1.1.1.2.2 yamt 500 1.1.1.1.2.2 yamt don't reuse the IP# from an active NAT session if the IP# in the rule 501 1.1.1.1.2.2 yamt has changed dynamically. 502 1.1.1.1.2.2 yamt 503 1.1.1.1.2.2 yamt lookup the protocol for NAT log information in ipmon and pass that to 504 1.1.1.1.2.2 yamt portname. 505 1.1.1.1.2.2 yamt 506 1.1.1.1.2.2 yamt fix the bug with changing the outbound interface of a packet where it 507 1.1.1.1.2.2 yamt would lead to a panic. 508 1.1.1.1.2.2 yamt 509 1.1.1.1.2.2 yamt use fr_running instead of ipl_inited. (sysctl name change on freebsd) 510 1.1.1.1.2.2 yamt 511 1.1.1.1.2.2 yamt return EIO if someone attempts an ioctl on state/nat if ipfilter is not 512 1.1.1.1.2.2 yamt enabled. 513 1.1.1.1.2.2 yamt 514 1.1.1.1.2.2 yamt fix rule insertion bug 515 1.1.1.1.2.2 yamt 516 1.1.1.1.2.2 yamt make state flushing clean anything that's not fully established (4/4) 517 1.1.1.1.2.2 yamt 518 1.1.1.1.2.2 yamt call fr_state_flush() after we've released ipf_state so we don't generate 519 1.1.1.1.2.2 yamt a recursive mutex acquisition panic 520 1.1.1.1.2.2 yamt 521 1.1.1.1.2.2 yamt fix parsing of icmp code after return-icmp/return-icmp-as-dest and add 522 1.1.1.1.2.2 yamt some patches to enhance parsing strength 523 1.1.1.1.2.2 yamt 524 1.1.1.1.2.2 yamt 3.3.6 28/12/1999 - Released 525 1.1.1.1.2.2 yamt 526 1.1.1.1.2.2 yamt add in missing rwlock release in fr_checkicmpmatchingstate() and fix check 527 1.1.1.1.2.2 yamt for ICMP_ECHO to only be for packet, not state entry which we don't have yet. 528 1.1.1.1.2.2 yamt 529 1.1.1.1.2.2 yamt handle SIOCIPFFB in nat_ioctl() and fr_state_ioctl() 530 1.1.1.1.2.2 yamt 531 1.1.1.1.2.2 yamt fix size of friostat for SunOS4 532 1.1.1.1.2.2 yamt 533 1.1.1.1.2.2 yamt fix bug in running off the end of a buffer in real audio proxy 534 1.1.1.1.2.2 yamt 535 1.1.1.1.2.2 yamt 3.3.5 11/12/1999 - Released 536 1.1.1.1.2.2 yamt 537 1.1.1.1.2.2 yamt fix parsing of "log level" and printing it back out too 538 1.1.1.1.2.2 yamt 539 1.1.1.1.2.2 yamt <net/if_types.h> is only present on Solaris2.6/7/8 540 1.1.1.1.2.2 yamt 541 1.1.1.1.2.2 yamt use send_icmp_err rather than icmp_error to send back a frag-needed error 542 1.1.1.1.2.2 yamt when doing PMTU 543 1.1.1.1.2.2 yamt 544 1.1.1.1.2.2 yamt do not use -b with add_drv on Solaris unless $BASEDIR is set. 545 1.1.1.1.2.2 yamt 546 1.1.1.1.2.2 yamt fix problem where source address in icmp replies is reversed 547 1.1.1.1.2.2 yamt 548 1.1.1.1.2.2 yamt fix yet another problem with real audio. 549 1.1.1.1.2.2 yamt 550 1.1.1.1.2.2 yamt 3.3.4 4/12/1999 - Released 551 1.1.1.1.2.2 yamt 552 1.1.1.1.2.2 yamt fix up the real audio proxy to properly setup state information and NAT 553 1.1.1.1.2.2 yamt entries, thanks to Laine Stump for testing/advice/fixes. 554 1.1.1.1.2.2 yamt 555 1.1.1.1.2.2 yamt fix ipfr_fastroute to set dst->sin_addr (Sean Farley - appears to prevent 556 1.1.1.1.2.2 yamt FreeBSD 3.3 from panic'ing) as this had been removed in prior hacks to this 557 1.1.1.1.2.2 yamt routine. 558 1.1.1.1.2.2 yamt 559 1.1.1.1.2.2 yamt fix kinstall for BSDI 560 1.1.1.1.2.2 yamt 561 1.1.1.1.2.2 yamt support ICMP errors being allowed through for ICMP packets going out with 562 1.1.1.1.2.2 yamt keep state enabled 563 1.1.1.1.2.2 yamt 564 1.1.1.1.2.2 yamt support hardware checksumming (gigabit ethernet cards) on Solaris thanks to 565 1.1.1.1.2.2 yamt Tel.Net Media for providing hardware for testing. 566 1.1.1.1.2.2 yamt 567 1.1.1.1.2.2 yamt patched from Frank Volf for ipmon (ICMP & fragmented packets) and allowing 568 1.1.1.1.2.2 yamt ICMP responses to ICMP packets in the keep state table. 569 1.1.1.1.2.2 yamt 570 1.1.1.1.2.2 yamt add in patches for hardware checksumming under solaris 571 1.1.1.1.2.2 yamt 572 1.1.1.1.2.2 yamt Solaris install scripts now use $BASEDIR as appropriate. 573 1.1.1.1.2.2 yamt 574 1.1.1.1.2.2 yamt add Solaris8 support 575 1.1.1.1.2.2 yamt 576 1.1.1.1.2.2 yamt fix "ipf -y" on solaris so that it rescans rules also for changes in 577 1.1.1.1.2.2 yamt interface pointers 578 1.1.1.1.2.2 yamt 579 1.1.1.1.2.2 yamt let ipmon become a daemon with -D if it is using syslog 580 1.1.1.1.2.2 yamt 581 1.1.1.1.2.2 yamt fix parsing of return-icmp-as-dest(foo) 582 1.1.1.1.2.2 yamt 583 1.1.1.1.2.2 yamt add reference to ipfstat -g to ipfstat.8 584 1.1.1.1.2.2 yamt 585 1.1.1.1.2.2 yamt ipf_mutex needs to be declared for irix in ip_fil.c 586 1.1.1.1.2.2 yamt 587 1.1.1.1.2.2 yamt 3.3.3 22/10/1999 - Released 588 1.1.1.1.2.2 yamt 589 1.1.1.1.2.2 yamt add -g command line option to ipfstat to show groups still define. 590 1.1.1.1.2.2 yamt 591 1.1.1.1.2.2 yamt fix problem with fragment table not recording rule pointer when called 592 1.1.1.1.2.2 yamt from state functions (fin_fr not set). 593 1.1.1.1.2.2 yamt 594 1.1.1.1.2.2 yamt fixup fastroute problems with keep state rules. 595 1.1.1.1.2.2 yamt 596 1.1.1.1.2.2 yamt load rules into inactive set first, so we don't disable things like NIS 597 1.1.1.1.2.2 yamt lookups half way through processing - found by Kevin Littlejohn 598 1.1.1.1.2.2 yamt 599 1.1.1.1.2.2 yamt fix handling of unaligned ip pointer for solaris 600 1.1.1.1.2.2 yamt 601 1.1.1.1.2.2 yamt patch for fr_newauth from Rudi Sluijtman 602 1.1.1.1.2.2 yamt 603 1.1.1.1.2.2 yamt fixed htons() bug in fr_tcpsum() where ip_p wasn't cast to u_short 604 1.1.1.1.2.2 yamt 605 1.1.1.1.2.2 yamt 3.3.2 23/09/1999 - Released 606 1.1.1.1.2.2 yamt 607 1.1.1.1.2.2 yamt patches from Scott Presnell to fix rcmd proxy 608 1.1.1.1.2.2 yamt 609 1.1.1.1.2.2 yamt patches from Greg to fix Solaris detachment of interfaces 610 1.1.1.1.2.2 yamt 611 1.1.1.1.2.2 yamt add openbsd compatibility fixes 612 1.1.1.1.2.2 yamt 613 1.1.1.1.2.2 yamt fix free'ing already freed memory in ipfr_slowtimer() 614 1.1.1.1.2.2 yamt 615 1.1.1.1.2.2 yamt fix for deferencing invalid memory in cleaning up after a device disappears 616 1.1.1.1.2.2 yamt 617 1.1.1.1.2.2 yamt 3.3.1 14/8/1999 - Released 618 1.1.1.1.2.2 yamt 619 1.1.1.1.2.2 yamt remove include file sys/user.h for irix 620 1.1.1.1.2.2 yamt 621 1.1.1.1.2.2 yamt prevent people from running buildsunos directly 622 1.1.1.1.2.2 yamt 623 1.1.1.1.2.2 yamt fix up some problems with the saving of rule pointers so that NAT saves 624 1.1.1.1.2.2 yamt that information in case it should need to call fr_addstate() from a proxy. 625 1.1.1.1.2.2 yamt 626 1.1.1.1.2.2 yamt fix up scanning for the end of FTP messages 627 1.1.1.1.2.2 yamt 628 1.1.1.1.2.2 yamt don't remove /etc/opt/ipf in postremove 629 1.1.1.1.2.2 yamt 630 1.1.1.1.2.2 yamt attempt to prevent people running buildsolaris script without doing a 631 1.1.1.1.2.2 yamt "make solaris" 632 1.1.1.1.2.2 yamt 633 1.1.1.1.2.2 yamt fix timeout losing on freebsd3 634 1.1.1.1.2.2 yamt 635 1.1.1.1.2.2 yamt 3.3 7/8/1999 - Released 636 1.1.1.1.2.2 yamt 637 1.1.1.1.2.2 yamt NAT: information (rules, mappings) are stored in hash tables; setup some 638 1.1.1.1.2.2 yamt basic NAT regression testing. 639 1.1.1.1.2.2 yamt 640 1.1.1.1.2.2 yamt display version name of installed kernel code when initializing. 641 1.1.1.1.2.2 yamt 642 1.1.1.1.2.2 yamt add -V command line option to ipf, showing version (program and kernel 643 1.1.1.1.2.2 yamt module) as well as the run-status of the kernel code. 644 1.1.1.1.2.2 yamt 645 1.1.1.1.2.2 yamt fix problem with "log" rules actually affecting result of filtering. 646 1.1.1.1.2.2 yamt 647 1.1.1.1.2.2 yamt automatically use SUNWspro if available and on a 64bit Solaris system for 648 1.1.1.1.2.2 yamt compiling. 649 1.1.1.1.2.2 yamt 650 1.1.1.1.2.2 yamt add kernel proxies for rcmd(3) and RealAudio (PNA) 651 1.1.1.1.2.2 yamt 652 1.1.1.1.2.2 yamt use timeout/untimeout on SunOS4/BSD platforms too rather than hijacking 653 1.1.1.1.2.2 yamt ip_slowtimo 654 1.1.1.1.2.2 yamt 655 1.1.1.1.2.2 yamt fix IP headers generated through parsing of text information 656 1.1.1.1.2.2 yamt 657 1.1.1.1.2.2 yamt fix NAT rules to be in the correct order again. 658 1.1.1.1.2.2 yamt 659 1.1.1.1.2.2 yamt make keep-state work with to/fastroute keywords and enforce usage of those 660 1.1.1.1.2.2 yamt interfaces. 661 1.1.1.1.2.2 yamt 662 1.1.1.1.2.2 yamt update keep-state code with new algorithm from Guido 663 1.1.1.1.2.2 yamt 664 1.1.1.1.2.2 yamt add FreeBSD-3 support 665 1.1.1.1.2.2 yamt 666 1.1.1.1.2.2 yamt add return-icmp-as-dest option to retrun an ICMP packet using the original 667 1.1.1.1.2.2 yamt destination as the source rather than a local IP address 668 1.1.1.1.2.2 yamt 669 1.1.1.1.2.2 yamt add "level [facility.]<priority>" option to filter language 670 1.1.1.1.2.2 yamt 671 1.1.1.1.2.2 yamt add changes from Guido to state code. 672 1.1.1.1.2.2 yamt 673 1.1.1.1.2.2 yamt add code to return EPERM if the device is opened for writing and we're 674 1.1.1.1.2.2 yamt in securelevel 2 or greater. 675 1.1.1.1.2.2 yamt 676 1.1.1.1.2.2 yamt authentication code patches from Guido 677 1.1.1.1.2.2 yamt 678 1.1.1.1.2.2 yamt fix real audio proxy 679 1.1.1.1.2.2 yamt 680 1.1.1.1.2.2 yamt fix ipmon rule printing of interfaces and add IN/OUT to the end of ipmon 681 1.1.1.1.2.2 yamt log output. 682 1.1.1.1.2.2 yamt 683 1.1.1.1.2.2 yamt fix bimap rules with hash tables 684 1.1.1.1.2.2 yamt 685 1.1.1.1.2.2 yamt update addresses used in NAT mappings for 0/32 rules for any protocol but TCP 686 1.1.1.1.2.2 yamt if it changes on the interface - check every ip_natexpire() 687 1.1.1.1.2.2 yamt 688 1.1.1.1.2.2 yamt add redirect regression test 689 1.1.1.1.2.2 yamt 690 1.1.1.1.2.2 yamt count buckets used in the state hash table. 691 1.1.1.1.2.2 yamt 692 1.1.1.1.2.2 yamt fix sending of RST's with return-rst to use the ack number provided in 693 1.1.1.1.2.2 yamt the packet being replied to in addition to the sequence number. 694 1.1.1.1.2.2 yamt 695 1.1.1.1.2.2 yamt fix to compile as a 64bit application on solaris7-64bit 696 1.1.1.1.2.2 yamt 697 1.1.1.1.2.2 yamt add NAT IP mapping to ranges of IP addresses that aren't CIDR specified 698 1.1.1.1.2.2 yamt 699 1.1.1.1.2.2 yamt fix calculation of in_space parameter for NAT 700 1.1.1.1.2.2 yamt 701 1.1.1.1.2.2 yamt fix `wrapping' when incrementing the next ip address for use in NAT 702 1.1.1.1.2.2 yamt 703 1.1.1.1.2.2 yamt fix free'ing of kernel memory in ip_natunload on solaris 704 1.1.1.1.2.2 yamt 705 1.1.1.1.2.2 yamt fix -l/-U command line options from interfering with each other 706 1.1.1.1.2.2 yamt 707 1.1.1.1.2.2 yamt fix fastroute under solaris2 and cleanup compilation for solaris7 708 1.1.1.1.2.2 yamt 709 1.1.1.1.2.2 yamt add install scripts and compile cleanly on BSD/OS 4.0 710 1.1.1.1.2.2 yamt 711 1.1.1.1.2.2 yamt safely open files in /tmp for writing device output when testing. 712 1.1.1.1.2.2 yamt 713 1.1.1.1.2.2 yamt fix uninitialized pointer bug in NAT 714 1.1.1.1.2.2 yamt 715 1.1.1.1.2.2 yamt fix SIOCZRLST (zero list rule stats) bug with groups 716 1.1.1.1.2.2 yamt 717 1.1.1.1.2.2 yamt change some usage of u_short to u_int in function calling 718 1.1.1.1.2.2 yamt 719 1.1.1.1.2.2 yamt fix compilation for Solaris7 (SUNWspro) 720 1.1.1.1.2.2 yamt 721 1.1.1.1.2.2 yamt change solaris makefiles to build for either sparc or i386 rather than 722 1.1.1.1.2.2 yamt per-cpu (sun4u, etc). 723 1.1.1.1.2.2 yamt 724 1.1.1.1.2.2 yamt fixed bug in ipllog 725 1.1.1.1.2.2 yamt 726 1.1.1.1.2.2 yamt add patches from George Michaelson for FreeBSD 3.0 727 1.1.1.1.2.2 yamt 728 1.1.1.1.2.2 yamt add patch from Guido to provide ICMP checking for known state in the same 729 1.1.1.1.2.2 yamt manner as is done for NAT. 730 1.1.1.1.2.2 yamt 731 1.1.1.1.2.2 yamt enable FTP PASV proxying and enable wildcarding in NAT/state code for ports 732 1.1.1.1.2.2 yamt for better PORT/PASV support with FTP. 733 1.1.1.1.2.2 yamt 734 1.1.1.1.2.2 yamt bring into main tree static nat features: map-block and "auto" portmapping. 735 1.1.1.1.2.2 yamt 736 1.1.1.1.2.2 yamt add in source host filtering for redirects (alan jones) 737 1.1.1.1.2.2 yamt 738 1.1.1.1.2.2 yamt 3.2.10 22/11/98 - Released 739 1.1.1.1.2.2 yamt 740 1.1.1.1.2.2 yamt 3.2.10beta9 17/11/98 - Released 741 1.1.1.1.2.2 yamt 742 1.1.1.1.2.2 yamt fix fr_tcpsum problems in handling mbufs with an odd number of bytes 743 1.1.1.1.2.2 yamt and/or split across an mbuf boundary 744 1.1.1.1.2.2 yamt 745 1.1.1.1.2.2 yamt fix NAT list entry comparisons and allow multiple entries for the same 746 1.1.1.1.2.2 yamt proxy (but on different ports). 747 1.1.1.1.2.2 yamt 748 1.1.1.1.2.2 yamt don't create duplicate NAT entries for repeated PORT commands. 749 1.1.1.1.2.2 yamt 750 1.1.1.1.2.2 yamt 3.2.10beta8 14/11/98 - Released 751 1.1.1.1.2.2 yamt 752 1.1.1.1.2.2 yamt always exit an rwlock before expecting to enter it again on solaris 753 1.1.1.1.2.2 yamt 754 1.1.1.1.2.2 yamt fix loop in nat_new for pre-existing nat 755 1.1.1.1.2.2 yamt 756 1.1.1.1.2.2 yamt don't setup state for an ftp connection if creating nat fails. 757 1.1.1.1.2.2 yamt 758 1.1.1.1.2.2 yamt 3.2.10beta7 05/11/98 - Released 759 1.1.1.1.2.2 yamt 760 1.1.1.1.2.2 yamt set fake window in ipft_tx.c to ensure code passes tests. 761 1.1.1.1.2.2 yamt 762 1.1.1.1.2.2 yamt cleaned up/enhanced ipnat -l/ipnat -lv output 763 1.1.1.1.2.2 yamt 764 1.1.1.1.2.2 yamt fixed NAT handling of non-TCP/UDP packets, esp. for ICMP errors returned. 765 1.1.1.1.2.2 yamt 766 1.1.1.1.2.2 yamt Solaris recusive mutex on icmp-error/tcp-reset - requires rwlock's rather 767 1.1.1.1.2.2 yamt than mutexes. 768 1.1.1.1.2.2 yamt 769 1.1.1.1.2.2 yamt 3.2.10beta6 03/11/98 - Released 770 1.1.1.1.2.2 yamt 771 1.1.1.1.2.2 yamt fix mixed use of krwlock_t and kmutex_t on Solaris2 772 1.1.1.1.2.2 yamt 773 1.1.1.1.2.2 yamt fix FTP proxy back up, splitting pasv code out of port code. 774 1.1.1.1.2.2 yamt 775 1.1.1.1.2.2 yamt 3.2.10beta5 02/11/98 - Released 776 1.1.1.1.2.2 yamt 777 1.1.1.1.2.2 yamt fixed port translation in ICMP reply handling 778 1.1.1.1.2.2 yamt 779 1.1.1.1.2.2 yamt 3.2.10beta4 01/11/98 - Released 780 1.1.1.1.2.2 yamt 781 1.1.1.1.2.2 yamt increase useful statistic collection on solaris 782 1.1.1.1.2.2 yamt 783 1.1.1.1.2.2 yamt filter DL_UNITDATA_REQ as well as DL_UNITDATA_IND on solaris 784 1.1.1.1.2.2 yamt 785 1.1.1.1.2.2 yamt disable PASV reply translation for now 786 1.1.1.1.2.2 yamt 787 1.1.1.1.2.2 yamt fail with an error if we try to load a NAT rule with a non-existant 788 1.1.1.1.2.2 yamt proxy name - Guido 789 1.1.1.1.2.2 yamt 790 1.1.1.1.2.2 yamt fix portmap usage with 0/0 and 0/32 map rules 791 1.1.1.1.2.2 yamt 792 1.1.1.1.2.2 yamt remove ap_unload/ap_expire - automatically done when NAT is cleaned up 793 1.1.1.1.2.2 yamt 794 1.1.1.1.2.2 yamt print "STATE:CLOSED" from ipmon if the connection progresses past established 795 1.1.1.1.2.2 yamt rather than "STATE:EXPIRED" 796 1.1.1.1.2.2 yamt 797 1.1.1.1.2.2 yamt 3.2.10beta3 26/10/98 - Released 798 1.1.1.1.2.2 yamt 799 1.1.1.1.2.2 yamt fixed traceroute/nat problem 800 1.1.1.1.2.2 yamt 801 1.1.1.1.2.2 yamt rewrote nat/proxy interface 802 1.1.1.1.2.2 yamt 803 1.1.1.1.2.2 yamt ipnat now lists associated proxy sessions for each NAT where applicable 804 1.1.1.1.2.2 yamt 805 1.1.1.1.2.2 yamt 3.2.10beta2 13/10/98 - Released 806 1.1.1.1.2.2 yamt 807 1.1.1.1.2.2 yamt use KRWLOCK_T in place of krwlock_t for solaris as well as irix 808 1.1.1.1.2.2 yamt 809 1.1.1.1.2.2 yamt disable use of read-write lock acquisition by default 810 1.1.1.1.2.2 yamt 811 1.1.1.1.2.2 yamt add in mb_t for linux, non-kernel 812 1.1.1.1.2.2 yamt 813 1.1.1.1.2.2 yamt some changes to progress compilation on linux with glibc 814 1.1.1.1.2.2 yamt 815 1.1.1.1.2.2 yamt change PASV as well as PORT when passed through kernel ftp proxy. 816 1.1.1.1.2.2 yamt 817 1.1.1.1.2.2 yamt don't allow window to become 0 in tcp state code 818 1.1.1.1.2.2 yamt 819 1.1.1.1.2.2 yamt make ipmon compile cleaner 820 1.1.1.1.2.2 yamt 821 1.1.1.1.2.2 yamt irix patches 822 1.1.1.1.2.2 yamt 823 1.1.1.1.2.2 yamt 3.2.10beta 11/09/98 - Released 824 1.1.1.1.2.2 yamt 825 1.1.1.1.2.2 yamt stop fr_tcpsum() thinking it has run out of data when it hasn't. 826 1.1.1.1.2.2 yamt 827 1.1.1.1.2.2 yamt stop solaris panics due to fin_dp being something wild. 828 1.1.1.1.2.2 yamt 829 1.1.1.1.2.2 yamt revisit usage of ATOMIC_*() 830 1.1.1.1.2.2 yamt 831 1.1.1.1.2.2 yamt log closing state of TCP connection in "keep state" 832 1.1.1.1.2.2 yamt 833 1.1.1.1.2.2 yamt fix fake-arp table code for ipsend. 834 1.1.1.1.2.2 yamt 835 1.1.1.1.2.2 yamt ipmon now writes pid to a file. 836 1.1.1.1.2.2 yamt 837 1.1.1.1.2.2 yamt fix "ipmon -a" to actually activate all logging devices. 838 1.1.1.1.2.2 yamt 839 1.1.1.1.2.2 yamt add patches for BSDOS4. 840 1.1.1.1.2.2 yamt 841 1.1.1.1.2.2 yamt perl scripts for log analysis donated. 842 1.1.1.1.2.2 yamt 843 1.1.1.1.2.2 yamt 3.2.9 22/06/98 - Released 844 1.1.1.1.2.2 yamt 845 1.1.1.1.2.2 yamt fix byte order for ICMP packets generated on Solaris 846 1.1.1.1.2.2 yamt 847 1.1.1.1.2.2 yamt fix some locking problems. 848 1.1.1.1.2.2 yamt 849 1.1.1.1.2.2 yamt fix malloc bug in NAT (introduced in 3.2.8). 850 1.1.1.1.2.2 yamt 851 1.1.1.1.2.2 yamt patch from guido for state connections that get fragmented 852 1.1.1.1.2.2 yamt 853 1.1.1.1.2.2 yamt 3.2.8 08/06/98 - Released 854 1.1.1.1.2.2 yamt 855 1.1.1.1.2.2 yamt use readers/writers locks in Solaris2 in place of some mutexes. 856 1.1.1.1.2.2 yamt 857 1.1.1.1.2.2 yamt Solaris2 installation enhancements - Martin Forssen (maf@carlstedt.se) 858 1.1.1.1.2.2 yamt 859 1.1.1.1.2.2 yamt 3.2.7 24/05/98 - Released 860 1.1.1.1.2.2 yamt 861 1.1.1.1.2.2 yamt u_long -> u_32_t conversions 862 1.1.1.1.2.2 yamt 863 1.1.1.1.2.2 yamt patches from Bernd Ernesti for NetBSD 864 1.1.1.1.2.2 yamt 865 1.1.1.1.2.2 yamt fixup ipmon to actually handle HUP's. 866 1.1.1.1.2.2 yamt 867 1.1.1.1.2.2 yamt Linux fixes from Michael H. Warfield (mhw (at] wittsend.com) 868 1.1.1.1.2.2 yamt 869 1.1.1.1.2.2 yamt update for keep state patch (not security related) - Guido 870 1.1.1.1.2.2 yamt 871 1.1.1.1.2.2 yamt dumphex() uses stdout rather than log 872 1.1.1.1.2.2 yamt 873 1.1.1.1.2.2 yamt 3.2.6 18/05/98 - Released 874 1.1.1.1.2.2 yamt 875 1.1.1.1.2.2 yamt fix potential security loop hole in keep state code. 876 1.1.1.1.2.2 yamt 877 1.1.1.1.2.2 yamt update examples. 878 1.1.1.1.2.2 yamt 879 1.1.1.1.2.2 yamt 3.2.5 09/05/98 - Released 880 1.1.1.1.2.2 yamt 881 1.1.1.1.2.2 yamt BSD/OS 3.1 .o files added for the kernel. 882 1.1.1.1.2.2 yamt 883 1.1.1.1.2.2 yamt fix sequence # skew vs window size check. 884 1.1.1.1.2.2 yamt 885 1.1.1.1.2.2 yamt fix minimum ICMP header size check. 886 1.1.1.1.2.2 yamt 887 1.1.1.1.2.2 yamt remove references to Cybersource. 888 1.1.1.1.2.2 yamt 889 1.1.1.1.2.2 yamt fix my email address. 890 1.1.1.1.2.2 yamt 891 1.1.1.1.2.2 yamt remove ntohl in ipnat - Thomas Tornblom 892 1.1.1.1.2.2 yamt 893 1.1.1.1.2.2 yamt 3.2.4 09/04/98 - Released 894 1.1.1.1.2.2 yamt 895 1.1.1.1.2.2 yamt add script to make devices for /dev on BSD boxes 896 1.1.1.1.2.2 yamt 897 1.1.1.1.2.2 yamt fixup building into the kernel for FreeBSD 2.2.5 898 1.1.1.1.2.2 yamt 899 1.1.1.1.2.2 yamt add -D command line option to ipmon to make it a daemon and SIGHUP causes 900 1.1.1.1.2.2 yamt it to close and reopen the logfile 901 1.1.1.1.2.2 yamt 902 1.1.1.1.2.2 yamt fixup make clean and make package for SunOS5 - Marc Boucher 903 1.1.1.1.2.2 yamt 904 1.1.1.1.2.2 yamt postinstall keeps adding "minor=ipf ipl" - George Ross <gdmr (at] dcs.ed.ac.uk> 905 1.1.1.1.2.2 yamt 906 1.1.1.1.2.2 yamt protected by IP Filter gif - Sergey Solyanik <solik (at] atom.ru> 907 1.1.1.1.2.2 yamt 908 1.1.1.1.2.2 yamt 3.2.3 10/11/97 - Released 909 1.1.1.1.2.2 yamt 910 1.1.1.1.2.2 yamt fix some iplang bugs 911 1.1.1.1.2.2 yamt 912 1.1.1.1.2.2 yamt fix tcp checksum data overrun, sgi #define changes, 913 1.1.1.1.2.2 yamt avoid infinite loop when nat'ing to single IP# - Marc Boucher 914 1.1.1.1.2.2 yamt 915 1.1.1.1.2.2 yamt fixup DEVFS usage for FreeBSD 916 1.1.1.1.2.2 yamt 917 1.1.1.1.2.2 yamt fix sunos5 "make clean" cleaning up too much 918 1.1.1.1.2.2 yamt 919 1.1.1.1.2.2 yamt 3.2.2 28/11/97 - Released 920 1.1.1.1.2.2 yamt 921 1.1.1.1.2.2 yamt change packet matching to return actual error, if bad packet, to facilitate 922 1.1.1.1.2.2 yamt ECONNRESET for TCP. 923 1.1.1.1.2.2 yamt 924 1.1.1.1.2.2 yamt allow ip:netmask in grammar too now - Guido 925 1.1.1.1.2.2 yamt 926 1.1.1.1.2.2 yamt assume IRIX has u_int32_t in sys/types.h (needed for R10000) 927 1.1.1.1.2.2 yamt 928 1.1.1.1.2.2 yamt rewrite parts of command line options for ipmon 929 1.1.1.1.2.2 yamt 930 1.1.1.1.2.2 yamt fix TCP urgent packet & offset testing and add LAND attack test for iptest 931 1.1.1.1.2.2 yamt 932 1.1.1.1.2.2 yamt fix grammar error in yacc grammar for iplang 933 1.1.1.1.2.2 yamt 934 1.1.1.1.2.2 yamt redirect (rdr) destination port bytes-wapped when it shouldn't be. 935 1.1.1.1.2.2 yamt 936 1.1.1.1.2.2 yamt general: fr_check now returns error code, such as EHOSTUNREACH or 937 1.1.1.1.2.2 yamt ECONNRESET (attempt to make ECONNRESET work for locally outbound 938 1.1.1.1.2.2 yamt packets). 939 1.1.1.1.2.2 yamt 940 1.1.1.1.2.2 yamt linux: enable return-rst, need to filter tcp retransmits which are sent 941 1.1.1.1.2.2 yamt separately from normal packets 942 1.1.1.1.2.2 yamt 943 1.1.1.1.2.2 yamt memory leak plugged in ip_proxy.c 944 1.1.1.1.2.2 yamt 945 1.1.1.1.2.2 yamt BSDI compatibility patches from Guido 946 1.1.1.1.2.2 yamt 947 1.1.1.1.2.2 yamt tcp checksum fix - Marc Boucher 948 1.1.1.1.2.2 yamt 949 1.1.1.1.2.2 yamt recursive mutex and ioctl param fix - Marc Boucher 950 1.1.1.1.2.2 yamt 951 1.1.1.1.2.2 yamt 3.2.1 12/11/97 - Released 952 1.1.1.1.2.2 yamt 953 1.1.1.1.2.2 yamt port to BSD/OS 3.0 954 1.1.1.1.2.2 yamt 955 1.1.1.1.2.2 yamt port to Linux 2.0.31 956 1.1.1.1.2.2 yamt 957 1.1.1.1.2.2 yamt patches to make "map a/m -> 0/0" work with ftp proxying properly - Marc Boucher 958 1.1.1.1.2.2 yamt 959 1.1.1.1.2.2 yamt add "ipf -F s" and "ipf -F S" to flush state table entries. 960 1.1.1.1.2.2 yamt 961 1.1.1.1.2.2 yamt announce if logging is on or off when ip filter initializes. 962 1.1.1.1.2.2 yamt 963 1.1.1.1.2.2 yamt "ipf -F a" doesn't flush groups properly for Solaris. 964 1.1.1.1.2.2 yamt 965 1.1.1.1.2.2 yamt 3.2 30/10/97 - Released 966 1.1.1.1.2.2 yamt 967 1.1.1.1.2.2 yamt ipnat doesn't successfully remove proxy mappings with "-rf" - 968 1.1.1.1.2.2 yamt Alexander Romanyu 969 1.1.1.1.2.2 yamt 970 1.1.1.1.2.2 yamt use K&R C function style for solaris kernel code 971 1.1.1.1.2.2 yamt 972 1.1.1.1.2.2 yamt use m_adj() to decrease packet size in ftp proxy 973 1.1.1.1.2.2 yamt 974 1.1.1.1.2.2 yamt use mbufchainlen rather than msgdsize, 975 1.1.1.1.2.2 yamt IRIX update - Marc Boucher 976 1.1.1.1.2.2 yamt 977 1.1.1.1.2.2 yamt fix NetBSD modunload bug (pfil_add_hook done twice) 978 1.1.1.1.2.2 yamt 979 1.1.1.1.2.2 yamt patches for OpenBSD 2.1 - Craig Bevins <craigb (at] bitcom.net.au> 980 1.1.1.1.2.2 yamt 981 1.1.1.1.2.2 yamt 3.2beta10 24/10/97 - Released 982 1.1.1.1.2.2 yamt 983 1.1.1.1.2.2 yamt fix fragment table entries allocated for NAT. 984 1.1.1.1.2.2 yamt 985 1.1.1.1.2.2 yamt fix tcp checksum calculations over mbuf/mblk boundaries 986 1.1.1.1.2.2 yamt 987 1.1.1.1.2.2 yamt fix panic for blen < 0 in ftp kernel proxy - marc boucher 988 1.1.1.1.2.2 yamt 989 1.1.1.1.2.2 yamt fix flushing of rules which have been grouped. 990 1.1.1.1.2.2 yamt 991 1.1.1.1.2.2 yamt 3.2beta9 20/10/97 - Released 992 1.1.1.1.2.2 yamt 993 1.1.1.1.2.2 yamt some nit picking on solaris2 with SUNWspro - Michael Lyle <mrl (at] rpnet.net> 994 1.1.1.1.2.2 yamt 995 1.1.1.1.2.2 yamt ftp kernel proxy patches from Marc Boucher 996 1.1.1.1.2.2 yamt 997 1.1.1.1.2.2 yamt 3.2beta8 13/10/97 - Released 998 1.1.1.1.2.2 yamt 999 1.1.1.1.2.2 yamt add support for passing ICMP errors back through NAT. 1000 1.1.1.1.2.2 yamt 1001 1.1.1.1.2.2 yamt IRIX port update - Marc Boucher 1002 1.1.1.1.2.2 yamt 1003 1.1.1.1.2.2 yamt calculate correct MIN size of packet to log for UDP - Marc Boucher 1004 1.1.1.1.2.2 yamt 1005 1.1.1.1.2.2 yamt need htons(ETHERTYPE_x) on little endian BSD boxes - Dave Huang 1006 1.1.1.1.2.2 yamt 1007 1.1.1.1.2.2 yamt copyright header fixups 1008 1.1.1.1.2.2 yamt 1009 1.1.1.1.2.2 yamt 3.2beta7 23/09/97 - Released 1010 1.1.1.1.2.2 yamt 1011 1.1.1.1.2.2 yamt fickup problems introduced by prior merges & changes. 1012 1.1.1.1.2.2 yamt 1013 1.1.1.1.2.2 yamt 3.2beta6 23/09/97 - Released 1014 1.1.1.1.2.2 yamt 1015 1.1.1.1.2.2 yamt patch for spin-reading race condition - Marc Boucher. 1016 1.1.1.1.2.2 yamt 1017 1.1.1.1.2.2 yamt IRIX port by Marc Boucher. 1018 1.1.1.1.2.2 yamt 1019 1.1.1.1.2.2 yamt compatibility updates for Linux to ipsend 1020 1.1.1.1.2.2 yamt 1021 1.1.1.1.2.2 yamt 3.2beta5 13/09/97 - Released 1022 1.1.1.1.2.2 yamt 1023 1.1.1.1.2.2 yamt patches from Bernd Ernesti for NetBSD integration (mostly prototyping and 1024 1.1.1.1.2.2 yamt compiler warning things) 1025 1.1.1.1.2.2 yamt 1026 1.1.1.1.2.2 yamt ipf -y will resync IP#'s allocated with 0/32 in NAT to match interface if it 1027 1.1.1.1.2.2 yamt changes. 1028 1.1.1.1.2.2 yamt 1029 1.1.1.1.2.2 yamt update manual pages and other documentation updates. 1030 1.1.1.1.2.2 yamt 1031 1.1.1.1.2.2 yamt 3.2beta4 27/8/97 - Released 1032 1.1.1.1.2.2 yamt 1033 1.1.1.1.2.2 yamt enable setting IP and TCP options for iplang/ 1034 1.1.1.1.2.2 yamt 1035 1.1.1.1.2.2 yamt Solaris2 patches from Marc Boucher. 1036 1.1.1.1.2.2 yamt 1037 1.1.1.1.2.2 yamt add groups for filter rules. 1038 1.1.1.1.2.2 yamt 1039 1.1.1.1.2.2 yamt 3.2beta3 21/8/97 - Released 1040 1.1.1.1.2.2 yamt 1041 1.1.1.1.2.2 yamt patches for Solaris2 (interface panic solution ?): fix FIONREAD and 1042 1.1.1.1.2.2 yamt replacing q_qinfo points - Marc Boucher <marc@CAM.ORG> 1043 1.1.1.1.2.2 yamt 1044 1.1.1.1.2.2 yamt change ipsend/* and ipsd/* copyright notices to be the same as ip filter's 1045 1.1.1.1.2.2 yamt 1046 1.1.1.1.2.2 yamt patch for SYN-ACK skew testing fix from Eric V. Smith <EricSmith (at] windsor.com> 1047 1.1.1.1.2.2 yamt 1048 1.1.1.1.2.2 yamt 3.2beta2 6/8/97 - Released 1049 1.1.1.1.2.2 yamt 1050 1.1.1.1.2.2 yamt make it load on Solaris 2.3 1051 1.1.1.1.2.2 yamt 1052 1.1.1.1.2.2 yamt rewrote logging to remove solaris errors, introduced checking to see if the 1053 1.1.1.1.2.2 yamt same packet is logged successively. 1054 1.1.1.1.2.2 yamt 1055 1.1.1.1.2.2 yamt fix filter cache to work when there are no rules loaded. 1056 1.1.1.1.2.2 yamt 1057 1.1.1.1.2.2 yamt add "raw" option to ipresend to send entire ethernet frames. 1058 1.1.1.1.2.2 yamt 1059 1.1.1.1.2.2 yamt nat list corruption bug - NetBSD - Klaus Klein 1060 1.1.1.1.2.2 yamt 1061 1.1.1.1.2.2 yamt 3.2beta1 5/7/97 - Released 1062 1.1.1.1.2.2 yamt 1063 1.1.1.1.2.2 yamt patches from Jason Thorpe fixing: UNSIGNED_CHAR lossage, off_t being 64bits 1064 1.1.1.1.2.2 yamt lossage, and other NetBSD bits. 1065 1.1.1.1.2.2 yamt 1066 1.1.1.1.2.2 yamt NetBSD 1.2G update. 1067 1.1.1.1.2.2 yamt 1068 1.1.1.1.2.2 yamt fixup fwtk patches and add protocol field for SIOCGNATL. 1069 1.1.1.1.2.2 yamt 1070 1.1.1.1.2.2 yamt rdr bugs reported by Alexander Romanyu (alexr (at] aix.krid.crimea.ua), with 1071 1.1.1.1.2.2 yamt fixes: 1072 1.1.1.1.2.2 yamt * rdr matched all packets of a given protocol (ignored ports). 1073 1.1.1.1.2.2 yamt * severe bug in nat_delete which caused system crash/freeze. 1074 1.1.1.1.2.2 yamt 1075 1.1.1.1.2.2 yamt change Makefile so that CC isn't passed on for FreeBSD/NetBSD (will use 1076 1.1.1.1.2.2 yamt the default CC - cc, not gcc) 1077 1.1.1.1.2.2 yamt 1078 1.1.1.1.2.2 yamt 3.2alpha9 16/6/97 - Released 1079 1.1.1.1.2.2 yamt 1080 1.1.1.1.2.2 yamt added "skip" keyword. 1081 1.1.1.1.2.2 yamt 1082 1.1.1.1.2.2 yamt implement preauthentication of packets, as outlined by Guido. 1083 1.1.1.1.2.2 yamt 1084 1.1.1.1.2.2 yamt Make it compile as cleanly as possible with -Wall & general code cleanup 1085 1.1.1.1.2.2 yamt 1086 1.1.1.1.2.2 yamt getopt returns int, not char. Bernd Ernesti 1087 1.1.1.1.2.2 yamt 1088 1.1.1.1.2.2 yamt 3.2alpha8 13/6/97 - Released 1089 1.1.1.1.2.2 yamt 1090 1.1.1.1.2.2 yamt code added to support "auth" rules which require a user program to allow them 1091 1.1.1.1.2.2 yamt through. First revision and much of the code came from Guido. 1092 1.1.1.1.2.2 yamt 1093 1.1.1.1.2.2 yamt hex output from ipmon doesn't goto syslog when recovering from out of sync 1094 1.1.1.1.2.2 yamt error. Luke Mewburn (lukem (at] connect.com.au) 1095 1.1.1.1.2.2 yamt 1096 1.1.1.1.2.2 yamt fix solaris2.6 lookup of destination ire's. 1097 1.1.1.1.2.2 yamt 1098 1.1.1.1.2.2 yamt ipnat doesn't throw away unused bits (after masking), causing it to 1099 1.1.1.1.2.2 yamt behave incorrectly. Carson Gaspar 1100 1.1.1.1.2.2 yamt 1101 1.1.1.1.2.2 yamt NAT code doesn't include inteface name when matching - Alexey Mavrin 1102 1.1.1.1.2.2 yamt <lha@elco.spb.ru> 1103 1.1.1.1.2.2 yamt 1104 1.1.1.1.2.2 yamt replace old SunOS tcpip.h with new tcpip.h (from 4.4BSD) - Jason Thorpe. 1105 1.1.1.1.2.2 yamt 1106 1.1.1.1.2.2 yamt update install procedures to include ip_proxy.c 1107 1.1.1.1.2.2 yamt 1108 1.1.1.1.2.2 yamt mask out unused bits in NAT/RDR rules. 1109 1.1.1.1.2.2 yamt 1110 1.1.1.1.2.2 yamt use a generic type (u_32_t) for 32bit variables, rather than rely on 1111 1.1.1.1.2.2 yamt u_long being such - Jason Thorpe. 1112 1.1.1.1.2.2 yamt 1113 1.1.1.1.2.2 yamt create a local "netinet" directory and include from ~netinet/*" rather than 1114 1.1.1.1.2.2 yamt just "*" to make keeping the code working on ports easier. 1115 1.1.1.1.2.2 yamt 1116 1.1.1.1.2.2 yamt add an m_copydata and m_copyback for SunOS4 (based on 4.4BSD-Lite versions) 1117 1.1.1.1.2.2 yamt 1118 1.1.1.1.2.2 yamt documentation updates. 1119 1.1.1.1.2.2 yamt 1120 1.1.1.1.2.2 yamt NetBSD update from Jason Thorpe <thorpej (at] netbsd.org> 1121 1.1.1.1.2.2 yamt 1122 1.1.1.1.2.2 yamt allow RST's through with a matching SEQ # and 0 ACK. Guido Van Rooij 1123 1.1.1.1.2.2 yamt 1124 1.1.1.1.2.2 yamt ipmon uses excessive amounts of CPU on Solaris2 - Reinhard Bertram 1125 1.1.1.1.2.2 yamt <Reinhard.Bertram (at] KOM.th-darmstadt.de> 1126 1.1.1.1.2.2 yamt 1127 1.1.1.1.2.2 yamt 3.2alpha7 25/5/97 - Released 1128 1.1.1.1.2.2 yamt 1129 1.1.1.1.2.2 yamt add strlen for pre-2.2 kernels - Doug Kite <dkite (at] websgi.icomnet.com> 1130 1.1.1.1.2.2 yamt 1131 1.1.1.1.2.2 yamt setup bits and pieces for compiling into a FreeBSD-2.2 kernel. 1132 1.1.1.1.2.2 yamt 1133 1.1.1.1.2.2 yamt split up "bsd" targets. Now a separate netbsd/freebsd/bsd target. 1134 1.1.1.1.2.2 yamt mln_ipl.c has been split up into itself and mlf_ipl.c (for freebsd). 1135 1.1.1.1.2.2 yamt 1136 1.1.1.1.2.2 yamt fix (negative) host matching in filtering. 1137 1.1.1.1.2.2 yamt 1138 1.1.1.1.2.2 yamt add sysctl interface for some variables when compiled into FreeBSD-2.2 kernels 1139 1.1.1.1.2.2 yamt or later. 1140 1.1.1.1.2.2 yamt 1141 1.1.1.1.2.2 yamt make all the candidates for kernel compiling include "netinet/..." and build 1142 1.1.1.1.2.2 yamt a subdirectory "netinet" when compiling and symlink all .h files into this. 1143 1.1.1.1.2.2 yamt 1144 1.1.1.1.2.2 yamt add install make target to Makefile.ipsend 1145 1.1.1.1.2.2 yamt 1146 1.1.1.1.2.2 yamt 3.2alpha6 8/5/97 - Released 1147 1.1.1.1.2.2 yamt 1148 1.1.1.1.2.2 yamt Add "!" (not) to hostname/ip matching. 1149 1.1.1.1.2.2 yamt 1150 1.1.1.1.2.2 yamt Automatically add packet info to the fragment cache if it is a fragment 1151 1.1.1.1.2.2 yamt and we're translating addreses for. 1152 1.1.1.1.2.2 yamt 1153 1.1.1.1.2.2 yamt Automatically add packet info to the fragment cache if it is a fragment 1154 1.1.1.1.2.2 yamt and we're "keeping state" for the packet. 1155 1.1.1.1.2.2 yamt 1156 1.1.1.1.2.2 yamt Solaris2 patches - Anthony Baxter (arb (at] connect.com.au) 1157 1.1.1.1.2.2 yamt 1158 1.1.1.1.2.2 yamt change install procedure for FreeBSD 2.2 to allow building to a kernel 1159 1.1.1.1.2.2 yamt which is different to the running kernel. 1160 1.1.1.1.2.2 yamt 1161 1.1.1.1.2.2 yamt add FIONREAD for Solaris2! 1162 1.1.1.1.2.2 yamt 1163 1.1.1.1.2.2 yamt when expiring NAT table entries, if we would set a time to fr_tcpclosed 1164 1.1.1.1.2.2 yamt (which is 1), make it fr_tcplaskack(20) so that the state tables have a 1165 1.1.1.1.2.2 yamt chance to clear up. 1166 1.1.1.1.2.2 yamt 1167 1.1.1.1.2.2 yamt 3.2alpha5 1168 1.1.1.1.2.2 yamt 1169 1.1.1.1.2.2 yamt add proxying skeleton support and sample ftp transparent proxy code. 1170 1.1.1.1.2.2 yamt 1171 1.1.1.1.2.2 yamt add printfs at startup to tell user what is happening. 1172 1.1.1.1.2.2 yamt 1173 1.1.1.1.2.2 yamt add packets & bytes for EXPIRE NAT log records. 1174 1.1.1.1.2.2 yamt 1175 1.1.1.1.2.2 yamt fix the "install-bsd" target in the root Makefile. Chris Williams 1176 1.1.1.1.2.2 yamt <psion (at] mv.mv.com> 1177 1.1.1.1.2.2 yamt 1178 1.1.1.1.2.2 yamt Fixes for FreeBSD 2.2 (and later revs) to prevent panics. Julian Assange. 1179 1.1.1.1.2.2 yamt 1180 1.1.1.1.2.2 yamt 3.2alpha4 2/4/97 - Released 1181 1.1.1.1.2.2 yamt 1182 1.1.1.1.2.2 yamt Some compiler warnings cleaned up. 1183 1.1.1.1.2.2 yamt 1184 1.1.1.1.2.2 yamt FreeBSD-2.2 patches for LKM completed. 1185 1.1.1.1.2.2 yamt 1186 1.1.1.1.2.2 yamt 3.2alpha3 31/3/97 - Released 1187 1.1.1.1.2.2 yamt 1188 1.1.1.1.2.2 yamt ipmon changes: -N for reading NAT logfile, -S for reading state logfile. 1189 1.1.1.1.2.2 yamt -a for reading all. -n now toggles hostname resolution. 1190 1.1.1.1.2.2 yamt 1191 1.1.1.1.2.2 yamt Add logging of new state entries and expiration of old state entries. 1192 1.1.1.1.2.2 yamt count log successes and failures. 1193 1.1.1.1.2.2 yamt 1194 1.1.1.1.2.2 yamt Add logging of new NAT entries and expiration of old NAT entries. 1195 1.1.1.1.2.2 yamt count log successes and failures. 1196 1.1.1.1.2.2 yamt 1197 1.1.1.1.2.2 yamt Use u_quad_t for records of bytes & packets where kept 1198 1.1.1.1.2.2 yamt (IP Accounting: fr_hits, fr_bytes; IP state: is_pkts, is_bytes). 1199 1.1.1.1.2.2 yamt 1200 1.1.1.1.2.2 yamt Fixup use of CPU and DCPU in Makefiles. 1201 1.1.1.1.2.2 yamt 1202 1.1.1.1.2.2 yamt Fix broken 0/32 NAT mapping. Carl Makin <cmakin (at] nla.gov.au> 1203 1.1.1.1.2.2 yamt 1204 1.1.1.1.2.2 yamt 3.2alpha2 1205 1.1.1.1.2.2 yamt 1206 1.1.1.1.2.2 yamt Implement mapping to 0/32 as being an alias for automatically using the 1207 1.1.1.1.2.2 yamt interface's first IP address. 1208 1.1.1.1.2.2 yamt 1209 1.1.1.1.2.2 yamt Implement separate minor devices for both NAT and IP state code. 1210 1.1.1.1.2.2 yamt 1211 1.1.1.1.2.2 yamt Fully prototype all functions. 1212 1.1.1.1.2.2 yamt 1213 1.1.1.1.2.2 yamt Fix Makefile problem due to attempt to fix Sun compiling problems. 1214 1.1.1.1.2.2 yamt 1215 1.1.1.1.2.2 yamt 3.1.10 23/3/97 - Released 1216 1.1.1.1.2.2 yamt 1217 1.1.1.1.2.2 yamt ipfstat -a requires a -i or -o command line option too. Print an error 1218 1.1.1.1.2.2 yamt when not present rather than attempt to do something. 1219 1.1.1.1.2.2 yamt 1220 1.1.1.1.2.2 yamt patch updates for SunOS4 for kernel compiling. 1221 1.1.1.1.2.2 yamt patch for ipmon -s (flush's syslog file which isn't good). Andrew J. Schorr 1222 1.1.1.1.2.2 yamt <schorr (at] ead.dsa.com> 1223 1.1.1.1.2.2 yamt 1224 1.1.1.1.2.2 yamt too many people hit their heads hard when compiling code into the kernel 1225 1.1.1.1.2.2 yamt that doesn't let any packets through. (fil.c - IPF_NOMATCH) 1226 1.1.1.1.2.2 yamt 1227 1.1.1.1.2.2 yamt icmp-type parsing doesn't return any errors when it isn't constructed 1228 1.1.1.1.2.2 yamt correctly. Neil Readwin 1229 1.1.1.1.2.2 yamt 1230 1.1.1.1.2.2 yamt Using "-conf" with modload on SunOS4 doesn't work. 1231 1.1.1.1.2.2 yamt Timothy Demarest <demarest (at] arraycomm.com> 1232 1.1.1.1.2.2 yamt 1233 1.1.1.1.2.2 yamt Need to define ARCH in makefile for SunOS4 building. "make sunos4" 1234 1.1.1.1.2.2 yamt in INSTALL.SunOS is incorrect. James R Grinter <jrg (at] blodwen.demon.co.uk> 1235 1.1.1.1.2.2 yamt [all SunOS targets now run buildsunos] 1236 1.1.1.1.2.2 yamt 1237 1.1.1.1.2.2 yamt NAT lookups are still incorrect, matching non-TCP/UDP with TCP/UDP 1238 1.1.1.1.2.2 yamt information. ArkanoiD <ark (at] paranoid.convey.ru> 1239 1.1.1.1.2.2 yamt 1240 1.1.1.1.2.2 yamt Need to check for __FreeBSD_version being 199511 rather than 199607 1241 1.1.1.1.2.2 yamt in mln_ipl.c. Eric Feillant <Eric.Feillant (at] EUnet.fr> 1242 1.1.1.1.2.2 yamt 1243 1.1.1.1.2.2 yamt 3.1.9 8/3/97 - Released 1244 1.1.1.1.2.2 yamt 1245 1.1.1.1.2.2 yamt fixed incorrect lookup of active NAT entries. 1246 1.1.1.1.2.2 yamt 1247 1.1.1.1.2.2 yamt patch for ip_deq() wrong for pre 2.1.6 FreeBSD. 1248 1.1.1.1.2.2 yamt fyeung (at] fyeung8.netific.com (Francis Yeung) 1249 1.1.1.1.2.2 yamt 1250 1.1.1.1.2.2 yamt check for out with return-rst/return-icmp at wrong place - Erkki Ritoniemi 1251 1.1.1.1.2.2 yamt (erkki (at] vlsi.fi) 1252 1.1.1.1.2.2 yamt 1253 1.1.1.1.2.2 yamt text_readip returns the interface pointer pointing to text on stack - 1254 1.1.1.1.2.2 yamt Neil Readwin 1255 1.1.1.1.2.2 yamt 1256 1.1.1.1.2.2 yamt fix from Pradeep Krishnan for printout rules "with not opt sec". 1257 1.1.1.1.2.2 yamt 1258 1.1.1.1.2.2 yamt 3.1.8 18/2/97 - Released 1259 1.1.1.1.2.2 yamt 1260 1.1.1.1.2.2 yamt Diffs for ip_output.c and ip_input.c updated to fix bug with fastroute and 1261 1.1.1.1.2.2 yamt compiling warnings about reuse of m0. 1262 1.1.1.1.2.2 yamt 1263 1.1.1.1.2.2 yamt prevent use of return-rst and return-icmp with rules blocking packets going 1264 1.1.1.1.2.2 yamt out, preventing panics in certain situations. 1265 1.1.1.1.2.2 yamt 1266 1.1.1.1.2.2 yamt loop forms in frag cache table - Yury Pshenychny <yura (at] rd.zgik.zaporizhzhe.ua> 1267 1.1.1.1.2.2 yamt 1268 1.1.1.1.2.2 yamt should use SPLNET/SPLX around expire routines in NAT/frag/state code. 1269 1.1.1.1.2.2 yamt 1270 1.1.1.1.2.2 yamt redeclared malloc in 44arp.c - 1271 1.1.1.1.2.2 yamt 1272 1.1.1.1.2.2 yamt 3.1.7 8/2/97 - Released 1273 1.1.1.1.2.2 yamt 1274 1.1.1.1.2.2 yamt Macros used for ntohs/htons supplied with gcc don't always work very well 1275 1.1.1.1.2.2 yamt when the assignment is the same variable being converted. 1276 1.1.1.1.2.2 yamt 1277 1.1.1.1.2.2 yamt Filter matching doesn't not match rule which checks tcp flags on packets 1278 1.1.1.1.2.2 yamt which are fragments - David Wilson 1279 1.1.1.1.2.2 yamt 1280 1.1.1.1.2.2 yamt 3.1.7beta 30/1/97 - Released 1281 1.1.1.1.2.2 yamt 1282 1.1.1.1.2.2 yamt Fix up NAT bugs introduced in last major change (now tested), including 1283 1.1.1.1.2.2 yamt nat_delete(), nat_lookupredir(), checksum changes, etc. 1284 1.1.1.1.2.2 yamt 1285 1.1.1.1.2.2 yamt 3.1.7alpha 30/1/97 - Released 1286 1.1.1.1.2.2 yamt 1287 1.1.1.1.2.2 yamt Many changes to NAT code, including contributions from Laurent Joncheray 1288 1.1.1.1.2.2 yamt <lpj (at] ans.net> 1289 1.1.1.1.2.2 yamt 1290 1.1.1.1.2.2 yamt Use "NO_SLEEP" when allocating memory under SunOS. 1291 1.1.1.1.2.2 yamt 1292 1.1.1.1.2.2 yamt Make kernel printf's nicer for BSD/SunOS4 1293 1.1.1.1.2.2 yamt 1294 1.1.1.1.2.2 yamt Always do a checksum for packets being filtered going out and being 1295 1.1.1.1.2.2 yamt processed by fastroute. 1296 1.1.1.1.2.2 yamt 1297 1.1.1.1.2.2 yamt Leave kernel to play with cdevsw on *BSD systems with LKM's. 1298 1.1.1.1.2.2 yamt 1299 1.1.1.1.2.2 yamt ipnat.1 man page fixes. 1300 1.1.1.1.2.2 yamt 1301 1.1.1.1.2.2 yamt 3.1.6 21/1/97 - Released 1302 1.1.1.1.2.2 yamt 1303 1.1.1.1.2.2 yamt Allow NAT to work on BSD systems in conjunction with "pass .. to ifname" 1304 1.1.1.1.2.2 yamt 1305 1.1.1.1.2.2 yamt Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried 1306 1.1.1.1.2.2 yamt to free memory twice. 1307 1.1.1.1.2.2 yamt 1308 1.1.1.1.2.2 yamt NAT recalculates IP header checksum based on difference between IP#'s and 1309 1.1.1.1.2.2 yamt port numbers - should be just IP#'s (Solaris2 only) 1310 1.1.1.1.2.2 yamt 1311 1.1.1.1.2.2 yamt 3.1.5 13/1/97 - Released 1312 1.1.1.1.2.2 yamt 1313 1.1.1.1.2.2 yamt fixed setting of NAT timeouts and use different timeouts for concurrent 1314 1.1.1.1.2.2 yamt TCP sessions using the same IP# mapping (when port mapping isn't used) 1315 1.1.1.1.2.2 yamt 1316 1.1.1.1.2.2 yamt multiple loading/unloading of LKM's doesn't clean up cdevsw properly for 1317 1.1.1.1.2.2 yamt *BSD systems. 1318 1.1.1.1.2.2 yamt 1319 1.1.1.1.2.2 yamt 3.1.4 10/1/97 - Released 1320 1.1.1.1.2.2 yamt 1321 1.1.1.1.2.2 yamt add command line options -C and -F to ipnat to flush NAT list and table 1322 1.1.1.1.2.2 yamt 1323 1.1.1.1.2.2 yamt ipnat -l loops on output - Neil Readwin (nreadwin (at] nysales.micrognosis.com) 1324 1.1.1.1.2.2 yamt 1325 1.1.1.1.2.2 yamt NetBSD/FreeBSD kernel malloc changes - Daniel Carosone 1326 1.1.1.1.2.2 yamt 1327 1.1.1.1.2.2 yamt 3.1.3 10/1/97 - Released 1328 1.1.1.1.2.2 yamt 1329 1.1.1.1.2.2 yamt NAT chains not constructed correctly in hash tables - Antony Y.R Lu 1330 1.1.1.1.2.2 yamt (antony (at] hawk.ee.ncku.edu.tw) 1331 1.1.1.1.2.2 yamt 1332 1.1.1.1.2.2 yamt Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2 1333 1.1.1.1.2.2 yamt 1334 1.1.1.1.2.2 yamt man page update (ipf.5) from Daniel Carosone (dan (at] geek.com.au) 1335 1.1.1.1.2.2 yamt 1336 1.1.1.1.2.2 yamt ICMP header checksum update now included in NAT. 1337 1.1.1.1.2.2 yamt 1338 1.1.1.1.2.2 yamt Solaris2 needs to modify IP header checksums in ip_natin and ip_natout. 1339 1.1.1.1.2.2 yamt 1340 1.1.1.1.2.2 yamt 3.1.2 4/12/96 - Released 1341 1.1.1.1.2.2 yamt 1342 1.1.1.1.2.2 yamt ipmon doesn't use syslog all the time when given -s option 1343 1.1.1.1.2.2 yamt 1344 1.1.1.1.2.2 yamt fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro 1345 1.1.1.1.2.2 yamt 1346 1.1.1.1.2.2 yamt check the results of hostname resolution in ipnat 1347 1.1.1.1.2.2 yamt 1348 1.1.1.1.2.2 yamt "make *install" fixed for subdirectories. 1349 1.1.1.1.2.2 yamt 1350 1.1.1.1.2.2 yamt problems with "ARCH:=" and gnu make resolved 1351 1.1.1.1.2.2 yamt 1352 1.1.1.1.2.2 yamt parser reports an error for lines with whitespaces only rather than skipping 1353 1.1.1.1.2.2 yamt them. D.Carosone (at] abm.com.au (Daniel Carosone) 1354 1.1.1.1.2.2 yamt 1355 1.1.1.1.2.2 yamt patches for integration into NetBSD-current (post 1.2). 1356 1.1.1.1.2.2 yamt 1357 1.1.1.1.2.2 yamt add an option to allow non-IP packets going up/down the stream on Solaris2 1358 1.1.1.1.2.2 yamt to be dropped. John Bass. 1359 1.1.1.1.2.2 yamt 1360 1.1.1.1.2.2 yamt 3.1.2beta 21/11/96 - Released 1361 1.1.1.1.2.2 yamt 1362 1.1.1.1.2.2 yamt make ipsend compile on Linux 2.0.24 1363 1.1.1.1.2.2 yamt 1364 1.1.1.1.2.2 yamt changes to TCP kept state algorithm, making it watch state on TCP 1365 1.1.1.1.2.2 yamt connections in both directions. Also use the same algorithm for NAT TCP. 1366 1.1.1.1.2.2 yamt 1367 1.1.1.1.2.2 yamt -Wall cleanup - Bernd Ernesti 1368 1.1.1.1.2.2 yamt 1369 1.1.1.1.2.2 yamt added "or-block" for "pass .. log or-block" after a suggestion from 1370 1.1.1.1.2.2 yamt David Oppenheim (davido (at] optimation.com.au) 1371 1.1.1.1.2.2 yamt 1372 1.1.1.1.2.2 yamt added subdirectories for building IP Filter in SunOS5/BSD for different 1373 1.1.1.1.2.2 yamt cpu architecures 1374 1.1.1.1.2.2 yamt 1375 1.1.1.1.2.2 yamt Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2 1376 1.1.1.1.2.2 yamt 1377 1.1.1.1.2.2 yamt mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96 1378 1.1.1.1.2.2 yamt 1379 1.1.1.1.2.2 yamt 3.1.1 28/10/96 - Released 1380 1.1.1.1.2.2 yamt 1381 1.1.1.1.2.2 yamt Installation script fixes and deinstall scripts for IP Filter on: 1382 1.1.1.1.2.2 yamt SunOS4/FreeBSD/NetBSD 1383 1.1.1.1.2.2 yamt 1384 1.1.1.1.2.2 yamt Man page fixes - Paul Dubois (dubois (at] primate.wisc.edu) 1385 1.1.1.1.2.2 yamt 1386 1.1.1.1.2.2 yamt Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!) 1387 1.1.1.1.2.2 yamt 1388 1.1.1.1.2.2 yamt parsing isn't completely case insensitive - David Wilson 1389 1.1.1.1.2.2 yamt (davidw (at] optimation.com.au) 1390 1.1.1.1.2.2 yamt 1391 1.1.1.1.2.2 yamt Release ipl_mutex across uiomove() calls 1392 1.1.1.1.2.2 yamt 1393 1.1.1.1.2.2 yamt print entire rule entries out for "ipf -z" when zero'ing per-rule stats. 1394 1.1.1.1.2.2 yamt 1395 1.1.1.1.2.2 yamt ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik 1396 1.1.1.1.2.2 yamt (ts (at] polynet.lviv.ua) 1397 1.1.1.1.2.2 yamt 1398 1.1.1.1.2.2 yamt New algorithm for setting timeouts for TCP connection (more closely follow 1399 1.1.1.1.2.2 yamt TCP FSM) - Pradeep Krishnan (pkrishna (at] netcom.com) 1400 1.1.1.1.2.2 yamt 1401 1.1.1.1.2.2 yamt Track both window sizes for TCP connections through "keep state". 1402 1.1.1.1.2.2 yamt 1403 1.1.1.1.2.2 yamt Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel 1404 1.1.1.1.2.2 yamt (wezel (at] bio.vu.nl) 1405 1.1.1.1.2.2 yamt 1406 1.1.1.1.2.2 yamt 3.1.1-beta2 6/10/96 - Released 1407 1.1.1.1.2.2 yamt 1408 1.1.1.1.2.2 yamt Solaris2 fastroute/dup-to/to now works 1409 1.1.1.1.2.2 yamt 1410 1.1.1.1.2.2 yamt ipmon `record' reading rewritten 1411 1.1.1.1.2.2 yamt 1412 1.1.1.1.2.2 yamt Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg (at] eterna.com.au) 1413 1.1.1.1.2.2 yamt 1414 1.1.1.1.2.2 yamt Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson 1415 1.1.1.1.2.2 yamt (davidw (at] optimation.com.au) 1416 1.1.1.1.2.2 yamt 1417 1.1.1.1.2.2 yamt Michael Ryan (mike (at] NetworX.ie) reports the following: 1418 1.1.1.1.2.2 yamt * The Trumpet WinSock under Windows always sends its SYN packet with an ACK 1419 1.1.1.1.2.2 yamt value of 1, unlike any other implementation I've seen, which would set it 1420 1.1.1.1.2.2 yamt to zero. The "keep state" feature of IP Filter doesn't work when receiving 1421 1.1.1.1.2.2 yamt non-zero ACK values on new connection requests. 1422 1.1.1.1.2.2 yamt * */Makefile install rule doesn't install all the binaries/man pages 1423 1.1.1.1.2.2 yamt * Make ipnat use "tcp/udp" instead of "tcpudp" 1424 1.1.1.1.2.2 yamt * Print out "tcp/udp" properly 1425 1.1.1.1.2.2 yamt * ipnat "portmap tcp" matches "portmap udp" when adding/removing 1426 1.1.1.1.2.2 yamt * NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't 1427 1.1.1.1.2.2 yamt 1428 1.1.1.1.2.2 yamt 3.1.1-beta 1/9/96 - Released 1429 1.1.1.1.2.2 yamt 1430 1.1.1.1.2.2 yamt add better detection of TCP connections closing to TCP state monitoring. 1431 1.1.1.1.2.2 yamt 1432 1.1.1.1.2.2 yamt fr_addstate() not called correctly for fragments. "keep state" and 1433 1.1.1.1.2.2 yamt "keep frag" code don't work together 100% - Songqing Cai 1434 1.1.1.1.2.2 yamt (songqing_cai (at] sterling.com) 1435 1.1.1.1.2.2 yamt 1436 1.1.1.1.2.2 yamt call to fr_addstate() incorrect for adding state in combination with keeping 1437 1.1.1.1.2.2 yamt fragment information - Songqing Cai (songqing_cai (at] sterling.com) 1438 1.1.1.1.2.2 yamt 1439 1.1.1.1.2.2 yamt KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood 1440 1.1.1.1.2.2 yamt (cgull (at] smoke.marlboro.vt.us) 1441 1.1.1.1.2.2 yamt 1442 1.1.1.1.2.2 yamt make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban 1443 1.1.1.1.2.2 yamt (dima@best.net) 1444 1.1.1.1.2.2 yamt 1445 1.1.1.1.2.2 yamt 3.1.1-alpha 23/8/96 - Released 1446 1.1.1.1.2.2 yamt 1447 1.1.1.1.2.2 yamt kernel panic's when ICMP packets go through NAT code 1448 1.1.1.1.2.2 yamt 1449 1.1.1.1.2.2 yamt stats aren't zero'd properly with ipf -Z 1450 1.1.1.1.2.2 yamt 1451 1.1.1.1.2.2 yamt ipnat doesn't show port numbers correctly all the time and also add the 1452 1.1.1.1.2.2 yamt protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com) 1453 1.1.1.1.2.2 yamt 1454 1.1.1.1.2.2 yamt fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com) 1455 1.1.1.1.2.2 yamt 1456 1.1.1.1.2.2 yamt NetBSD-1.2 patches from - VaX#n8 <vax (at] linkdead.paranoia.com> 1457 1.1.1.1.2.2 yamt 1458 1.1.1.1.2.2 yamt Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu) 1459 1.1.1.1.2.2 yamt 1460 1.1.1.1.2.2 yamt ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall 1461 1.1.1.1.2.2 yamt (nrh@tardis.ed.ac.uk) 1462 1.1.1.1.2.2 yamt 1463 1.1.1.1.2.2 yamt 3.1.0 7/7/96 - Released 1464 1.1.1.1.2.2 yamt 1465 1.1.1.1.2.2 yamt Reformatted ipnat output to be compatible with it's input, so that 1466 1.1.1.1.2.2 yamt "ipnat -l | ipnat -rf -" is possible. 1467 1.1.1.1.2.2 yamt 1468 1.1.1.1.2.2 yamt 3.1.0beta 30/6/96 - Released 1469 1.1.1.1.2.2 yamt 1470 1.1.1.1.2.2 yamt NetBSD-1.2 patches from Greg Woods (woods (at] most.weird.com) 1471 1.1.1.1.2.2 yamt 1472 1.1.1.1.2.2 yamt kernel module must not be installed stripped (Solaris2), as created by 1473 1.1.1.1.2.2 yamt "make package" for Solaris2 - Peter Heimann 1474 1.1.1.1.2.2 yamt (peter (at] i3.informatik.rwth-aachen.de) 1475 1.1.1.1.2.2 yamt 1476 1.1.1.1.2.2 yamt 3.1.0alpha 5/6/96 - Released 1477 1.1.1.1.2.2 yamt 1478 1.1.1.1.2.2 yamt include examples in package for solaris2 1479 1.1.1.1.2.2 yamt 1480 1.1.1.1.2.2 yamt patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS) 1481 1.1.1.1.2.2 yamt 1482 1.1.1.1.2.2 yamt removed trailing space from printouts of rules in ipf. 1483 1.1.1.1.2.2 yamt 1484 1.1.1.1.2.2 yamt ipresend supports the same range of inputs that ipftest does. 1485 1.1.1.1.2.2 yamt 1486 1.1.1.1.2.2 yamt sending a duplicate copy of a packet to another network devices is now 1487 1.1.1.1.2.2 yamt supported. ("dup-to") 1488 1.1.1.1.2.2 yamt 1489 1.1.1.1.2.2 yamt sending a packet to an arbitary interface is now supported, irrespective 1490 1.1.1.1.2.2 yamt of its actual route, with no ttl decrement. Can also be routed without 1491 1.1.1.1.2.2 yamt the ttl being decremented. ("to" and "fastroute"). 1492 1.1.1.1.2.2 yamt 1493 1.1.1.1.2.2 yamt "call" option added to support calling a generic function if a packet is 1494 1.1.1.1.2.2 yamt matched. 1495 1.1.1.1.2.2 yamt 1496 1.1.1.1.2.2 yamt show all (upto 4) recorded bytes from the interface name in logging from 1497 1.1.1.1.2.2 yamt ipmon. 1498 1.1.1.1.2.2 yamt 1499 1.1.1.1.2.2 yamt support for using unix file permissions for read/write access on the device 1500 1.1.1.1.2.2 yamt is now in place. 1501 1.1.1.1.2.2 yamt 1502 1.1.1.1.2.2 yamt recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per (at] stibo.dk> 1503 1.1.1.1.2.2 yamt 1504 1.1.1.1.2.2 yamt ipftest doesn't call initparse() for THISHOST - Catherine Allen 1505 1.1.1.1.2.2 yamt (cla@connect.com.au) 1506 1.1.1.1.2.2 yamt 1507 1.1.1.1.2.2 yamt Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au) 1508 1.1.1.1.2.2 yamt 1509 1.1.1.1.2.2 yamt 3.0.4 10/4/96 - Released 1510 1.1.1.1.2.2 yamt 1511 1.1.1.1.2.2 yamt looop in `parsing' IP packets with optlen 0 for ip options. 1512 1.1.1.1.2.2 yamt 1513 1.1.1.1.2.2 yamt rule number not initialized and resulted in unexpected results for state 1514 1.1.1.1.2.2 yamt maching. 1515 1.1.1.1.2.2 yamt 1516 1.1.1.1.2.2 yamt option parsing and printing bugs - Pradeep Krishnan 1517 1.1.1.1.2.2 yamt 1518 1.1.1.1.2.2 yamt 3.0.4beta 25/3/96 - Released 1519 1.1.1.1.2.2 yamt 1520 1.1.1.1.2.2 yamt wouldn't parse "keep flags keep state" correctly. 1521 1.1.1.1.2.2 yamt 1522 1.1.1.1.2.2 yamt SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon 1523 1.1.1.1.2.2 yamt 1524 1.1.1.1.2.2 yamt patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems 1525 1.1.1.1.2.2 yamt from Thorsten Lockert <tholo (at] tetherless.com> 1526 1.1.1.1.2.2 yamt 1527 1.1.1.1.2.2 yamt b* functions in fil.c on Solaris 2.4 1528 1.1.1.1.2.2 yamt 1529 1.1.1.1.2.2 yamt 3.0.3 17/3/96 - Released 1530 1.1.1.1.2.2 yamt 1531 1.1.1.1.2.2 yamt added patches to support IP Filter initialisation when compiled into the 1532 1.1.1.1.2.2 yamt kernel. 1533 1.1.1.1.2.2 yamt 1534 1.1.1.1.2.2 yamt added -x option to ipmon to display hex dumps of logged packets. 1535 1.1.1.1.2.2 yamt 1536 1.1.1.1.2.2 yamt added -H option to ipftest to allow ascii-hex formatted input to specify 1537 1.1.1.1.2.2 yamt arbitary IP packets. 1538 1.1.1.1.2.2 yamt 1539 1.1.1.1.2.2 yamt Sending TCP RSTs as a response now work for Solaris2 x86 1540 1.1.1.1.2.2 yamt 1541 1.1.1.1.2.2 yamt add patches to make IP Filter compile into NetBSD kernels properly. 1542 1.1.1.1.2.2 yamt 1543 1.1.1.1.2.2 yamt patch to stop SunOS 4.1.x kernels panicing with "data traps". 1544 1.1.1.1.2.2 yamt 1545 1.1.1.1.2.2 yamt ipfboot script unloads and reloads ipf module on Solaris2 if it is already 1546 1.1.1.1.2.2 yamt loaded into the kernel. 1547 1.1.1.1.2.2 yamt 1548 1.1.1.1.2.2 yamt Installation of IP Filter as a Solaris2 package is now supported. 1549 1.1.1.1.2.2 yamt 1550 1.1.1.1.2.2 yamt Man pages for ipnat.4, ipnat.5 added. 1551 1.1.1.1.2.2 yamt 1552 1.1.1.1.2.2 yamt added some more regression tests and fixed up IP Filter to pass the new tests 1553 1.1.1.1.2.2 yamt (previous versions failed some of the tests in set 12). 1554 1.1.1.1.2.2 yamt 1555 1.1.1.1.2.2 yamt IP option filter processing has changed so that saying "with opt lsrr" will 1556 1.1.1.1.2.2 yamt check only for that one, but not mask out other options, so a packet with 1557 1.1.1.1.2.2 yamt strict source routing, along with loose source routing will match all of 1558 1.1.1.1.2.2 yamt "with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr". 1559 1.1.1.1.2.2 yamt 1560 1.1.1.1.2.2 yamt IPL_NAME needed in ipnat.c - Kelly (kelly (at] count04.mry.scruznet.com) 1561 1.1.1.1.2.2 yamt 1562 1.1.1.1.2.2 yamt patches for clean NetBSD compilation from Bernd Ernesti (bernd (at] arresum.inka.de) 1563 1.1.1.1.2.2 yamt 1564 1.1.1.1.2.2 yamt make install is incorrect - Julian Briggs (julian (at] lightwork.co.uk) 1565 1.1.1.1.2.2 yamt 1566 1.1.1.1.2.2 yamt strtol() returns 0x7fffffff for all negative numbers, 1567 1.1.1.1.2.2 yamt printfr() generates incorrect output for "opt sec-class *", 1568 1.1.1.1.2.2 yamt handling of "not opt xxx opt yyy" incorrect. 1569 1.1.1.1.2.2 yamt - Minh Tonthat (minht (at] sbei.com)/Pradeep Krishnan (pradeepk (at] sbei.com) 1570 1.1.1.1.2.2 yamt 1571 1.1.1.1.2.2 yamt m_pullup() called only for input and not output; caused problems 1572 1.1.1.1.2.2 yamt with filtering icmp - Nigel Verdon (verdenn (at] gb.swissbank.com) 1573 1.1.1.1.2.2 yamt 1574 1.1.1.1.2.2 yamt parsing problem for "port 1" and NetBSD patches incorrect - 1575 1.1.1.1.2.2 yamt Andreas Gustafsson (gson (at] guava.araneus.fi) 1576 1.1.1.1.2.2 yamt 1577 1.1.1.1.2.2 yamt 3.0.2 4/2/96 - Released 1578 1.1.1.1.2.2 yamt 1579 1.1.1.1.2.2 yamt Corrected bug where NAT recalculates checksums for fragments. 1580 1.1.1.1.2.2 yamt 1581 1.1.1.1.2.2 yamt make NAT recalculate UDP checksums (rather than setting them to 0), 1582 1.1.1.1.2.2 yamt if they're non-zero. 1583 1.1.1.1.2.2 yamt 1584 1.1.1.1.2.2 yamt DNS patches - Real Page (Real.Page (at] Matrox.com) 1585 1.1.1.1.2.2 yamt 1586 1.1.1.1.2.2 yamt alteration of checksum recalculations in NAT code and addition of 1587 1.1.1.1.2.2 yamt redirection with NAT - Mike Neuman 1588 1.1.1.1.2.2 yamt 1589 1.1.1.1.2.2 yamt core dump, if tcp/udp is used with a port number and not service name, 1590 1.1.1.1.2.2 yamt in ipf - Mike Neuman (mcn (at] engarde.com) 1591 1.1.1.1.2.2 yamt 1592 1.1.1.1.2.2 yamt initparse() call, missing to prime "<thishost>" hook - Craig Bishop 1593 1.1.1.1.2.2 yamt 1594 1.1.1.1.2.2 yamt 3.0.1 14/1/96 - Released 1595 1.1.1.1.2.2 yamt 1596 1.1.1.1.2.2 yamt miscellaneous patches for Solaris2 1597 1.1.1.1.2.2 yamt 1598 1.1.1.1.2.2 yamt 3.0 14/1/96 - Released 1599 1.1.1.1.2.2 yamt 1600 1.1.1.1.2.2 yamt Patch included for FDDI, from Richard Ohnemus 1601 1.1.1.1.2.2 yamt (Richard_Ohnemus (at] dallas.csd.sterling.com) 1602 1.1.1.1.2.2 yamt 1603 1.1.1.1.2.2 yamt Code cleanup for release. 1604 1.1.1.1.2.2 yamt 1605 1.1.1.1.2.2 yamt 3.0beta4 10/1/96 1606 1.1.1.1.2.2 yamt 1607 1.1.1.1.2.2 yamt recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop 1608 1.1.1.1.2.2 yamt 1609 1.1.1.1.2.2 yamt recursive mutex in sending TCP RSTs fixed, reported by Tony Becker 1610 1.1.1.1.2.2 yamt 1611 1.1.1.1.2.2 yamt 3.0beta3 9/1/96 1612 1.1.1.1.2.2 yamt 1613 1.1.1.1.2.2 yamt FIxup for Solaris2.5 install and interface name bug in ipftest from 1614 1.1.1.1.2.2 yamt Julian Briggs (julian (at] lightwork.co.uk) 1615 1.1.1.1.2.2 yamt 1616 1.1.1.1.2.2 yamt Byte order patches for ipmon from Tony Becker (tony (at] mcrsys.com) 1617 1.1.1.1.2.2 yamt 1618 1.1.1.1.2.2 yamt 3.0beta2 7/1/96 1619 1.1.1.1.2.2 yamt 1620 1.1.1.1.2.2 yamt Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD. 1621 1.1.1.1.2.2 yamt Note, this isn't really what one would call IP account, when compared to 1622 1.1.1.1.2.2 yamt process accounting, sigh. 1623 1.1.1.1.2.2 yamt 1624 1.1.1.1.2.2 yamt Split up ipresend into iptest/ipresend/ipsend 1625 1.1.1.1.2.2 yamt 1626 1.1.1.1.2.2 yamt Added another m_pullup() inside fr_check() for BSD style kernels and 1627 1.1.1.1.2.2 yamt added some checks to ipllog() to not log more than is present (for short 1628 1.1.1.1.2.2 yamt packets). 1629 1.1.1.1.2.2 yamt 1630 1.1.1.1.2.2 yamt Fixed bug where failed hostname/netname resolution goes undetecte and 1631 1.1.1.1.2.2 yamt becomes 0.0.0.0 (any) (reported Guido van Rooij) 1632 1.1.1.1.2.2 yamt 1633 1.1.1.1.2.2 yamt 3.0beta 11/11/95 - Released 1634 1.1.1.1.2.2 yamt 1635 1.1.1.1.2.2 yamt Rewrote the way rule testing is done, reducing the number of files needed and 1636 1.1.1.1.2.2 yamt generated. 1637 1.1.1.1.2.2 yamt 1638 1.1.1.1.2.2 yamt SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green) 1639 1.1.1.1.2.2 yamt 1640 1.1.1.1.2.2 yamt Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3 1641 1.1.1.1.2.2 yamt BSD based Unixes (panic'd) 1642 1.1.1.1.2.2 yamt 1643 1.1.1.1.2.2 yamt Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku (at] tequila.nixu.fi> 1644 1.1.1.1.2.2 yamt (I think someone else already told me about these but they got lost :-/) 1645 1.1.1.1.2.2 yamt 1646 1.1.1.1.2.2 yamt Changed Makefile structure to build object files for different operating 1647 1.1.1.1.2.2 yamt systems in separate directories by default. 1648 1.1.1.1.2.2 yamt 1649 1.1.1.1.2.2 yamt BSDI has ef0 for first ethernet interface 1650 1.1.1.1.2.2 yamt 1651 1.1.1.1.2.2 yamt Allow for a "not" operator before optional keywords. 1652 1.1.1.1.2.2 yamt 1653 1.1.1.1.2.2 yamt The "rule number" was being incorrectly incremented every time it went through 1654 1.1.1.1.2.2 yamt the loop rather than when it matched a rule. 1655 1.1.1.1.2.2 yamt 1656 1.1.1.1.2.2 yamt 2.8.2 24/10/95 - Released 1657 1.1.1.1.2.2 yamt 1658 1.1.1.1.2.2 yamt Fixed up problems with "textip" for doing lots of testing. 1659 1.1.1.1.2.2 yamt 1660 1.1.1.1.2.2 yamt Fixed bug in detection of "short" tcp/ip packets (all reported as being short). 1661 1.1.1.1.2.2 yamt 1662 1.1.1.1.2.2 yamt Solaris 2.4 port now works 100%. 1663 1.1.1.1.2.2 yamt 1664 1.1.1.1.2.2 yamt Man page errors reported and fixed. 1665 1.1.1.1.2.2 yamt 1666 1.1.1.1.2.2 yamt Removed duplicate entry in etc/services for login on port 49 (Craig Bishop). 1667 1.1.1.1.2.2 yamt 1668 1.1.1.1.2.2 yamt Fixed ipmon output to put a space after the log-letter. 1669 1.1.1.1.2.2 yamt 1670 1.1.1.1.2.2 yamt Patch from Guido van Rooij to fix parsing problem. 1671 1.1.1.1.2.2 yamt 1672 1.1.1.1.2.2 yamt 2.8.1 15/10/95 - Released 1673 1.1.1.1.2.2 yamt 1674 1.1.1.1.2.2 yamt Added ttl and tos filtering. 1675 1.1.1.1.2.2 yamt 1676 1.1.1.1.2.2 yamt Patches for fixing up compilation and port problems (little endian) 1677 1.1.1.1.2.2 yamt from Guido van Rooij <guido (at] IAEhv.nl>. 1678 1.1.1.1.2.2 yamt 1679 1.1.1.1.2.2 yamt Man page problems reported and fixed by Carson Gaspar <carson (at] lehman.com>. 1680 1.1.1.1.2.2 yamt 1681 1.1.1.1.2.2 yamt ipsend doesn't compile properly on Solaris2.4 1682 1.1.1.1.2.2 yamt 1683 1.1.1.1.2.2 yamt Lots of work done for Solaris2.4 to make it MT/MP safe and work. 1684 1.1.1.1.2.2 yamt 1685 1.1.1.1.2.2 yamt 2.8 15/9/95 - Released 1686 1.1.1.1.2.2 yamt 1687 1.1.1.1.2.2 yamt ipmon can now send messages to syslogd (-s) and use names instead of 1688 1.1.1.1.2.2 yamt numbers (-N). 1689 1.1.1.1.2.2 yamt 1690 1.1.1.1.2.2 yamt IP packets are now "compiled" into a structure only containing filterable 1691 1.1.1.1.2.2 yamt bits. 1692 1.1.1.1.2.2 yamt 1693 1.1.1.1.2.2 yamt Added regression testing in the test/ subdirectory, using a new option 1694 1.1.1.1.2.2 yamt (-b) with the ipftest program. 1695 1.1.1.1.2.2 yamt 1696 1.1.1.1.2.2 yamt Added "nomatch" return to filter results. These are counted and show 1697 1.1.1.1.2.2 yamt up in reports from ipfstat. 1698 1.1.1.1.2.2 yamt 1699 1.1.1.1.2.2 yamt Moved filter code out of ip_fil.c and into fil.c - there is now only one 1700 1.1.1.1.2.2 yamt instance of it in the package. 1701 1.1.1.1.2.2 yamt 1702 1.1.1.1.2.2 yamt Added Solaris 2.4 support. 1703 1.1.1.1.2.2 yamt 1704 1.1.1.1.2.2 yamt Added IPSO basic security option filtering. 1705 1.1.1.1.2.2 yamt 1706 1.1.1.1.2.2 yamt Added name support for filtering on all 19 named IP options. 1707 1.1.1.1.2.2 yamt 1708 1.1.1.1.2.2 yamt Patches from Ivan Brawley to log packet contents as well as packet headers. 1709 1.1.1.1.2.2 yamt 1710 1.1.1.1.2.2 yamt Update for sun/conf.c.diff from Ivan Brawley <ibrawley (at] awadi.com.AU> 1711 1.1.1.1.2.2 yamt 1712 1.1.1.1.2.2 yamt Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf, 1713 1.1.1.1.2.2 yamt along with a new ioctl, SIOCFRENB. 1714 1.1.1.1.2.2 yamt From: Dieter Dworkin Muller <dworkin (at] village.org> 1715 1.1.1.1.2.2 yamt 1716 1.1.1.1.2.2 yamt 2.7.3 31/7.95 - Released 1717 1.1.1.1.2.2 yamt 1718 1.1.1.1.2.2 yamt Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green). 1719 1.1.1.1.2.2 yamt 1720 1.1.1.1.2.2 yamt ipftest now deals with tcpdump3 binary output files (from libpcap) with -P. 1721 1.1.1.1.2.2 yamt 1722 1.1.1.1.2.2 yamt Brought ipftest program upto date with actual filter code. 1723 1.1.1.1.2.2 yamt 1724 1.1.1.1.2.2 yamt Filter would cause a match to occur when it wasn't meant to if the packet 1725 1.1.1.1.2.2 yamt had short headers and was missing portions that should have been there. 1726 1.1.1.1.2.2 yamt Err, it would rightly not match on them, but their absence caused a match 1727 1.1.1.1.2.2 yamt when it shouldn't have been. 1728 1.1.1.1.2.2 yamt 1729 1.1.1.1.2.2 yamt 2.7.2 26/7/95 - Released 1730 1.1.1.1.2.2 yamt 1731 1.1.1.1.2.2 yamt Problem with filtering just SYN flagged packets reported by 1732 1.1.1.1.2.2 yamt Dieter Dworkin Muller <dworkin (at] village.org>. To solve this 1733 1.1.1.1.2.2 yamt problem, added support for masking TCP flags for comparison "flags X/Y". 1734 1.1.1.1.2.2 yamt 1735 1.1.1.1.2.2 yamt 2.7.1 9/7/95 - Released 1736 1.1.1.1.2.2 yamt 1737 1.1.1.1.2.2 yamt Added ip_dirbroadcast support for Sun ip_input.c 1738 1.1.1.1.2.2 yamt 1739 1.1.1.1.2.2 yamt Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are 1740 1.1.1.1.2.2 yamt better. 1741 1.1.1.1.2.2 yamt 1742 1.1.1.1.2.2 yamt 2.7 7/7/95 - Released 1743 1.1.1.1.2.2 yamt 1744 1.1.1.1.2.2 yamt Added "return-rst" to return TCP RST's to TCP packets. 1745 1.1.1.1.2.2 yamt 1746 1.1.1.1.2.2 yamt Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now. 1747 1.1.1.1.2.2 yamt 1748 1.1.1.1.2.2 yamt Added insertion of filter rules. Use "@<#>" at the beginning of a filter 1749 1.1.1.1.2.2 yamt to insert a rule at row #. 1750 1.1.1.1.2.2 yamt 1751 1.1.1.1.2.2 yamt Filter keeps track of how many times each rule is matched. 1752 1.1.1.1.2.2 yamt 1753 1.1.1.1.2.2 yamt Changed compile time things to match kernel option (IPFILTER_LKM & 1754 1.1.1.1.2.2 yamt IPFILTER_LOG). 1755 1.1.1.1.2.2 yamt 1756 1.1.1.1.2.2 yamt Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP. 1757 1.1.1.1.2.2 yamt (No change required for 3.6) 1758 1.1.1.1.2.2 yamt 1759 1.1.1.1.2.2 yamt Now includes TCP fragments which start inside the TCP header as being short. 1760 1.1.1.1.2.2 yamt Added counting the number of times each rule is matched. 1761 1.1.1.1.2.2 yamt 1762 1.1.1.1.2.2 yamt 1763 1.1.1.1.2.2 yamt 2.6 11/5/95 - Released 1764 1.1.1.1.2.2 yamt 1765 1.1.1.1.2.2 yamt Added -n option to ipf: when supplied, no changes are made to the kernel. 1766 1.1.1.1.2.2 yamt 1767 1.1.1.1.2.2 yamt Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI. 1768 1.1.1.1.2.2 yamt 1769 1.1.1.1.2.2 yamt Rewrote filtering to use a more generic mask & match procedure for 1770 1.1.1.1.2.2 yamt checking if a packet matches a rule. 1771 1.1.1.1.2.2 yamt 1772 1.1.1.1.2.2 yamt 2.5.2 27/4/95 - Released 1773 1.1.1.1.2.2 yamt 1774 1.1.1.1.2.2 yamt "tcp/udp" and a non-initialised pointer caused the "proto" to become 1775 1.1.1.1.2.2 yamt a `random' value; added "ip#/dotted.mask" notation to the BNF. 1776 1.1.1.1.2.2 yamt From Adam W. Feigin <feigin (at] iis.ee.ethz.ch> 1777 1.1.1.1.2.2 yamt 1778 1.1.1.1.2.2 yamt 2.5.1 22/3/95 - Released 1779 1.1.1.1.2.2 yamt 1780 1.1.1.1.2.2 yamt "tcp/udp" had a strange effect (undesired) on getserv*() functions, 1781 1.1.1.1.2.2 yamt causing protocol/service lookups to fail. Reported by Matthew Green. 1782 1.1.1.1.2.2 yamt 1783 1.1.1.1.2.2 yamt 2.5 17/3/95 - Released 1784 1.1.1.1.2.2 yamt 1785 1.1.1.1.2.2 yamt Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop 1786 1.1.1.1.2.2 yamt output through the ipftest program. Suggestions from: 1787 1.1.1.1.2.2 yamt Michael Ciavarella (mikec (at] phyto.apana.org.au) 1788 1.1.1.1.2.2 yamt 1789 1.1.1.1.2.2 yamt Conflicts occur when "general" filter rules are used for ports and the 1790 1.1.1.1.2.2 yamt lack of a "proto" when used with "port" matches other packets when only 1791 1.1.1.1.2.2 yamt TCP/UDP are implied. 1792 1.1.1.1.2.2 yamt Reported Matthew Green (mrg (at] fulcom.com.au); 1793 1.1.1.1.2.2 yamt reported & fixed 6-8/3/95 1794 1.1.1.1.2.2 yamt 1795 1.1.1.1.2.2 yamt Added filtering of short TCP packets using "with short" 28/2/95 1796 1.1.1.1.2.2 yamt (These can possibly slip by checks for the various flags). Short UDP 1797 1.1.1.1.2.2 yamt or ICMP are dropped to the floor and logged. 1798 1.1.1.1.2.2 yamt 1799 1.1.1.1.2.2 yamt Added filtering of fragmented packets using "with frag" 24/2/95 1800 1.1.1.1.2.2 yamt 1801 1.1.1.1.2.2 yamt Port to NetBSD-current completed 20/2/95, using LKM. 1802 1.1.1.1.2.2 yamt 1803 1.1.1.1.2.2 yamt Added logging of the rule # which caused the logging to happen and the 1804 1.1.1.1.2.2 yamt interface on which the packet is currently as suggested by 1805 1.1.1.1.2.2 yamt Andreas Greulich (greulich (at] math-stat.unibe.ch) 10/2/95 1806 1.1.1.1.2.2 yamt 1807 1.1.1.1.2.2 yamt 2.4 9/2/95 - Released 1808 1.1.1.1.2.2 yamt Fixed saving of IP headers in ICMP packets. 1809 1.1.1.1.2.2 yamt 1810 1.1.1.1.2.2 yamt 2.3 29/1/95 1811 1.1.1.1.2.2 yamt Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL). 1812 1.1.1.1.2.2 yamt Fixed iplread() and iplsave() with help from Marc Huber. 1813 1.1.1.1.2.2 yamt 1814 1.1.1.1.2.2 yamt 2.2 7/1/95 - Released 1815 1.1.1.1.2.2 yamt Added code from Marc Huber <huber (at] fzi.de> to allow it to allocate 1816 1.1.1.1.2.2 yamt its own major char number dynamically when modload'ing. Fixed up 1817 1.1.1.1.2.2 yamt use of <, >, <=, >= and >< for ports. 1818 1.1.1.1.2.2 yamt 1819 1.1.1.1.2.2 yamt 2.1 21/12/94 - Released 1820 1.1.1.1.2.2 yamt repackaged to include the correct ip_output.c and ip_input.c *goof* 1821 1.1.1.1.2.2 yamt 1822 1.1.1.1.2.2 yamt 2.0 18/12/94 - Released 1823 1.1.1.1.2.2 yamt added code to check for port ranges - complete. 1824 1.1.1.1.2.2 yamt rewrote to work as a loadable kernel module - complete. 1825 1.1.1.1.2.2 yamt 1826 1.1.1.1.2.2 yamt 1.1 1827 1.1.1.1.2.2 yamt added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers. 1828 1.1.1.1.2.2 yamt 1829 1.1.1.1.2.2 yamt 1.0 22/04/93 - Released 1830 1.1.1.1.2.2 yamt First release cut. 1831
Indexes created Tue May 05 00:25:04 UTC 2026