version 1.3.8

diff --git a/sbin/ipf/ipf.c b/sbin/ipf/ipf.c
index 3d4eb97..260fc73 100644 (file)
--- a/sbin/ipf/ipf.c
+++ b/sbin/ipf/ipf.c
@@ -1,3 +1,4 @@
+/*     $OpenBSD: ipf.c,v 1.10 1997/02/26 04:35:39 kstailey Exp $       */
 /*
  * (C)opyright 1993,1994,1995 by Darren Reed.
  *
@@ -13,6 +14,9 @@
 #if !defined(__SVR4) && !defined(__GNUC__)
 #include <strings.h>
 #endif
+#if !defined(__SVR4) && defined(__GNUC__) && !defined(__OpenBSD__)
+extern char    *index();
+#endif
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/file.h>
@@ -32,13 +36,13 @@
 #include <resolv.h>
 #include "ipf.h"
 
-#ifndef        lint
+#if !defined(lint) && defined(LIBC_SCCS)
 static char    sccsid[] = "@(#)ipf.c   1.23 6/5/96 (C) 1993-1995 Darren Reed";
-static char    rcsid[] = "$Id: ipf.c,v 1.9 1997/01/29 01:28:03 deraadt Exp $";
+static char    rcsid[] = "$DRId: ipf.c,v 2.0.1.2 1997/02/04 14:37:46 darrenr Exp $";
 #endif
 
 #if    SOLARIS
-void   frsync();
+void   frsync(), blockunknown();
 #endif
 void   zerostats();
 
@@ -50,14 +54,15 @@ static      int     fd = -1;
 
 static void    procfile(), flushfilter(), set_state();
 static void    packetlogon(), swapactive(), showstats();
+static char   *getline();
 
 int main(argc,argv)
 int argc;
 char *argv[];
 {
-       int     c;
+       char    c;
 
-       while ((c = getopt(argc, argv, "AsInopvdryf:F:l:EDzZ")) != -1) {
+       while ((c = getopt(argc, argv, "AdDEf:F:Il:noprsUvyzZ")) != -1) {
                switch (c)
                {
                case 'E' :
@@ -99,6 +104,11 @@ char *argv[];
                case 's' :
                        swapactive();
                        break;
+#if SOLARIS
+               case 'U' :
+                       blockunknown();
+                       break;
+#endif
                case 'v' :
                        opts |= OPT_VERBOSE;
                        break;
@@ -168,12 +178,12 @@ char      *name, *file;
        if (!strcmp(file, "-"))
                fp = stdin;
        else if (!(fp = fopen(file, "r"))) {
-               fprintf(stderr, "%s: fopen(%s) failed: %s", name, file,
+               fprintf(stderr, "%s: fopen(%s) failed: %s\n", name, file,
                        STRERROR(errno));
                exit(1);
        }
 
-       while (fgets(line, sizeof(line)-1, fp)) {
+       while (getline(line, sizeof(line)-1, fp)) {
                /*
                 * treat both CR and LF as EOL
                 */
@@ -217,9 +227,11 @@ char       *name, *file;
                            !(opts & OPT_DONOTHING)) {
                                if (ioctl(fd, add, fr) == -1)
                                        perror("ioctl(SIOCZRLST)");
-                               else
-                                       printf("hits %d bytes %d\n",
+                               else {
+                                       printf("hits %ld bytes %ld ",
                                                fr->fr_hits, fr->fr_bytes);
+                                       printfr(fr);
+                               }
                        } else if ((opts & OPT_REMOVE) &&
                                   !(opts & OPT_DONOTHING)) {
                                if (ioctl(fd, del, fr) == -1)
@@ -233,11 +245,33 @@ char      *name, *file;
        (void)fclose(fp);
 }
 
+/*
+ * Similar to fgets(3) but can handle '\\'
+ */
+static char *getline(str, size, file)
+register char  *str;
+size_t size;
+FILE   *file;
+{
+       register char *p;
+
+       do {
+               for (p = str;; p+= strlen(p) - 1) {
+                       if (!fgets(p, size, file))
+                               return(NULL);
+                       p[strlen(p) -1] = '\0';
+                       if (p[strlen(p) - 1] != '\\')
+                               break;
+               }
+       } while (*str == '\0' || *str == '\n');
+       return(str);
+}
+
 
 static void packetlogon(opt)
 char   *opt;
 {
-       int     err, flag;
+       int     err, flag = 0;
 
        if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
                if ((err = ioctl(fd, SIOCGETFF, &flag)))
@@ -246,7 +280,7 @@ char        *opt;
                printf("log flag is currently %#x\n", flag);
        }
 
-       flag = 0;
+       flag &= ~(FF_LOGPASS|FF_LOGNOMATCH|FF_LOGBLOCK);
 
        if (strchr(opt, 'p')) {
                flag |= FF_LOGPASS;
@@ -370,3 +404,33 @@ friostat_t *fp;
                        fp->f_st[0].fr_pkl, fp->f_st[0].fr_skip,
                        fp->f_st[1].fr_pkl, fp->f_st[1].fr_skip);
 }
+
+
+#if SOLARIS
+void blockunknown()
+{
+       int     flag;
+
+       if (opendevice() == -1)
+               return;
+
+       if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
+               if (ioctl(fd, SIOCGETFF, &flag))
+                       perror("ioctl(SIOCGETFF)");
+
+               printf("log flag is currently %#x\n", flag);
+       }
+
+       flag ^= FF_BLOCKNONIP;
+
+       if (opendevice() != -2 && ioctl(fd, SIOCSETFF, &flag))
+               perror("ioctl(SIOCSETFF)");
+
+       if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
+               if (ioctl(fd, SIOCGETFF, &flag))
+                       perror("ioctl(SIOCGETFF)");
+
+               printf("log flag is now %#x\n", flag);
+       }
+}
+#endif

diff --git a/sbin/ipf/ipf.h b/sbin/ipf/ipf.h
index c287389..7980f22 100644 (file)
--- a/sbin/ipf/ipf.h
+++ b/sbin/ipf/ipf.h
@@ -6,7 +6,7 @@
  * to the original author and the contributors.
  *
  * @(#)ipf.h   1.12 6/5/96
- * $Id: ipf.h,v 1.6 1997/02/11 22:23:39 kstailey Exp $
+ * $DRId: ipf.h,v 2.0.1.1 1997/01/09 15:14:43 darrenr Exp $
  */
 
 #ifndef        SOLARIS

diff --git a/sbin/ipf/parse.c b/sbin/ipf/parse.c
index 19e093b..c3f0a7c 100644 (file)
--- a/sbin/ipf/parse.c
+++ b/sbin/ipf/parse.c
@@ -1,3 +1,4 @@
+/*     $OpenBSD: parse.c,v 1.9 1997/02/26 04:35:40 kstailey Exp $      */
 /*
  * (C)opyright 1993-1996 by Darren Reed.
  *
@@ -32,9 +33,9 @@
 #include "ipf.h"
 #include <ctype.h>
 
-#ifndef        lint
+#if !defined(lint) && defined(LIBC_SCCS)
 static char    sccsid[] ="@(#)parse.c  1.44 6/5/96 (C) 1993-1996 Darren Reed";
-static char    rcsid[] = "$Id: parse.c,v 1.8 1997/01/17 07:12:18 millert Exp $";
+static char    rcsid[] = "$DRId: parse.c,v 2.0.1.2 1997/02/17 13:59:44 darrenr Exp $";
 #endif
 
 extern struct  ipopt_names     ionames[], secclass[];
@@ -47,6 +48,8 @@ u_char        tcp_flags();
 struct frentry *parse();
 void   binprint(), printfr();
 int    addicmp(), extras(), hostmask(), ports(), icmpcode(), addkeep();
+int    to_interface();
+
 
 char   *proto = NULL;
 char   flagset[] = "FSRPAU";
@@ -75,6 +78,11 @@ char *line;
        u_char  ch;
        int     i, cnt = 1;
 
+       while (*line && isspace(*line))
+               line++;
+       if (!*line)
+               return NULL;
+
        bzero((char *)&fil, sizeof(fil));
        fil.fr_mip.fi_v = 0xf;
        fil.fr_ip.fi_v = 4;
@@ -95,15 +103,8 @@ char        *line;
        cpp = cps;
        if (**cpp == '@')
                fil.fr_hits = atoi(*cpp++ + 1) + 1;
-       /*
-        * does it start with one of the two possible first words ?
-        */
-       if (strcasecmp("block",*cpp) && strcasecmp("pass",*cpp) &&
-           strcasecmp("log",*cpp) && strcasecmp("count",*cpp)) {
-               (void)fprintf(stderr, "unknown keyword (%s)\n", *cpp);
-               return NULL;
-       }
-       if (**cpp == 'b') {
+
+       if (!strcasecmp("block", *cpp)) {
                fil.fr_flags = FR_BLOCK;
                if (!strncasecmp(*(cpp+1), "return-icmp", 11)) {
                        fil.fr_flags |= FR_RETICMP;
@@ -121,11 +122,11 @@ char      *line;
                        fil.fr_flags |= FR_RETRST;
                        cpp++;
                }
-       } else if (**cpp == 'c')
+       } else if (!strcasecmp("count", *cpp)) {
                fil.fr_flags = FR_ACCOUNT;
-       else if (**cpp == 'p') {
+       } else if (!strcasecmp("pass", *cpp)) {
                fil.fr_flags = FR_PASS;
-       } else if (**cpp == 'l') {
+       } else if (!strcasecmp("log", *cpp)) {
                fil.fr_flags = FR_LOG;
                if (!strcasecmp(*(cpp+1), "body")) {
                        fil.fr_flags |= FR_LOGBODY;
@@ -135,14 +136,29 @@ char      *line;
                        fil.fr_flags |= FR_LOGFIRST;
                        cpp++;
                }
+       } else {
+               /*
+                * Doesn't start with one of the action words
+                */
+               (void)fprintf(stderr, "unknown keyword (%s)\n", *cpp);
+               return NULL;
        }
        cpp++;
 
        if (!strcasecmp("in", *cpp))
                fil.fr_flags |= FR_INQUE;
-       else if (!strcasecmp("out", *cpp))
+       else if (!strcasecmp("out", *cpp)) {
                fil.fr_flags |= FR_OUTQUE;
-       else {
+               if (fil.fr_flags & FR_RETICMP) {
+                       (void)fprintf(stderr,
+                               "Can only use return-icmp with 'in'\n");
+                       return NULL;
+               } else if (fil.fr_flags & FR_RETRST) {
+                       (void)fprintf(stderr,
+                               "Can only use return-rst with 'in'\n");
+                       return NULL;
+               }
+       } else {
                (void)fprintf(stderr,
                        "missing 'in'/'out' keyword (%s)\n", *cpp);
                return NULL;
@@ -164,6 +180,15 @@ char       *line;
                        fil.fr_flags |= FR_LOGFIRST;
                        cpp++;
                }
+               if (!strcasecmp(*cpp, "or-block")) {
+                       if (!(fil.fr_flags & FR_PASS)) {
+                               (void)fprintf(stderr,
+                                       "or-block must be used with pass\n");
+                               return NULL;
+                       }
+                       fil.fr_flags |= FR_LOGORBLOCK;
+                       cpp++;
+               }
        }
 
        if (!strcasecmp("quick", *cpp)) {
@@ -172,7 +197,7 @@ char        *line;
        }
 
        *fil.fr_ifname = '\0';
-       if (!strcasecmp(*cpp, "on")) {
+       if (*cpp && !strcasecmp(*cpp, "on")) {
                if (!*++cpp) {
                        (void)fprintf(stderr, "interface name missing\n");
                        return NULL;
@@ -191,16 +216,6 @@ char       *line;
                }
 
                if (*cpp) {
-#if SOLARIS
-                       if (!strcasecmp(*cpp, "dup-to")  ||
-                           !strcasecmp(*cpp, "to") ||
-                           !strcasecmp(*cpp, "fastroute")) {
-                               (void) fprintf(stderr,
-                                       "%s not supported under SunOS5\n",
-                                       *cpp);
-                               return NULL;
-                       }
-#endif
                        if (!strcasecmp(*cpp, "dup-to") && *(cpp + 1)) {
                                cpp++;
                                if (to_interface(&fil.fr_dif, *cpp))
@@ -218,7 +233,7 @@ char        *line;
                        }
                }
        }
-       if (!strcasecmp(*cpp, "tos")) {
+       if (*cpp && !strcasecmp(*cpp, "tos")) {
                if (!*++cpp) {
                        (void)fprintf(stderr, "tos missing value\n");
                        return NULL;
@@ -228,7 +243,7 @@ char        *line;
                cpp++;
        }
 
-       if (!strcasecmp(*cpp, "ttl")) {
+       if (*cpp && !strcasecmp(*cpp, "ttl")) {
                if (!*++cpp) {
                        (void)fprintf(stderr, "ttl missing hopcount value\n");
                        return NULL;
@@ -242,7 +257,7 @@ char        *line;
         * check for "proto <protoname>" only decode udp/tcp/icmp as protoname
         */
        proto = NULL;
-       if (!strcasecmp(*cpp, "proto")) {
+       if (*cpp && !strcasecmp(*cpp, "proto")) {
                if (!*++cpp) {
                        (void)fprintf(stderr, "protocol name missing\n");
                        return NULL;
@@ -282,6 +297,10 @@ char       *line;
         * get the from host and bit mask to use against packets
         */
 
+       if (!*cpp) {
+               fprintf(stderr, "missing source specification\n");
+               return NULL;
+       }
        if (!strcasecmp(*cpp, "all")) {
                cpp++;
                if (!*cpp)
@@ -687,21 +706,21 @@ struct    frentry *fr;
               !strncasecmp(**cp, "not", 3) || !strncasecmp(**cp, "opt", 4) ||
               !strncasecmp(**cp, "frag", 3) || !strncasecmp(**cp, "no", 2) ||
               !strncasecmp(**cp, "short", 5))) {
-               if (***cp == 'n') {
+               if (***cp == 'n' || ***cp == 'N') {
                        notopt = 1;
                        (*cp)++;
                        continue;
-               } else if (***cp == 'i') {
+               } else if (***cp == 'i' || ***cp == 'I') {
                        if (!notopt)
                                fr->fr_ip.fi_fl |= FI_OPTIONS;
                        fr->fr_mip.fi_fl |= FI_OPTIONS;
                        goto nextopt;
-               } else if (***cp == 'f') {
+               } else if (***cp == 'f' || ***cp == 'F') {
                        if (!notopt)
                                fr->fr_ip.fi_fl |= FI_FRAG;
                        fr->fr_mip.fi_fl |= FI_FRAG;
                        goto nextopt;
-               } else if (***cp == 'o') {
+               } else if (***cp == 'o' || ***cp == 'O') {
                        if (!*(*cp + 1)) {
                                (void)fprintf(stderr,
                                        "opt missing arguements\n");
@@ -711,7 +730,7 @@ struct      frentry *fr;
                        if (!(opts = optname(cp, &secmsk)))
                                return -1;
                        oflags = FI_OPTIONS;
-               } else if (***cp == 's') {
+               } else if (***cp == 's' || ***cp == 'S') {
                        if (fr->fr_tcpf) {
                                (void) fprintf(stderr,
                                    "short cannot be used with TCP flags\n");
@@ -980,9 +999,9 @@ struct      frentry *fp;
                return -1;
        }
 
-       if (***cp == 's')
+       if (***cp == 's' || ***cp == 'S')
                fp->fr_flags |= FR_KEEPSTATE;
-       else if (***cp == 'f')
+       else if (***cp == 'f' || ***cp == 'F')
                fp->fr_flags |= FR_KEEPFRAG;
        (*cp)++;
        return 0;
@@ -1057,7 +1076,6 @@ struct    frentry *fp;
        static  char    *pcmp1[] = { "*", "=", "!=", "<", ">", "<=", ">=",
                                    "<>", "><"};
        struct  protoent        *p;
-       frdest_t        *fdp;
        int     ones = 0, pr;
        char    *s;
        u_char  *t;
@@ -1098,6 +1116,8 @@ struct    frentry *fp;
                        (void)printf("body ");
                if (fp->fr_flags & FR_LOGFIRST)
                        (void)printf("first ");
+               if (fp->fr_flags & FR_LOGORBLOCK)
+                       (void)printf("or-block ");
        }
        if (fp->fr_flags & FR_QUICK)
                (void)printf("quick ");