2 # NOTE: Quite a few patches and suggestions come from other sources, to whom
3 # I'm greatly indebted, even if no names are mentioned.
5 # Thanks to the Coombs Computing Unit at the ANU for their continued support
6 # in providing a very available location for the IP Filter home page and
9 # Thanks also to all those who have contributed patches and other code,
10 # and especially those who have found the time to port IP Filter to new
13 4.1.23 - Released 31 May 2007
15 NAT was not always correctly fixing ICMP headers for errors
17 some TCP state steps when closing do not update timeouts, leading to
18 them being removed prematurely.
20 fix compilation problems for netbsd 4.99
22 protect enumeration of lists in the kernel from callout interrupts on
25 fix various problems with IPv6 header checks: TCP/UDP checksum validation
26 was not being done, fragmentation header parsed dangerously and routing
27 header prevented others from being seen
29 fix gcc 4.2 compiler warnings
31 fix TCP/UDP checksum calculation for IPv6
33 fix reference after free'ing ipftoken memory
35 4.1.22 - Released 13 May 2007
37 fix endless loop when flushing state/NAT by idle time
39 4.1.21 - Released 12 May 2007
41 show the number of states created against a rule with "-v" for ipfstat
43 fix build problems with FreeBSD
45 make it possible to flush the state table by idle time and TCP state
47 fix flushing out idle connections when state/NAT tables fill
49 print out the TCP state population with ipfstat/ipnat
51 stop creation of state table orphans via return-*/fastroute
53 fix printing out of rule groups - they now only appear once
55 4.1.20 - Released 30 April 2007
57 adjust TCP state numbers, making 11 closed (was 0) to better facilitate
58 detecting closing connections that we can wipe out when a SYN arrives
61 make it compile on Solaris10 Update3
63 structures used for ipf command ioctls weren't being freed in timeout
66 use NL_EXPIRE, not ISL_EXPIRE, for expiring NAT sessions
68 adjust TCP timeout values and introduce a time-wait specifc timeout
69 to get a better TCP FSM emulation and one that can hopefully do a better
70 job of cleaning up in a speedy fashion than previous
72 refactor the automatic flushing of TCP state entries when we fill up,
73 but use the same algorithm as before but now it hopefully works
75 only 2 out of 4 interface names were being changed by ipfs when
76 interface renaming was being used for state entries
78 add ipf_proxy_debug to ipf-T
80 matching of last fragments that had a number of bytes that wasn't a
83 some combinations of TCP flags are considered bad aren't picked up as such,
84 but these may be possible with T/TCP
86 4.1.19 - Released 22 February 2007
88 Fix up compilation problems with NetBSD and Solaris.
90 4.1.18 - Released 18 February 2007
92 fix compiling on Tru64
94 fix listing out filter rules with ipfstat (delete token at end of
95 the list and detect zero rule being returned.)
97 fix extended flushing of NAT tables (was clearing out state tables)
99 fix null-pointer deref in hash table lookup
101 fix NAT and stateful filtering with to/reply-to on destination interface
103 4.1.17 - Released 20 January 2007
105 make flushing pools that are still in use mark them for deletion and
106 have attempting to recreate them clear the delete flag
108 walking through the NAT tables with ioctls caused lock recursion
110 fix tracking TCP window scaling in the state code
112 4.1.16 - Released 20 December 2006
114 allow rdr rules to only differ on the new port number
116 when creating state entry orphans, leave them on the linked list but not
117 attached to the hash table and mark them visible as orphans in "ipfstat -sl"
119 log state removed when unloading differently to allow visible cues
121 return ipf ticks via SIOCGETGS for /dev/ipnat so "ipnat -l" can display ttl
123 abort logging a packet if the mbuf pointer is null when ipflog is called
125 Some NetBSD's have a selinfo.h instead of select.h
127 SIOCIPFFL was using copyoutptr and should have been using bcopy for /dev/ipauth
129 listing accounting rules using ioctl interface wasn't possible
131 fix leakage of state entries due to packets not matching up with NAT
133 improve ICMP error packet matching with state/NAT
135 fix problems with parsing and printing "-" as an interface name in ipnat.conf
137 4.1.15 - Released 03 November 2006
139 Add in automatic flushing of NAT, like state, table if it fills up too much
141 Update comments in the code for NAT checksum adjustments
143 Fix compiling on FreeBSD 5.4 and 6.0
145 prevent panics from read/write IOs trying to use uninitialised structures
147 Newer NetBSD should use malloc() instead of MALLOC() in the kernel where
148 the size is not staticly defined
150 Some gcc warning message cleanup from NetBSD
152 Missing include for <sys/filio.h> on Solaris for poll work
154 NetBSD now uses opt_ipfilter.h, not opt_ipfilter_log.h
156 4.1.14 - Released 04 October 2006
158 rewrite checksum alteration for ICMP packets being NAT'd to use a sane
159 algorithm that can be understood...now it needs better comments
161 fix 1 byte error in checksum validation perl script
163 remove unused files in lib directory
165 ipftest will say "bad-packet" if it has been freed rather than just "blocked"
167 make it possible to load IP address pools from external files in ippool.conf
169 update copyright messages in tools directory
171 consolidate ioctl hanlding source code into fil.c
173 make ipfstat, ippool, ipnat retrieve information via ioctls rather than /dev/kmem
175 4.1.13 - Released 4 April 2006
177 fix bug where null pointers introduced by proxies could cause a crash
179 pass out the rule flags with SIOCAUTHW
181 force loading NAT rules with bad proxy labels to cause an error
183 nat_state is used unsafely in calls to fr_addstate
185 make return-rst and return-icmp* work with auth rules
187 4.1.12 - Released 28 March 2006
189 poll support on FreeBSD/NetBSD needs to use selrecord/selwakeup
191 make the fastroute code used by ipftest invoke state/NAT
193 move verbose/debug macros out of fil.c and into ip_fil.h (for wider use)
195 remove unused code in fr_fastroute
197 fix NAT with rules that specify forward and reverise interfaces
199 add missing ipfsync_canread() and ipfsync_canwrite()
201 behaviour of \ on the end of a line in ipf.conf does not match older behaviour
203 remove duplicate statistics line output with "ipfstat -s"
205 4.1.11 - Released 19 March 2006
207 Patch for NAT with ipfsync from N. Ersen (SESCI) - www.enderunix.org
209 NetBSD coverity report fixes (from run 5)
211 Possible to reacquire ipf_auth without releasing it in some circumstances
213 Locking in FreeBSD's iplioctl for ipf_global isn't present like it shoudl be
215 Add poll support for platforms I can build on: NetBSD, FreeBSD, Solaris, Linux
217 Using auth rules to return "keep state" got broken with pushing fr_addstate
218 call into fr_firewall
220 all use of '!' in map/rdr rules to match use in ipf configs
222 add -L command line option to ipmon to set the default syslog facility
224 looking up a port number is more complex than needed in ipft_tx.c
226 allow lib/getport to work when neither tcp or udp are specified in a rule
228 remove some dead code from lib/addicmpc, lib/facpri.c, lib/icmpcode.c
230 program in some more cases where TCP packets fail an initial in-window
231 check but should be allowed to match
233 filter rule added with NAT/state handling of SIOCSTPUT doesn't properly
234 initialise all fields, making it possible to panic
236 simplify NAT ICMP error handling where it updates checksums
238 rename "min" variables to "xmin" on NetBSD to avoid problems with the
241 #ifdef's for NetBSD compile incorrect for pfil interface
243 support select/poll on NetBSD
245 copying out a packet with an auth rule fails (EFAULT) because the wrong
246 pointer is passed to copyoutptr
248 ip_len/ip_off where byte swapped twice instead of once for packets
249 going to be stored on the auth queue
251 change timeout queue manipulation functions to make fewer mutex calls
253 fix use of skip rules with groups
254 fix coding problems discovered by the coverity project for FreeBSD
256 update BPF program validation with FreeBSD changes
258 4.1.10 - Released 6 December 2005
260 Expand regression testing to cover more features
262 Add "coverage" build target for BSD
264 Fix building 64bit sparc target for Solaris
266 Add IPv6 mobility header to list of accepted keywords for V6 headers
268 Resolve locking problems on Solaris when sending RST/icmp packets
270 #ifdef's for IPFILTER_BPF need to check if words are defined before
271 using them in comparisons
273 Add checking for SACK permitted option in TCP SYN packets
275 Fix loading anonymous pools from inline rule configuration groups
277 Add -C command line option to ipftest
279 Include extra "const" from NetBSD
281 Don't require SIOCKSTLCK for SIOCSTPUT
283 Fix some use of "sticky" on NAT rules
285 Fix statistical counting of deleting state for TCP connections
287 Fix compile problems caused by changes to is_opt/is_optmsk in ip_sync.c
289 Fix TCP out-of-window (OOW) problems:
290 - window scaling turned off if one chose for its scale factor
291 - Microsoft Windows TCP sends the "next packet" to the right of the window
292 when using SACK and filling in a hole
294 4.1.9 - Released 13 August 2005
296 make ipfilter fix IPv4 header checksums for outgoing packets if BRIDGE_IPF
297 is defined when compiled.
299 move the definition of SIOCPROXY from ip_nat.h to ip_proxy.h
301 make the BSD/upgrade script more instructive about the requiements for
302 ip_rules.[ch] when it is run
304 register for interface events on FreeBSD (>5.2.1) and NetBSD so that
305 "ipf -y" is not not requried to tell ipfilter about interface changes.
307 for "quick" rules that do "keep state", move the state adding into the rule
308 evaluation so that we can detect it failing as rules are evaluated and
309 continue on to the next rather than wait until we're done and it's too late
310 to recover for more rule processing.
312 mark ICMP packets advertising an MTU that's too small as being bad
314 rework ipv6 header parsing to get better code reuse and fix logic errors
315 in dealing with ipv6 packets containing fragment headers. Also, where a
316 protocol handler was doing both v4 & v6, make a seperate function for each.
318 build for both amd64 and i86pc (32bit) on Solaris10 and later, if possible
320 include start of work to get IPFilter working on AIX 5.3
322 Use FI_ICMPERR flag rather than try to compute its equivalent all the time
324 Rewrork IPv6 extension header parsing to get better code reuse
326 Add missing timeout on Linux
328 Fix for locking when reading from ipsync (Frank Volf)
330 Fix insertion/appending of rules that use a collection number
332 Somehow turning up the spl knob to splnet disappeared on platforms that still
333 use the spl interface.
335 fix problems with "ipf -T" not listing multiple variables properly
337 4.1.8 - Released 29 March 2005
339 include path from Phil Dibowitz for sorting ipfstat -t output by source or
342 fix a bug in printing rules where interface names could not be printed,
343 even if they're in the rule structure.
345 fix BSD/kupgrade to correctly change ipfilter lkm Makefile for FreeBSD
347 add 2 new features to SIOCGNATL:
348 - if IPN_FINDFORWARD is set, check if the respective MAP is already
349 present in the outbound table
350 - if IPN_IN is set, search for a matching MAP entry instead of RDR
353 turn off function inlining for freebsd 5.3+
355 UDP doesn't pullup enough data which can sometimes cause a panic.
356 Fix other protocols, as required, where a similar problem may exist.
358 overhaul the timeout queue management, especially that for user defined queues
359 which are now only freed in an orderly manner.
361 4.1.7 - Released 13 March 2005
363 Using the GRE call field is almost impossible because it is unbalanced and
364 both call fields are not present in each v1 header.
366 Fix a problem where it was possible to load duplicate rules into ipf
368 patch from John Wehle to address problems with fastroute on solaris
370 Copying data out for ipf -z failed because it tried to copy out to an address
371 that is a kernel pointer in user space.
373 add "ip" timeout for both NAT & state that's for non-TCP/UDP/ICMP
375 synch up with NetBSD's changes
377 fix problems parsing long lines of text in the ftp proxy where they would not
378 be parsed properly and stop the session from working
380 enhance the PPTP proxy so that it tries to decode messages in the TCP stream
381 so it knows when to create and destroy the state/nat sessions for GRE. There
382 are also 4 new regression tests for it, testing map/rdr rules.
384 impose some limits on the size of data that can be moved with SIOCSTPUT in
385 the NAT code and also prevent a duplicate session entry from being created
388 add a new flag (IPN_FINDFORWARD) to NAT code that can be used with SIOCGNATL
389 to check if it is possible to create an outgoing transparent NAT mapping to
390 compliment the redirect being investigated.
392 Linux requires that the checksums in the IP header get adjusted
394 only resolve unknown interfaces in fr_stinsert, and nuke all interface pointers
395 in SIOCSTPUT to prevent bad data being loaded from userspace.
397 make the byte counting for state correct (was counting data from ICMP packet
400 print out the keyword "frag-body" if the flag is set.
402 fix ipfs loading/restoring NAT sessions
404 patch from Frank to correctly format IP addresses in ipfstat -t output
406 parsing port numbers in ipf/ipnat was confusing as the port number was returned
407 in an int that was also overloaded to be the suceess/failure. instead, change
408 the port using pass by reference and only use the return value for indicating
411 4.1.6 - Released 19 February 2005
413 add a new timeout number to NAT (fr_defnatipage) that is used for all
414 non-TCP/UDP/ICMP protocols - default 60 seconds.
416 buffer leak with bad nat - David Gueluy
418 fix memory leak with state entries created by proxies
420 eliminate copying too much data into a scan buffer
422 allow a trailing protocol name for map rules as well as rdr ones
424 fix bug in parsing of <= and > for NAT rules (two were crossed over)
426 FreeBSD's iplwrite hasn't kept pace with iplread's prototype
428 expand documention on the karma of using "auto" in ipnat map rules
430 add matching on IP protocol to ipnat map rules
432 allow ippool definitions to contain no addresses to start with
434 Linux NAT needs to modify the IP header checksum as it gets called after it
435 has been computed by IP.
437 UDP was missing a pullup for packet header information before examining
440 4.1.5 - Released 9 January 2005
442 all rules were being converted into "dup-to" rules in the kernel
444 fix two ftp proxy problems: 1st, buffer needs to be bigger for fitting in
445 complete RETR/CWD commands, 2nd is () use in 227 messages isn't copied
449 revert ip_off back to network byte order in the ICMP error packet that
452 4.1.4 - Released 9 January 2005
454 force NAT rules to only match ipv4 NAT rules (which all are, currently,
457 include state synchronisation fixes from Frank Volf
459 make the maximum log size for internally buffered log entries accessible
462 redesign start of fr_check() to avoid putting duplicate information in
463 ipfilter about how much data needs to be pulled up for a protocol to be
466 tidy up sending ICMP error messages - some bad inputs could result in
467 data not being freed and/or no error returned.
469 make the maximum size of the log buffer run-time tunable
471 fix bug in parsing TCP header when looking for MSS option that could make
474 change pool lookups that fail to find a match to return "no match"
477 add run-time tunable debugging for proxy support code and FTP proxy.
479 fix state table updates for entries where the first packet as an ICMPv6
482 fix hang when flushing state for v4/v6 and other (v6/v4) entries are present
485 attaching filtering to ipv6 pfil hook wasn't present for solaris
487 don't allow rules with "keep state" and "with oow"
489 move a bunch of userland only code from fil.c to ip_fil.c
491 make fr_coalesce() more resiliant to bad input, just returning an error
492 instead of crashing, making calling it easier in many places
494 When m_pulldown doesn't return NULL, it doesn't necessarily return a pointer
495 to the same mbuf passed in as the first arg.
497 remove fr_unreach and use ENETUNREACH by default.
499 printing out of tag data in ipf rules doesn't match input syntax
501 ipftest(1) man page update
503 ipfs command line option parsing still rejects some valid syntaxes
505 SIGHUP handling by ipmon was not as safe as it could be
507 fix various parsing regressions, including "<thishost>", "tcpudp", ordering
510 patches from Frank Volk: add udp_acktimeout to sysctl list for FreeBSD,
511 ICMP packet length not calculated correctly in send_icmp_err, reply-to
512 not printed by ipfstat, keep state with icmp passing (mtrr)
514 patches for return-rst and return-icmp from Attila Fueloep
515 (lichtscheu@gesindel.org)
517 4.1.3 - Released 18 July 2004
519 do some more fine tuning on NAT checksum adjustments
521 correct IP address byte order in proxy setup for ipsec/pptp
525 fix numerous problems with ipfs operation
527 complete new syntax for ipmon.conf in its parser and update the sample file
529 assign error value consistantly in fastroute code
531 rewrite allocation of mbufs in send_reset/send_icmp_err to better use
532 mbuf clusters and size calculations
534 resolve problem with linux panic'ing because the wrong flag was being
535 passed to skb_clone/skb_alloc
537 enable use of shared/exclusive locks on freebsd5 and above
539 do not rely on m_pkthdr.len to be valid all the time for mbufs on modern BSD
540 and so use mbufchainlen to get the mbuf length instead
542 replace lots of COPYIN/COPYOUT with BCOPYIN/BCOPYOUT where the data is
543 going to be on the stack and not in userland
545 packet buffer pointers were not refreshed & used properly in fr_check()
547 include extra bits for OpenBSD 3.4 & 3.5.
549 fix ipf/ipnat parsing regression problems with v3.4
551 4.1.2 - RELEASED - 27 May 2004
553 add state top for ipv6
555 fix numerous parsing regressions
557 change sample proxies to use SIOCGNATL with the new API
559 allow macro names to contain underscores (_)
561 split the parser into a collection of dictionaries so that keywords do
562 not interfere with resolving hostnames and portnames
564 fix ipfrule LKM loading on freebsd
566 support mapping a fixed range of ports to a single port
568 fix timeout queue use by proxies with private queues
570 handle space-led ftp server replies properly
572 fix timeout queue management
574 fix fastroute, generation of RST & ICMP packets and operation with to/fastroute
576 resolve further linux compatibility problems
578 replace the use of COPYIN with BCOPYIN for platforms that provide ioctl
581 allow flushing of ipv6 rules independant of ipv4 rules
583 correct internal ipv6 checksum calculations
585 if a 'keep state' rule fails to create state, block the packet rather
588 correct all checksums in regression tests and correct NAT code to adjust
593 4.1.1 - RELEASED - 24 March 2004
595 allow new connections with the same port numbers as an existing one
596 in the state table if the creating packet is a SYN
598 timeout values have drifted, incorrectly, from what they were in 3.4
600 FreeBSD - compatibility changes for 5.2
602 don't match on sequence number (as well) for ICMO ECHO/REPLY, just the
603 ICMP Id. field as otherwise thre is a state/NAT entry per packet pair
604 rather than per "flow"
606 fr_cksum() returned the wrong answer for ICMP
609 - get return-rst and return-icmp working
610 - treat the interface name the same as if_xname on BSD
612 adjust expectations for TCP urgent bits based on observed traffic in the
615 openbsd3.4 has ip_len/ip_off in network byte order when ipfilter is called
617 fix flushing of hash pool gorups (ippool -F) as well as displaying them
620 passing of pointers to interface structures wrong for HP-UX/Solaris with
623 Make the solaris boot script able to run on 2.5.1
625 ippool related files missing from Solaris packages
627 The name /dev/ippool should be /dev/iplookup
629 add regression testing for parsing long interface names in nat rules,
630 along with mssclamp and tags. Also add test for mssclamp operation.
632 ttl displayed for "ipfstat -t" is wrong because ttl is not computed.
634 parse logical interface names (Sun)
636 unloading LKMs was only working if they were enabled.
638 sync'ing up NAT sessions when NICs change should cause NAT rules to
639 re-lookup name->pointer mappings
641 not all of the ippool ioctl's are IOWR and they should be because they
642 use the ipfobj_t for passing information in/out of the kernel. leave the
643 old values defined and handle them, for compatibility.
645 pool stats wrong: ippoolstate used where ipoolstat should be, hash table
646 statistics not reported at all
648 fr_running not set correctly for OpenBSD when compiled into the kernel
650 Allow SIOCGETFF while disabled
652 Fix mssclamp with NAT (pasing and printing of the word, plus wrong bytes
653 altered. How do you say "untested" ?)
655 4.1 - RELEASED - 12 February 2004
657 4.0-BETA1 20 August 2003
659 support 0/32 and 0/0 on the RHS in redirect rules
661 where LHS and RHS netmasks are the same size for redirect, do 1:1 mapping
664 allow NAT rule to match 'all' interfaces with * as interface name
666 do mapping of ICMP sequence id#'s in pings
668 allow default age for NAT entries to be set per NAT rule
670 provide round robin selection of destination addresses for redirect
672 ipmon can load a configuration file with instructions on actions
673 to take when a matching log entry is received
675 now requires pfil to work on Solaris & HP-UX
677 supports mapping outbound connections to a specific address/port
679 support toggling of logging per ipfilter 'device'
681 use queues to expire data rather than lists
687 support rules with dynamic ip addresses
689 add ability to define a pool of addresses & networks which can then
690 be placed in a single rule
692 support passing entire packet back to user program for authentication
694 support master/slave for state information sharing
696 reorganise generic code into a lib directory and make libipf.a
698 user programs enforce version matching with the kernel
700 supports window scaling if seen at TCP session setup
702 generates C code from filter rules to compile in or load as native
705 supports loading rules comprised of BPF bytecode statements
707 HP-UX 11 port completed
709 and packets-per-second filtering
711 add numerical tags to rules for filtering and display in ipmon output
713 3.4.4 23/05/2000 - Released
715 don't add TCP state if it is an RST packet and (attempt) to send out
716 RST/ICMP packets in a manner that bypasses IP Filter.
718 add patch to work with 4.0_STABLE delayed checksums
720 3.4.3 20/05/2000 - Released
724 don't truncate IPv6 packets on Solaris
726 fix keep state for ICMP ECHO
728 add some NAT stats and use def_nat_age rather than DEF_NAT_AGE
730 don't make ftp proxy drop packets
732 use MCLISREFERENCED() in tandem with M_EXT to check if IP fields need to be
735 fix up RST generation for non-Solaris
737 get "short" flag right for IPv6
739 3.4.2 - 10/5/2000 - Released
741 Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun
743 ignore previous NAT mappings for 0/0 and 0/32 rules
745 bring in a completely new ftp proxy
747 allow NAT to cause packets to be dropped.
749 add NetBSD callout support for 1.4-current
751 3.4.1 - 30/4/2000 - Released
753 add ratoui() and fix parsing of group numbers to allow 0 - UINT_MAX
755 don't include opt_inet6.h for FreeBSD if KLD_MODULE is defined
757 Solaris must use copyin() for all types of ioctl() args
759 fix up screen/tty when leaving "top mode" of ipfstat
761 linked list for maptable not setup correctly in nat_hostmap()
763 check for maptable rather than nat_table[1] to see if malloc for maptable
764 succeeded in nat_init
766 fix handling of map NAT rules with "from/to" host specs
768 fix printout out of source address when using "from/to" with map rules
770 convert ip_len back to network byte order, not plen, for solaris as ip_len
771 may have been changed by NAT and plen won't reflect this
773 3.4 - 27/4/2000 - Released
775 source address spoofing can be turned on (fr_chksrc) without using
778 group numbers are now 32bits in size, up from 16bits
780 IPv6 filtering available
782 add frank volf's state-top patches
784 add load splitting and round-robin attribute to redirect rules
786 FreeBSD-4.0 support (including KLD)
788 add top-style operation mode for ipfstat (-t)
790 add save/restore of IP Filter state/NAT information (ipfs)
792 further ftp proxy security checks
794 support for adding and removing proxies at runtime
796 3.3.13 26/04/2000 - Released
798 Fix parsing of "range" with "portmap"
800 Relax checking of ftp replies, slightly.
802 Fix NAT timeouts for ICMP packets
804 SunOS4 patches for ICMP redirects from Jurgen Keil (jk@tools.de)
806 3.3.12 16/03/2000 - Released
808 tighten up ftp proxy behaviour. sigh. yuck. hate.
810 fix bug in range check for NAT where the last IP# was not used.
812 fix problem with icmp codes > 127 in filter rules caused bad things to
813 happen and in particular, where #18 caused the rule to be printed
816 fix bug with the spl level not being reset when returning EIO from
817 iplioctl due to ipfilter not being initialized yet.
819 3.3.11 04/03/2000 - Released
821 make "or-block" work with lines that start with "log"
823 fix up parsing and printing of rules with syslog levels in them
825 fix from Cy Schubert for calling of apr_fini only if non-null
828 3.3.10 24/02/2000 - Released
830 * fix back from guido for state tracking interfaces
832 * update for NetBSD pfil interface changes
834 * if attaching fails and we can abort, then cleanup when doing so.
837 * solaris.c (fr_precheck): After calling freemsg on mt, set it point to *mp.
838 * ipf.c (packetlogon): use flag to store the return value from get_flags.
839 * ipmon.c (init_tabs): General cleanup so we do not have to cast
840 an int s->s_port to u_int port and try to check if the u_int port
843 3.3.9 15/02/2000 - Released
845 fix scheduling of bad locking in fr_addstate() used when we attach onto
848 fix up ip_statesync() with storing interface names in ipstate_t
850 fix fr_running for LKM's - Eugene Polovnikov
852 junk using pullupmsg() for solaris - it's next to useless for what we
853 need to do here anyway - and implement what we require.
855 don't call fr_delstate() in fr_checkstate(), when compiled for a user
856 program, early but when we're finished with it (got fr & pass)
858 ipnat(5) fix from Guido
860 on solaris2, copy message and use that with filter if there is another
861 copy if it being used (db_ref > 1). bad for performance, but better
862 than causing a crash.
864 patch for solaris8-fcs compile from Casper Dik
866 3.3.8 01/02/2000 - Released
868 fix state handling of SYN packets.
870 add parsing recognition of extra icmp types/codes and fix handling of
871 icmp time stamps and mask requests - Frank volf
873 3.3.7 25/01/2000 - Released
875 sync on state information as well as NAT information when required
877 record nat protocol in all nat log records
879 don't reuse the IP# from an active NAT session if the IP# in the rule
880 has changed dynamically.
882 lookup the protocol for NAT log information in ipmon and pass that to
885 fix the bug with changing the outbound interface of a packet where it
886 would lead to a panic.
888 use fr_running instead of ipl_inited. (sysctl name change on freebsd)
890 return EIO if someone attempts an ioctl on state/nat if ipfilter is not
893 fix rule insertion bug
895 make state flushing clean anything that's not fully established (4/4)
897 call fr_state_flush() after we've released ipf_state so we don't generate
898 a recursive mutex acquisition panic
900 fix parsing of icmp code after return-icmp/return-icmp-as-dest and add
901 some patches to enhance parsing strength
903 3.3.6 28/12/1999 - Released
905 add in missing rwlock release in fr_checkicmpmatchingstate() and fix check
906 for ICMP_ECHO to only be for packet, not state entry which we don't have yet.
908 handle SIOCIPFFB in nat_ioctl() and fr_state_ioctl()
910 fix size of friostat for SunOS4
912 fix bug in running off the end of a buffer in real audio proxy
914 3.3.5 11/12/1999 - Released
916 fix parsing of "log level" and printing it back out too
918 <net/if_types.h> is only present on Solaris2.6/7/8
920 use send_icmp_err rather than icmp_error to send back a frag-needed error
923 do not use -b with add_drv on Solaris unless $BASEDIR is set.
925 fix problem where source address in icmp replies is reversed
927 fix yet another problem with real audio.
929 3.3.4 4/12/1999 - Released
931 fix up the real audio proxy to properly setup state information and NAT
932 entries, thanks to Laine Stump for testing/advice/fixes.
934 fix ipfr_fastroute to set dst->sin_addr (Sean Farley - appears to prevent
935 FreeBSD 3.3 from panic'ing) as this had been removed in prior hacks to this
938 fix kinstall for BSDI
940 support ICMP errors being allowed through for ICMP packets going out with
943 support hardware checksumming (gigabit ethernet cards) on Solaris thanks to
944 Tel.Net Media for providing hardware for testing.
946 patched from Frank Volf for ipmon (ICMP & fragmented packets) and allowing
947 ICMP responses to ICMP packets in the keep state table.
949 add in patches for hardware checksumming under solaris
951 Solaris install scripts now use $BASEDIR as appropriate.
955 fix "ipf -y" on solaris so that it rescans rules also for changes in
958 let ipmon become a daemon with -D if it is using syslog
960 fix parsing of return-icmp-as-dest(foo)
962 add reference to ipfstat -g to ipfstat.8
964 ipf_mutex needs to be declared for irix in ip_fil.c
966 3.3.3 22/10/1999 - Released
968 add -g command line option to ipfstat to show groups still define.
970 fix problem with fragment table not recording rule pointer when called
971 from state functions (fin_fr not set).
973 fixup fastroute problems with keep state rules.
975 load rules into inactive set first, so we don't disable things like NIS
976 lookups half way through processing - found by Kevin Littlejohn
978 fix handling of unaligned ip pointer for solaris
980 patch for fr_newauth from Rudi Sluijtman
982 fixed htons() bug in fr_tcpsum() where ip_p wasn't cast to u_short
984 3.3.2 23/09/1999 - Released
986 patches from Scott Presnell to fix rcmd proxy
988 patches from Greg to fix Solaris detachment of interfaces
990 add openbsd compatibility fixes
992 fix free'ing already freed memory in ipfr_slowtimer()
994 fix for deferencing invalid memory in cleaning up after a device disappears
996 3.3.1 14/8/1999 - Released
998 remove include file sys/user.h for irix
1000 prevent people from running buildsunos directly
1002 fix up some problems with the saving of rule pointers so that NAT saves
1003 that information in case it should need to call fr_addstate() from a proxy.
1005 fix up scanning for the end of FTP messages
1007 don't remove /etc/opt/ipf in postremove
1009 attempt to prevent people running buildsolaris script without doing a
1012 fix timeout losing on freebsd3
1014 3.3 7/8/1999 - Released
1016 NAT: information (rules, mappings) are stored in hash tables; setup some
1017 basic NAT regression testing.
1019 display version name of installed kernel code when initializing.
1021 add -V command line option to ipf, showing version (program and kernel
1022 module) as well as the run-status of the kernel code.
1024 fix problem with "log" rules actually affecting result of filtering.
1026 automatically use SUNWspro if available and on a 64bit Solaris system for
1029 add kernel proxies for rcmd(3) and RealAudio (PNA)
1031 use timeout/untimeout on SunOS4/BSD platforms too rather than hijacking
1034 fix IP headers generated through parsing of text information
1036 fix NAT rules to be in the correct order again.
1038 make keep-state work with to/fastroute keywords and enforce usage of those
1041 update keep-state code with new algorithm from Guido
1043 add FreeBSD-3 support
1045 add return-icmp-as-dest option to retrun an ICMP packet using the original
1046 destination as the source rather than a local IP address
1048 add "level [facility.]<priority>" option to filter language
1050 add changes from Guido to state code.
1052 add code to return EPERM if the device is opened for writing and we're
1053 in securelevel 2 or greater.
1055 authentication code patches from Guido
1057 fix real audio proxy
1059 fix ipmon rule printing of interfaces and add IN/OUT to the end of ipmon
1062 fix bimap rules with hash tables
1064 update addresses used in NAT mappings for 0/32 rules for any protocol but TCP
1065 if it changes on the interface - check every ip_natexpire()
1067 add redirect regression test
1069 count buckets used in the state hash table.
1071 fix sending of RST's with return-rst to use the ack number provided in
1072 the packet being replied to in addition to the sequence number.
1074 fix to compile as a 64bit application on solaris7-64bit
1076 add NAT IP mapping to ranges of IP addresses that aren't CIDR specified
1078 fix calculation of in_space parameter for NAT
1080 fix `wrapping' when incrementing the next ip address for use in NAT
1082 fix free'ing of kernel memory in ip_natunload on solaris
1084 fix -l/-U command line options from interfering with each other
1086 fix fastroute under solaris2 and cleanup compilation for solaris7
1088 add install scripts and compile cleanly on BSD/OS 4.0
1090 safely open files in /tmp for writing device output when testing.
1092 fix uninitialized pointer bug in NAT
1094 fix SIOCZRLST (zero list rule stats) bug with groups
1096 change some usage of u_short to u_int in function calling
1098 fix compilation for Solaris7 (SUNWspro)
1100 change solaris makefiles to build for either sparc or i386 rather than
1101 per-cpu (sun4u, etc).
1105 add patches from George Michaelson for FreeBSD 3.0
1107 add patch from Guido to provide ICMP checking for known state in the same
1108 manner as is done for NAT.
1110 enable FTP PASV proxying and enable wildcarding in NAT/state code for ports
1111 for better PORT/PASV support with FTP.
1113 bring into main tree static nat features: map-block and "auto" portmapping.
1115 add in source host filtering for redirects (alan jones)
1117 3.2.10 22/11/98 - Released
1119 3.2.10beta9 17/11/98 - Released
1121 fix fr_tcpsum problems in handling mbufs with an odd number of bytes
1122 and/or split across an mbuf boundary
1124 fix NAT list entry comparisons and allow multiple entries for the same
1125 proxy (but on different ports).
1127 don't create duplicate NAT entries for repeated PORT commands.
1129 3.2.10beta8 14/11/98 - Released
1131 always exit an rwlock before expecting to enter it again on solaris
1133 fix loop in nat_new for pre-existing nat
1135 don't setup state for an ftp connection if creating nat fails.
1137 3.2.10beta7 05/11/98 - Released
1139 set fake window in ipft_tx.c to ensure code passes tests.
1141 cleaned up/enhanced ipnat -l/ipnat -lv output
1143 fixed NAT handling of non-TCP/UDP packets, esp. for ICMP errors returned.
1145 Solaris recusive mutex on icmp-error/tcp-reset - requires rwlock's rather
1148 3.2.10beta6 03/11/98 - Released
1150 fix mixed use of krwlock_t and kmutex_t on Solaris2
1152 fix FTP proxy back up, splitting pasv code out of port code.
1154 3.2.10beta5 02/11/98 - Released
1156 fixed port translation in ICMP reply handling
1158 3.2.10beta4 01/11/98 - Released
1160 increase useful statistic collection on solaris
1162 filter DL_UNITDATA_REQ as well as DL_UNITDATA_IND on solaris
1164 disable PASV reply translation for now
1166 fail with an error if we try to load a NAT rule with a non-existant
1169 fix portmap usage with 0/0 and 0/32 map rules
1171 remove ap_unload/ap_expire - automatically done when NAT is cleaned up
1173 print "STATE:CLOSED" from ipmon if the connection progresses past established
1174 rather than "STATE:EXPIRED"
1176 3.2.10beta3 26/10/98 - Released
1178 fixed traceroute/nat problem
1180 rewrote nat/proxy interface
1182 ipnat now lists associated proxy sessions for each NAT where applicable
1184 3.2.10beta2 13/10/98 - Released
1186 use KRWLOCK_T in place of krwlock_t for solaris as well as irix
1188 disable use of read-write lock acquisition by default
1190 add in mb_t for linux, non-kernel
1192 some changes to progress compilation on linux with glibc
1194 change PASV as well as PORT when passed through kernel ftp proxy.
1196 don't allow window to become 0 in tcp state code
1198 make ipmon compile cleaner
1202 3.2.10beta 11/09/98 - Released
1204 stop fr_tcpsum() thinking it has run out of data when it hasn't.
1206 stop solaris panics due to fin_dp being something wild.
1208 revisit usage of ATOMIC_*()
1210 log closing state of TCP connection in "keep state"
1212 fix fake-arp table code for ipsend.
1214 ipmon now writes pid to a file.
1216 fix "ipmon -a" to actually activate all logging devices.
1218 add patches for BSDOS4.
1220 perl scripts for log analysis donated.
1222 3.2.9 22/06/98 - Released
1224 fix byte order for ICMP packets generated on Solaris
1226 fix some locking problems.
1228 fix malloc bug in NAT (introduced in 3.2.8).
1230 patch from guido for state connections that get fragmented
1232 3.2.8 08/06/98 - Released
1234 use readers/writers locks in Solaris2 in place of some mutexes.
1236 Solaris2 installation enhancements - Martin Forssen (maf@carlstedt.se)
1238 3.2.7 24/05/98 - Released
1240 u_long -> u_32_t conversions
1242 patches from Bernd Ernesti for NetBSD
1244 fixup ipmon to actually handle HUP's.
1246 Linux fixes from Michael H. Warfield (mhw@wittsend.com)
1248 update for keep state patch (not security related) - Guido
1250 dumphex() uses stdout rather than log
1252 3.2.6 18/05/98 - Released
1254 fix potential security loop hole in keep state code.
1258 3.2.5 09/05/98 - Released
1260 BSD/OS 3.1 .o files added for the kernel.
1262 fix sequence # skew vs window size check.
1264 fix minimum ICMP header size check.
1266 remove references to Cybersource.
1268 fix my email address.
1270 remove ntohl in ipnat - Thomas Tornblom
1272 3.2.4 09/04/98 - Released
1274 add script to make devices for /dev on BSD boxes
1276 fixup building into the kernel for FreeBSD 2.2.5
1278 add -D command line option to ipmon to make it a daemon and SIGHUP causes
1279 it to close and reopen the logfile
1281 fixup make clean and make package for SunOS5 - Marc Boucher
1283 postinstall keeps adding "minor=ipf ipl" - George Ross <gdmr@dcs.ed.ac.uk>
1285 protected by IP Filter gif - Sergey Solyanik <solik@atom.ru>
1287 3.2.3 10/11/97 - Released
1289 fix some iplang bugs
1291 fix tcp checksum data overrun, sgi #define changes,
1292 avoid infinite loop when nat'ing to single IP# - Marc Boucher
1294 fixup DEVFS usage for FreeBSD
1296 fix sunos5 "make clean" cleaning up too much
1298 3.2.2 28/11/97 - Released
1300 change packet matching to return actual error, if bad packet, to facilitate
1303 allow ip:netmask in grammar too now - Guido
1305 assume IRIX has u_int32_t in sys/types.h (needed for R10000)
1307 rewrite parts of command line options for ipmon
1309 fix TCP urgent packet & offset testing and add LAND attack test for iptest
1311 fix grammar error in yacc grammar for iplang
1313 redirect (rdr) destination port bytes-wapped when it shouldn't be.
1315 general: fr_check now returns error code, such as EHOSTUNREACH or
1316 ECONNRESET (attempt to make ECONNRESET work for locally outbound
1319 linux: enable return-rst, need to filter tcp retransmits which are sent
1320 separately from normal packets
1322 memory leak plugged in ip_proxy.c
1324 BSDI compatibility patches from Guido
1326 tcp checksum fix - Marc Boucher
1328 recursive mutex and ioctl param fix - Marc Boucher
1330 3.2.1 12/11/97 - Released
1334 port to Linux 2.0.31
1336 patches to make "map a/m -> 0/0" work with ftp proxying properly - Marc Boucher
1338 add "ipf -F s" and "ipf -F S" to flush state table entries.
1340 announce if logging is on or off when ip filter initializes.
1342 "ipf -F a" doesn't flush groups properly for Solaris.
1344 3.2 30/10/97 - Released
1346 ipnat doesn't successfully remove proxy mappings with "-rf" -
1349 use K&R C function style for solaris kernel code
1351 use m_adj() to decrease packet size in ftp proxy
1353 use mbufchainlen rather than msgdsize,
1354 IRIX update - Marc Boucher
1356 fix NetBSD modunload bug (pfil_add_hook done twice)
1358 patches for OpenBSD 2.1 - Craig Bevins <craigb@bitcom.net.au>
1360 3.2beta10 24/10/97 - Released
1362 fix fragment table entries allocated for NAT.
1364 fix tcp checksum calculations over mbuf/mblk boundaries
1366 fix panic for blen < 0 in ftp kernel proxy - marc boucher
1368 fix flushing of rules which have been grouped.
1370 3.2beta9 20/10/97 - Released
1372 some nit picking on solaris2 with SUNWspro - Michael Lyle <mrl@rpnet.net>
1374 ftp kernel proxy patches from Marc Boucher
1376 3.2beta8 13/10/97 - Released
1378 add support for passing ICMP errors back through NAT.
1380 IRIX port update - Marc Boucher
1382 calculate correct MIN size of packet to log for UDP - Marc Boucher
1384 need htons(ETHERTYPE_x) on little endian BSD boxes - Dave Huang
1386 copyright header fixups
1388 3.2beta7 23/09/97 - Released
1390 fickup problems introduced by prior merges & changes.
1392 3.2beta6 23/09/97 - Released
1394 patch for spin-reading race condition - Marc Boucher.
1396 IRIX port by Marc Boucher.
1398 compatibility updates for Linux to ipsend
1400 3.2beta5 13/09/97 - Released
1402 patches from Bernd Ernesti for NetBSD integration (mostly prototyping and
1403 compiler warning things)
1405 ipf -y will resync IP#'s allocated with 0/32 in NAT to match interface if it
1408 update manual pages and other documentation updates.
1410 3.2beta4 27/8/97 - Released
1412 enable setting IP and TCP options for iplang/
1414 Solaris2 patches from Marc Boucher.
1416 add groups for filter rules.
1418 3.2beta3 21/8/97 - Released
1420 patches for Solaris2 (interface panic solution ?): fix FIONREAD and
1421 replacing q_qinfo points - Marc Boucher <marc@CAM.ORG>
1423 change ipsend/* and ipsd/* copyright notices to be the same as ip filter's
1425 patch for SYN-ACK skew testing fix from Eric V. Smith <EricSmith@windsor.com>
1427 3.2beta2 6/8/97 - Released
1429 make it load on Solaris 2.3
1431 rewrote logging to remove solaris errors, introduced checking to see if the
1432 same packet is logged successively.
1434 fix filter cache to work when there are no rules loaded.
1436 add "raw" option to ipresend to send entire ethernet frames.
1438 nat list corruption bug - NetBSD - Klaus Klein
1440 3.2beta1 5/7/97 - Released
1442 patches from Jason Thorpe fixing: UNSIGNED_CHAR lossage, off_t being 64bits
1443 lossage, and other NetBSD bits.
1447 fixup fwtk patches and add protocol field for SIOCGNATL.
1449 rdr bugs reported by Alexander Romanyu (alexr@aix.krid.crimea.ua), with
1451 * rdr matched all packets of a given protocol (ignored ports).
1452 * severe bug in nat_delete which caused system crash/freeze.
1454 change Makefile so that CC isn't passed on for FreeBSD/NetBSD (will use
1455 the default CC - cc, not gcc)
1457 3.2alpha9 16/6/97 - Released
1459 added "skip" keyword.
1461 implement preauthentication of packets, as outlined by Guido.
1463 Make it compile as cleanly as possible with -Wall & general code cleanup
1465 getopt returns int, not char. Bernd Ernesti
1467 3.2alpha8 13/6/97 - Released
1469 code added to support "auth" rules which require a user program to allow them
1470 through. First revision and much of the code came from Guido.
1472 hex output from ipmon doesn't goto syslog when recovering from out of sync
1473 error. Luke Mewburn (lukem@connect.com.au)
1475 fix solaris2.6 lookup of destination ire's.
1477 ipnat doesn't throw away unused bits (after masking), causing it to
1478 behave incorrectly. Carson Gaspar
1480 NAT code doesn't include inteface name when matching - Alexey Mavrin
1483 replace old SunOS tcpip.h with new tcpip.h (from 4.4BSD) - Jason Thorpe.
1485 update install procedures to include ip_proxy.c
1487 mask out unused bits in NAT/RDR rules.
1489 use a generic type (u_32_t) for 32bit variables, rather than rely on
1490 u_long being such - Jason Thorpe.
1492 create a local "netinet" directory and include from ~netinet/*" rather than
1493 just "*" to make keeping the code working on ports easier.
1495 add an m_copydata and m_copyback for SunOS4 (based on 4.4BSD-Lite versions)
1497 documentation updates.
1499 NetBSD update from Jason Thorpe <thorpej@netbsd.org>
1501 allow RST's through with a matching SEQ # and 0 ACK. Guido Van Rooij
1503 ipmon uses excessive amounts of CPU on Solaris2 - Reinhard Bertram
1504 <Reinhard.Bertram@KOM.th-darmstadt.de>
1506 3.2alpha7 25/5/97 - Released
1508 add strlen for pre-2.2 kernels - Doug Kite <dkite@websgi.icomnet.com>
1510 setup bits and pieces for compiling into a FreeBSD-2.2 kernel.
1512 split up "bsd" targets. Now a separate netbsd/freebsd/bsd target.
1513 mln_ipl.c has been split up into itself and mlf_ipl.c (for freebsd).
1515 fix (negative) host matching in filtering.
1517 add sysctl interface for some variables when compiled into FreeBSD-2.2 kernels
1520 make all the candidates for kernel compiling include "netinet/..." and build
1521 a subdirectory "netinet" when compiling and symlink all .h files into this.
1523 add install make target to Makefile.ipsend
1525 3.2alpha6 8/5/97 - Released
1527 Add "!" (not) to hostname/ip matching.
1529 Automatically add packet info to the fragment cache if it is a fragment
1530 and we're translating addreses for.
1532 Automatically add packet info to the fragment cache if it is a fragment
1533 and we're "keeping state" for the packet.
1535 Solaris2 patches - Anthony Baxter (arb@connect.com.au)
1537 change install procedure for FreeBSD 2.2 to allow building to a kernel
1538 which is different to the running kernel.
1540 add FIONREAD for Solaris2!
1542 when expiring NAT table entries, if we would set a time to fr_tcpclosed
1543 (which is 1), make it fr_tcplaskack(20) so that the state tables have a
1548 add proxying skeleton support and sample ftp transparent proxy code.
1550 add printfs at startup to tell user what is happening.
1552 add packets & bytes for EXPIRE NAT log records.
1554 fix the "install-bsd" target in the root Makefile. Chris Williams
1557 Fixes for FreeBSD 2.2 (and later revs) to prevent panics. Julian Assange.
1559 3.2alpha4 2/4/97 - Released
1561 Some compiler warnings cleaned up.
1563 FreeBSD-2.2 patches for LKM completed.
1565 3.2alpha3 31/3/97 - Released
1567 ipmon changes: -N for reading NAT logfile, -S for reading state logfile.
1568 -a for reading all. -n now toggles hostname resolution.
1570 Add logging of new state entries and expiration of old state entries.
1571 count log successes and failures.
1573 Add logging of new NAT entries and expiration of old NAT entries.
1574 count log successes and failures.
1576 Use u_quad_t for records of bytes & packets where kept
1577 (IP Accounting: fr_hits, fr_bytes; IP state: is_pkts, is_bytes).
1579 Fixup use of CPU and DCPU in Makefiles.
1581 Fix broken 0/32 NAT mapping. Carl Makin <cmakin@nla.gov.au>
1585 Implement mapping to 0/32 as being an alias for automatically using the
1586 interface's first IP address.
1588 Implement separate minor devices for both NAT and IP state code.
1590 Fully prototype all functions.
1592 Fix Makefile problem due to attempt to fix Sun compiling problems.
1594 3.1.10 23/3/97 - Released
1596 ipfstat -a requires a -i or -o command line option too. Print an error
1597 when not present rather than attempt to do something.
1599 patch updates for SunOS4 for kernel compiling.
1600 patch for ipmon -s (flush's syslog file which isn't good). Andrew J. Schorr
1601 <schorr@ead.dsa.com>
1603 too many people hit their heads hard when compiling code into the kernel
1604 that doesn't let any packets through. (fil.c - IPF_NOMATCH)
1606 icmp-type parsing doesn't return any errors when it isn't constructed
1607 correctly. Neil Readwin
1609 Using "-conf" with modload on SunOS4 doesn't work.
1610 Timothy Demarest <demarest@arraycomm.com>
1612 Need to define ARCH in makefile for SunOS4 building. "make sunos4"
1613 in INSTALL.SunOS is incorrect. James R Grinter <jrg@blodwen.demon.co.uk>
1614 [all SunOS targets now run buildsunos]
1616 NAT lookups are still incorrect, matching non-TCP/UDP with TCP/UDP
1617 information. ArkanoiD <ark@paranoid.convey.ru>
1619 Need to check for __FreeBSD_version being 199511 rather than 199607
1620 in mln_ipl.c. Eric Feillant <Eric.Feillant@EUnet.fr>
1622 3.1.9 8/3/97 - Released
1624 fixed incorrect lookup of active NAT entries.
1626 patch for ip_deq() wrong for pre 2.1.6 FreeBSD.
1627 fyeung@fyeung8.netific.com (Francis Yeung)
1629 check for out with return-rst/return-icmp at wrong place - Erkki Ritoniemi
1632 text_readip returns the interface pointer pointing to text on stack -
1635 fix from Pradeep Krishnan for printout rules "with not opt sec".
1637 3.1.8 18/2/97 - Released
1639 Diffs for ip_output.c and ip_input.c updated to fix bug with fastroute and
1640 compiling warnings about reuse of m0.
1642 prevent use of return-rst and return-icmp with rules blocking packets going
1643 out, preventing panics in certain situations.
1645 loop forms in frag cache table - Yury Pshenychny <yura@rd.zgik.zaporizhzhe.ua>
1647 should use SPLNET/SPLX around expire routines in NAT/frag/state code.
1649 redeclared malloc in 44arp.c -
1651 3.1.7 8/2/97 - Released
1653 Macros used for ntohs/htons supplied with gcc don't always work very well
1654 when the assignment is the same variable being converted.
1656 Filter matching doesn't not match rule which checks tcp flags on packets
1657 which are fragments - David Wilson
1659 3.1.7beta 30/1/97 - Released
1661 Fix up NAT bugs introduced in last major change (now tested), including
1662 nat_delete(), nat_lookupredir(), checksum changes, etc.
1664 3.1.7alpha 30/1/97 - Released
1666 Many changes to NAT code, including contributions from Laurent Joncheray
1669 Use "NO_SLEEP" when allocating memory under SunOS.
1671 Make kernel printf's nicer for BSD/SunOS4
1673 Always do a checksum for packets being filtered going out and being
1674 processed by fastroute.
1676 Leave kernel to play with cdevsw on *BSD systems with LKM's.
1678 ipnat.1 man page fixes.
1680 3.1.6 21/1/97 - Released
1682 Allow NAT to work on BSD systems in conjunction with "pass .. to ifname"
1684 Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried
1685 to free memory twice.
1687 NAT recalculates IP header checksum based on difference between IP#'s and
1688 port numbers - should be just IP#'s (Solaris2 only)
1690 3.1.5 13/1/97 - Released
1692 fixed setting of NAT timeouts and use different timeouts for concurrent
1693 TCP sessions using the same IP# mapping (when port mapping isn't used)
1695 multiple loading/unloading of LKM's doesn't clean up cdevsw properly for
1698 3.1.4 10/1/97 - Released
1700 add command line options -C and -F to ipnat to flush NAT list and table
1702 ipnat -l loops on output - Neil Readwin (nreadwin@nysales.micrognosis.com)
1704 NetBSD/FreeBSD kernel malloc changes - Daniel Carosone
1706 3.1.3 10/1/97 - Released
1708 NAT chains not constructed correctly in hash tables - Antony Y.R Lu
1709 (antony@hawk.ee.ncku.edu.tw)
1711 Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2
1713 man page update (ipf.5) from Daniel Carosone (dan@geek.com.au)
1715 ICMP header checksum update now included in NAT.
1717 Solaris2 needs to modify IP header checksums in ip_natin and ip_natout.
1719 3.1.2 4/12/96 - Released
1721 ipmon doesn't use syslog all the time when given -s option
1723 fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro
1725 check the results of hostname resolution in ipnat
1727 "make *install" fixed for subdirectories.
1729 problems with "ARCH:=" and gnu make resolved
1731 parser reports an error for lines with whitespaces only rather than skipping
1732 them. D.Carosone@abm.com.au (Daniel Carosone)
1734 patches for integration into NetBSD-current (post 1.2).
1736 add an option to allow non-IP packets going up/down the stream on Solaris2
1737 to be dropped. John Bass.
1739 3.1.2beta 21/11/96 - Released
1741 make ipsend compile on Linux 2.0.24
1743 changes to TCP kept state algorithm, making it watch state on TCP
1744 connections in both directions. Also use the same algorithm for NAT TCP.
1746 -Wall cleanup - Bernd Ernesti
1748 added "or-block" for "pass .. log or-block" after a suggestion from
1749 David Oppenheim (davido@optimation.com.au)
1751 added subdirectories for building IP Filter in SunOS5/BSD for different
1754 Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2
1756 mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96
1758 3.1.1 28/10/96 - Released
1760 Installation script fixes and deinstall scripts for IP Filter on:
1761 SunOS4/FreeBSD/NetBSD
1763 Man page fixes - Paul Dubois (dubois@primate.wisc.edu)
1765 Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!)
1767 parsing isn't completely case insensitive - David Wilson
1768 (davidw@optimation.com.au)
1770 Release ipl_mutex across uiomove() calls
1772 print entire rule entries out for "ipf -z" when zero'ing per-rule stats.
1774 ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik
1775 (ts@polynet.lviv.ua)
1777 New algorithm for setting timeouts for TCP connection (more closely follow
1778 TCP FSM) - Pradeep Krishnan (pkrishna@netcom.com)
1780 Track both window sizes for TCP connections through "keep state".
1782 Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel
1785 3.1.1-beta2 6/10/96 - Released
1787 Solaris2 fastroute/dup-to/to now works
1789 ipmon `record' reading rewritten
1791 Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg@eterna.com.au)
1793 Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson
1794 (davidw@optimation.com.au)
1796 Michael Ryan (mike@NetworX.ie) reports the following:
1797 * The Trumpet WinSock under Windows always sends its SYN packet with an ACK
1798 value of 1, unlike any other implementation I've seen, which would set it
1799 to zero. The "keep state" feature of IP Filter doesn't work when receiving
1800 non-zero ACK values on new connection requests.
1801 * */Makefile install rule doesn't install all the binaries/man pages
1802 * Make ipnat use "tcp/udp" instead of "tcpudp"
1803 * Print out "tcp/udp" properly
1804 * ipnat "portmap tcp" matches "portmap udp" when adding/removing
1805 * NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't
1807 3.1.1-beta 1/9/96 - Released
1809 add better detection of TCP connections closing to TCP state monitoring.
1811 fr_addstate() not called correctly for fragments. "keep state" and
1812 "keep frag" code don't work together 100% - Songqing Cai
1813 (songqing_cai@sterling.com)
1815 call to fr_addstate() incorrect for adding state in combination with keeping
1816 fragment information - Songqing Cai (songqing_cai@sterling.com)
1818 KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood
1819 (cgull@smoke.marlboro.vt.us)
1821 make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban
1824 3.1.1-alpha 23/8/96 - Released
1826 kernel panic's when ICMP packets go through NAT code
1828 stats aren't zero'd properly with ipf -Z
1830 ipnat doesn't show port numbers correctly all the time and also add the
1831 protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com)
1833 fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com)
1835 NetBSD-1.2 patches from - VaX#n8 <vax@linkdead.paranoia.com>
1837 Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu)
1839 ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall
1840 (nrh@tardis.ed.ac.uk)
1842 3.1.0 7/7/96 - Released
1844 Reformatted ipnat output to be compatible with it's input, so that
1845 "ipnat -l | ipnat -rf -" is possible.
1847 3.1.0beta 30/6/96 - Released
1849 NetBSD-1.2 patches from Greg Woods (woods@most.weird.com)
1851 kernel module must not be installed stripped (Solaris2), as created by
1852 "make package" for Solaris2 - Peter Heimann
1853 (peter@i3.informatik.rwth-aachen.de)
1855 3.1.0alpha 5/6/96 - Released
1857 include examples in package for solaris2
1859 patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS)
1861 removed trailing space from printouts of rules in ipf.
1863 ipresend supports the same range of inputs that ipftest does.
1865 sending a duplicate copy of a packet to another network devices is now
1866 supported. ("dup-to")
1868 sending a packet to an arbitary interface is now supported, irrespective
1869 of its actual route, with no ttl decrement. Can also be routed without
1870 the ttl being decremented. ("to" and "fastroute").
1872 "call" option added to support calling a generic function if a packet is
1875 show all (upto 4) recorded bytes from the interface name in logging from
1878 support for using unix file permissions for read/write access on the device
1881 recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per@stibo.dk>
1883 ipftest doesn't call initparse() for THISHOST - Catherine Allen
1884 (cla@connect.com.au)
1886 Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au)
1888 3.0.4 10/4/96 - Released
1890 looop in `parsing' IP packets with optlen 0 for ip options.
1892 rule number not initialized and resulted in unexpected results for state
1895 option parsing and printing bugs - Pradeep Krishnan
1897 3.0.4beta 25/3/96 - Released
1899 wouldn't parse "keep flags keep state" correctly.
1901 SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon
1903 patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems
1904 from Thorsten Lockert <tholo@tetherless.com>
1906 b* functions in fil.c on Solaris 2.4
1908 3.0.3 17/3/96 - Released
1910 added patches to support IP Filter initialisation when compiled into the
1913 added -x option to ipmon to display hex dumps of logged packets.
1915 added -H option to ipftest to allow ascii-hex formatted input to specify
1916 arbitary IP packets.
1918 Sending TCP RSTs as a response now work for Solaris2 x86
1920 add patches to make IP Filter compile into NetBSD kernels properly.
1922 patch to stop SunOS 4.1.x kernels panicing with "data traps".
1924 ipfboot script unloads and reloads ipf module on Solaris2 if it is already
1925 loaded into the kernel.
1927 Installation of IP Filter as a Solaris2 package is now supported.
1929 Man pages for ipnat.4, ipnat.5 added.
1931 added some more regression tests and fixed up IP Filter to pass the new tests
1932 (previous versions failed some of the tests in set 12).
1934 IP option filter processing has changed so that saying "with opt lsrr" will
1935 check only for that one, but not mask out other options, so a packet with
1936 strict source routing, along with loose source routing will match all of
1937 "with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr".
1939 IPL_NAME needed in ipnat.c - Kelly (kelly@count04.mry.scruznet.com)
1941 patches for clean NetBSD compilation from Bernd Ernesti (bernd@arresum.inka.de)
1943 make install is incorrect - Julian Briggs (julian@lightwork.co.uk)
1945 strtol() returns 0x7fffffff for all negative numbers,
1946 printfr() generates incorrect output for "opt sec-class *",
1947 handling of "not opt xxx opt yyy" incorrect.
1948 - Minh Tonthat (minht@sbei.com)/Pradeep Krishnan (pradeepk@sbei.com)
1950 m_pullup() called only for input and not output; caused problems
1951 with filtering icmp - Nigel Verdon (verdenn@gb.swissbank.com)
1953 parsing problem for "port 1" and NetBSD patches incorrect -
1954 Andreas Gustafsson (gson@guava.araneus.fi)
1956 3.0.2 4/2/96 - Released
1958 Corrected bug where NAT recalculates checksums for fragments.
1960 make NAT recalculate UDP checksums (rather than setting them to 0),
1961 if they're non-zero.
1963 DNS patches - Real Page (Real.Page@Matrox.com)
1965 alteration of checksum recalculations in NAT code and addition of
1966 redirection with NAT - Mike Neuman
1968 core dump, if tcp/udp is used with a port number and not service name,
1969 in ipf - Mike Neuman (mcn@engarde.com)
1971 initparse() call, missing to prime "<thishost>" hook - Craig Bishop
1973 3.0.1 14/1/96 - Released
1975 miscellaneous patches for Solaris2
1977 3.0 14/1/96 - Released
1979 Patch included for FDDI, from Richard Ohnemus
1980 (Richard_Ohnemus@dallas.csd.sterling.com)
1982 Code cleanup for release.
1986 recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop
1988 recursive mutex in sending TCP RSTs fixed, reported by Tony Becker
1992 FIxup for Solaris2.5 install and interface name bug in ipftest from
1993 Julian Briggs (julian@lightwork.co.uk)
1995 Byte order patches for ipmon from Tony Becker (tony@mcrsys.com)
1999 Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD.
2000 Note, this isn't really what one would call IP account, when compared to
2001 process accounting, sigh.
2003 Split up ipresend into iptest/ipresend/ipsend
2005 Added another m_pullup() inside fr_check() for BSD style kernels and
2006 added some checks to ipllog() to not log more than is present (for short
2009 Fixed bug where failed hostname/netname resolution goes undetecte and
2010 becomes 0.0.0.0 (any) (reported Guido van Rooij)
2012 3.0beta 11/11/95 - Released
2014 Rewrote the way rule testing is done, reducing the number of files needed and
2017 SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green)
2019 Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3
2020 BSD based Unixes (panic'd)
2022 Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku@tequila.nixu.fi>
2023 (I think someone else already told me about these but they got lost :-/)
2025 Changed Makefile structure to build object files for different operating
2026 systems in separate directories by default.
2028 BSDI has ef0 for first ethernet interface
2030 Allow for a "not" operator before optional keywords.
2032 The "rule number" was being incorrectly incremented every time it went through
2033 the loop rather than when it matched a rule.
2035 2.8.2 24/10/95 - Released
2037 Fixed up problems with "textip" for doing lots of testing.
2039 Fixed bug in detection of "short" tcp/ip packets (all reported as being short).
2041 Solaris 2.4 port now works 100%.
2043 Man page errors reported and fixed.
2045 Removed duplicate entry in etc/services for login on port 49 (Craig Bishop).
2047 Fixed ipmon output to put a space after the log-letter.
2049 Patch from Guido van Rooij to fix parsing problem.
2051 2.8.1 15/10/95 - Released
2053 Added ttl and tos filtering.
2055 Patches for fixing up compilation and port problems (little endian)
2056 from Guido van Rooij <guido@IAEhv.nl>.
2058 Man page problems reported and fixed by Carson Gaspar <carson@lehman.com>.
2060 ipsend doesn't compile properly on Solaris2.4
2062 Lots of work done for Solaris2.4 to make it MT/MP safe and work.
2064 2.8 15/9/95 - Released
2066 ipmon can now send messages to syslogd (-s) and use names instead of
2069 IP packets are now "compiled" into a structure only containing filterable
2072 Added regression testing in the test/ subdirectory, using a new option
2073 (-b) with the ipftest program.
2075 Added "nomatch" return to filter results. These are counted and show
2076 up in reports from ipfstat.
2078 Moved filter code out of ip_fil.c and into fil.c - there is now only one
2079 instance of it in the package.
2081 Added Solaris 2.4 support.
2083 Added IPSO basic security option filtering.
2085 Added name support for filtering on all 19 named IP options.
2087 Patches from Ivan Brawley to log packet contents as well as packet headers.
2089 Update for sun/conf.c.diff from Ivan Brawley <ibrawley@awadi.com.AU>
2091 Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf,
2092 along with a new ioctl, SIOCFRENB.
2093 From: Dieter Dworkin Muller <dworkin@village.org>
2095 2.7.3 31/7.95 - Released
2097 Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green).
2099 ipftest now deals with tcpdump3 binary output files (from libpcap) with -P.
2101 Brought ipftest program upto date with actual filter code.
2103 Filter would cause a match to occur when it wasn't meant to if the packet
2104 had short headers and was missing portions that should have been there.
2105 Err, it would rightly not match on them, but their absence caused a match
2106 when it shouldn't have been.
2108 2.7.2 26/7/95 - Released
2110 Problem with filtering just SYN flagged packets reported by
2111 Dieter Dworkin Muller <dworkin@village.org>. To solve this
2112 problem, added support for masking TCP flags for comparison "flags X/Y".
2114 2.7.1 9/7/95 - Released
2116 Added ip_dirbroadcast support for Sun ip_input.c
2118 Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are
2121 2.7 7/7/95 - Released
2123 Added "return-rst" to return TCP RST's to TCP packets.
2125 Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now.
2127 Added insertion of filter rules. Use "@<#>" at the beginning of a filter
2128 to insert a rule at row #.
2130 Filter keeps track of how many times each rule is matched.
2132 Changed compile time things to match kernel option (IPFILTER_LKM &
2135 Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP.
2136 (No change required for 3.6)
2138 Now includes TCP fragments which start inside the TCP header as being short.
2139 Added counting the number of times each rule is matched.
2142 2.6 11/5/95 - Released
2144 Added -n option to ipf: when supplied, no changes are made to the kernel.
2146 Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI.
2148 Rewrote filtering to use a more generic mask & match procedure for
2149 checking if a packet matches a rule.
2151 2.5.2 27/4/95 - Released
2153 "tcp/udp" and a non-initialised pointer caused the "proto" to become
2154 a `random' value; added "ip#/dotted.mask" notation to the BNF.
2155 From Adam W. Feigin <feigin@iis.ee.ethz.ch>
2157 2.5.1 22/3/95 - Released
2159 "tcp/udp" had a strange effect (undesired) on getserv*() functions,
2160 causing protocol/service lookups to fail. Reported by Matthew Green.
2162 2.5 17/3/95 - Released
2164 Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop
2165 output through the ipftest program. Suggestions from:
2166 Michael Ciavarella (mikec@phyto.apana.org.au)
2168 Conflicts occur when "general" filter rules are used for ports and the
2169 lack of a "proto" when used with "port" matches other packets when only
2170 TCP/UDP are implied.
2171 Reported Matthew Green (mrg@fulcom.com.au);
2172 reported & fixed 6-8/3/95
2174 Added filtering of short TCP packets using "with short" 28/2/95
2175 (These can possibly slip by checks for the various flags). Short UDP
2176 or ICMP are dropped to the floor and logged.
2178 Added filtering of fragmented packets using "with frag" 24/2/95
2180 Port to NetBSD-current completed 20/2/95, using LKM.
2182 Added logging of the rule # which caused the logging to happen and the
2183 interface on which the packet is currently as suggested by
2184 Andreas Greulich (greulich@math-stat.unibe.ch) 10/2/95
2186 2.4 9/2/95 - Released
2187 Fixed saving of IP headers in ICMP packets.
2190 Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL).
2191 Fixed iplread() and iplsave() with help from Marc Huber.
2193 2.2 7/1/95 - Released
2194 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
2195 its own major char number dynamically when modload'ing. Fixed up
2196 use of <, >, <=, >= and >< for ports.
2198 2.1 21/12/94 - Released
2199 repackaged to include the correct ip_output.c and ip_input.c *goof*
2201 2.0 18/12/94 - Released
2202 added code to check for port ranges - complete.
2203 rewrote to work as a loadable kernel module - complete.
2206 added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers.
2208 1.0 22/04/93 - Released