2 # NOTE: Quite a few patches and suggestions come from other sources, to whom
3 # I'm greatly indebted, even if no names are mentioned.
5 # Thanks to the Coombs Computing Unit at the ANU for their continued support
6 # in providing a very available location for the IP Filter home page and
9 # Thanks also to all those who have contributed patches and other code,
10 # and especially those who have found the time to port IP Filter to new
13 4.1.10 - Released 6 December 2005
15 Expand regression testing to cover more features
17 Add "coverage" build target for BSD
19 Fix building 64bit sparc target for Solaris
21 Add IPv6 mobility header to list of accepted keywords for V6 headers
23 Resolve locking problems on Solaris when sending RST/icmp packets
25 #ifdef's for IPFILTER_BPF need to check if words are defined before
26 using them in comparisons
28 Add checking for SACK permitted option in TCP SYN packets
30 Fix loading anonymous pools from inline rule configuration groups
32 Add -C command line option to ipftest
34 Include extra "const" from NetBSD
36 Don't require SIOCKSTLCK for SIOCSTPUT
38 Fix some use of "sticky" on NAT rules
40 Fix statistical counting of deleting state for TCP connections
42 Fix compile problems caused by changes to is_opt/is_optmsk in ip_sync.c
44 Fix TCP out-of-window (OOW) problems:
45 - window scaling turned off if one chose for its scale factor
46 - Microsoft Windows TCP sends the "next packet" to the right of the window
47 when using SACK and filling in a hole
49 4.1.9 - Released 13 August 2005
51 make ipfilter fix IPv4 header checksums for outgoing packets if BRIDGE_IPF
52 is defined when compiled.
54 move the definition of SIOCPROXY from ip_nat.h to ip_proxy.h
56 make the BSD/upgrade script more instructive about the requiements for
57 ip_rules.[ch] when it is run
59 register for interface events on FreeBSD (>5.2.1) and NetBSD so that
60 "ipf -y" is not not requried to tell ipfilter about interface changes.
62 for "quick" rules that do "keep state", move the state adding into the rule
63 evaluation so that we can detect it failing as rules are evaluated and
64 continue on to the next rather than wait until we're done and it's too late
65 to recover for more rule processing.
67 mark ICMP packets advertising an MTU that's too small as being bad
69 rework ipv6 header parsing to get better code reuse and fix logic errors
70 in dealing with ipv6 packets containing fragment headers. Also, where a
71 protocol handler was doing both v4 & v6, make a seperate function for each.
73 build for both amd64 and i86pc (32bit) on Solaris10 and later, if possible
75 include start of work to get IPFilter working on AIX 5.3
77 Use FI_ICMPERR flag rather than try to compute its equivalent all the time
79 Rewrork IPv6 extension header parsing to get better code reuse
81 Add missing timeout on Linux
83 Fix for locking when reading from ipsync (Frank Volf)
85 Fix insertion/appending of rules that use a collection number
87 Somehow turning up the spl knob to splnet disappeared on platforms that still
88 use the spl interface.
90 fix problems with "ipf -T" not listing multiple variables properly
92 4.1.8 - Released 29 March 2005
94 include path from Phil Dibowitz for sorting ipfstat -t output by source or
97 fix a bug in printing rules where interface names could not be printed,
98 even if they're in the rule structure.
100 fix BSD/kupgrade to correctly change ipfilter lkm Makefile for FreeBSD
102 add 2 new features to SIOCGNATL:
103 - if IPN_FINDFORWARD is set, check if the respective MAP is already
104 present in the outbound table
105 - if IPN_IN is set, search for a matching MAP entry instead of RDR
108 turn off function inlining for freebsd 5.3+
110 UDP doesn't pullup enough data which can sometimes cause a panic.
111 Fix other protocols, as required, where a similar problem may exist.
113 overhaul the timeout queue management, especially that for user defined queues
114 which are now only freed in an orderly manner.
116 4.1.7 - Released 13 March 2005
118 Using the GRE call field is almost impossible because it is unbalanced and
119 both call fields are not present in each v1 header.
121 Fix a problem where it was possible to load duplicate rules into ipf
123 patch from John Wehle to address problems with fastroute on solaris
125 Copying data out for ipf -z failed because it tried to copy out to an address
126 that is a kernel pointer in user space.
128 add "ip" timeout for both NAT & state that's for non-TCP/UDP/ICMP
130 synch up with NetBSD's changes
132 fix problems parsing long lines of text in the ftp proxy where they would not
133 be parsed properly and stop the session from working
135 enhance the PPTP proxy so that it tries to decode messages in the TCP stream
136 so it knows when to create and destroy the state/nat sessions for GRE. There
137 are also 4 new regression tests for it, testing map/rdr rules.
139 impose some limits on the size of data that can be moved with SIOCSTPUT in
140 the NAT code and also prevent a duplicate session entry from being created
143 add a new flag (IPN_FINDFORWARD) to NAT code that can be used with SIOCGNATL
144 to check if it is possible to create an outgoing transparent NAT mapping to
145 compliment the redirect being investigated.
147 Linux requires that the checksums in the IP header get adjusted
149 only resolve unknown interfaces in fr_stinsert, and nuke all interface pointers
150 in SIOCSTPUT to prevent bad data being loaded from userspace.
152 make the byte counting for state correct (was counting data from ICMP packet
155 print out the keyword "frag-body" if the flag is set.
157 fix ipfs loading/restoring NAT sessions
159 patch from Frank to correctly format IP addresses in ipfstat -t output
161 parsing port numbers in ipf/ipnat was confusing as the port number was returned
162 in an int that was also overloaded to be the suceess/failure. instead, change
163 the port using pass by reference and only use the return value for indicating
166 4.1.6 - Released 19 February 2005
168 add a new timeout number to NAT (fr_defnatipage) that is used for all
169 non-TCP/UDP/ICMP protocols - default 60 seconds.
171 buffer leak with bad nat - David Gueluy
173 fix memory leak with state entries created by proxies
175 eliminate copying too much data into a scan buffer
177 allow a trailing protocol name for map rules as well as rdr ones
179 fix bug in parsing of <= and > for NAT rules (two were crossed over)
181 FreeBSD's iplwrite hasn't kept pace with iplread's prototype
183 expand documention on the karma of using "auto" in ipnat map rules
185 add matching on IP protocol to ipnat map rules
187 allow ippool definitions to contain no addresses to start with
189 Linux NAT needs to modify the IP header checksum as it gets called after it
190 has been computed by IP.
192 UDP was missing a pullup for packet header information before examining
195 4.1.5 - Released 9 January 2005
197 all rules were being converted into "dup-to" rules in the kernel
199 fix two ftp proxy problems: 1st, buffer needs to be bigger for fitting in
200 complete RETR/CWD commands, 2nd is () use in 227 messages isn't copied
204 revert ip_off back to network byte order in the ICMP error packet that
207 4.1.4 - Released 9 January 2005
209 force NAT rules to only match ipv4 NAT rules (which all are, currently,
212 include state synchronisation fixes from Frank Volf
214 make the maximum log size for internally buffered log entries accessible
217 redesign start of fr_check() to avoid putting duplicate information in
218 ipfilter about how much data needs to be pulled up for a protocol to be
221 tidy up sending ICMP error messages - some bad inputs could result in
222 data not being freed and/or no error returned.
224 make the maximum size of the log buffer run-time tunable
226 fix bug in parsing TCP header when looking for MSS option that could make
229 change pool lookups that fail to find a match to return "no match"
232 add run-time tunable debugging for proxy support code and FTP proxy.
234 fix state table updates for entries where the first packet as an ICMPv6
237 fix hang when flushing state for v4/v6 and other (v6/v4) entries are present
240 attaching filtering to ipv6 pfil hook wasn't present for solaris
242 don't allow rules with "keep state" and "with oow"
244 move a bunch of userland only code from fil.c to ip_fil.c
246 make fr_coalesce() more resiliant to bad input, just returning an error
247 instead of crashing, making calling it easier in many places
249 When m_pulldown doesn't return NULL, it doesn't necessarily return a pointer
250 to the same mbuf passed in as the first arg.
252 remove fr_unreach and use ENETUNREACH by default.
254 printing out of tag data in ipf rules doesn't match input syntax
256 ipftest(1) man page update
258 ipfs command line option parsing still rejects some valid syntaxes
260 SIGHUP handling by ipmon was not as safe as it could be
262 fix various parsing regressions, including "<thishost>", "tcpudp", ordering
265 patches from Frank Volk: add udp_acktimeout to sysctl list for FreeBSD,
266 ICMP packet length not calculated correctly in send_icmp_err, reply-to
267 not printed by ipfstat, keep state with icmp passing (mtrr)
269 patches for return-rst and return-icmp from Attila Fueloep
270 (lichtscheu@gesindel.org)
272 4.1.3 - Released 18 July 2004
274 do some more fine tuning on NAT checksum adjustments
276 correct IP address byte order in proxy setup for ipsec/pptp
280 fix numerous problems with ipfs operation
282 complete new syntax for ipmon.conf in its parser and update the sample file
284 assign error value consistantly in fastroute code
286 rewrite allocation of mbufs in send_reset/send_icmp_err to better use
287 mbuf clusters and size calculations
289 resolve problem with linux panic'ing because the wrong flag was being
290 passed to skb_clone/skb_alloc
292 enable use of shared/exclusive locks on freebsd5 and above
294 do not rely on m_pkthdr.len to be valid all the time for mbufs on modern BSD
295 and so use mbufchainlen to get the mbuf length instead
297 replace lots of COPYIN/COPYOUT with BCOPYIN/BCOPYOUT where the data is
298 going to be on the stack and not in userland
300 packet buffer pointers were not refreshed & used properly in fr_check()
302 include extra bits for OpenBSD 3.4 & 3.5.
304 fix ipf/ipnat parsing regression problems with v3.4
306 4.1.2 - RELEASED - 27 May 2004
308 add state top for ipv6
310 fix numerous parsing regressions
312 change sample proxies to use SIOCGNATL with the new API
314 allow macro names to contain underscores (_)
316 split the parser into a collection of dictionaries so that keywords do
317 not interfere with resolving hostnames and portnames
319 fix ipfrule LKM loading on freebsd
321 support mapping a fixed range of ports to a single port
323 fix timeout queue use by proxies with private queues
325 handle space-led ftp server replies properly
327 fix timeout queue management
329 fix fastroute, generation of RST & ICMP packets and operation with to/fastroute
331 resolve further linux compatibility problems
333 replace the use of COPYIN with BCOPYIN for platforms that provide ioctl
336 allow flushing of ipv6 rules independant of ipv4 rules
338 correct internal ipv6 checksum calculations
340 if a 'keep state' rule fails to create state, block the packet rather
343 correct all checksums in regression tests and correct NAT code to adjust
348 4.1.1 - RELEASED - 24 March 2004
350 allow new connections with the same port numbers as an existing one
351 in the state table if the creating packet is a SYN
353 timeout values have drifted, incorrectly, from what they were in 3.4
355 FreeBSD - compatibility changes for 5.2
357 don't match on sequence number (as well) for ICMO ECHO/REPLY, just the
358 ICMP Id. field as otherwise thre is a state/NAT entry per packet pair
359 rather than per "flow"
361 fr_cksum() returned the wrong answer for ICMP
364 - get return-rst and return-icmp working
365 - treat the interface name the same as if_xname on BSD
367 adjust expectations for TCP urgent bits based on observed traffic in the
370 openbsd3.4 has ip_len/ip_off in network byte order when ipfilter is called
372 fix flushing of hash pool gorups (ippool -F) as well as displaying them
375 passing of pointers to interface structures wrong for HP-UX/Solaris with
378 Make the solaris boot script able to run on 2.5.1
380 ippool related files missing from Solaris packages
382 The name /dev/ippool should be /dev/iplookup
384 add regression testing for parsing long interface names in nat rules,
385 along with mssclamp and tags. Also add test for mssclamp operation.
387 ttl displayed for "ipfstat -t" is wrong because ttl is not computed.
389 parse logical interface names (Sun)
391 unloading LKMs was only working if they were enabled.
393 sync'ing up NAT sessions when NICs change should cause NAT rules to
394 re-lookup name->pointer mappings
396 not all of the ippool ioctl's are IOWR and they should be because they
397 use the ipfobj_t for passing information in/out of the kernel. leave the
398 old values defined and handle them, for compatibility.
400 pool stats wrong: ippoolstate used where ipoolstat should be, hash table
401 statistics not reported at all
403 fr_running not set correctly for OpenBSD when compiled into the kernel
405 Allow SIOCGETFF while disabled
407 Fix mssclamp with NAT (pasing and printing of the word, plus wrong bytes
408 altered. How do you say "untested" ?)
410 4.1 - RELEASED - 12 February 2004
412 4.0-BETA1 20 August 2003
414 support 0/32 and 0/0 on the RHS in redirect rules
416 where LHS and RHS netmasks are the same size for redirect, do 1:1 mapping
419 allow NAT rule to match 'all' interfaces with * as interface name
421 do mapping of ICMP sequence id#'s in pings
423 allow default age for NAT entries to be set per NAT rule
425 provide round robin selection of destination addresses for redirect
427 ipmon can load a configuration file with instructions on actions
428 to take when a matching log entry is received
430 now requires pfil to work on Solaris & HP-UX
432 supports mapping outbound connections to a specific address/port
434 support toggling of logging per ipfilter 'device'
436 use queues to expire data rather than lists
442 support rules with dynamic ip addresses
444 add ability to define a pool of addresses & networks which can then
445 be placed in a single rule
447 support passing entire packet back to user program for authentication
449 support master/slave for state information sharing
451 reorganise generic code into a lib directory and make libipf.a
453 user programs enforce version matching with the kernel
455 supports window scaling if seen at TCP session setup
457 generates C code from filter rules to compile in or load as native
460 supports loading rules comprised of BPF bytecode statements
462 HP-UX 11 port completed
464 and packets-per-second filtering
466 add numerical tags to rules for filtering and display in ipmon output
468 3.4.4 23/05/2000 - Released
470 don't add TCP state if it is an RST packet and (attempt) to send out
471 RST/ICMP packets in a manner that bypasses IP Filter.
473 add patch to work with 4.0_STABLE delayed checksums
475 3.4.3 20/05/2000 - Released
479 don't truncate IPv6 packets on Solaris
481 fix keep state for ICMP ECHO
483 add some NAT stats and use def_nat_age rather than DEF_NAT_AGE
485 don't make ftp proxy drop packets
487 use MCLISREFERENCED() in tandem with M_EXT to check if IP fields need to be
490 fix up RST generation for non-Solaris
492 get "short" flag right for IPv6
494 3.4.2 - 10/5/2000 - Released
496 Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun
498 ignore previous NAT mappings for 0/0 and 0/32 rules
500 bring in a completely new ftp proxy
502 allow NAT to cause packets to be dropped.
504 add NetBSD callout support for 1.4-current
506 3.4.1 - 30/4/2000 - Released
508 add ratoui() and fix parsing of group numbers to allow 0 - UINT_MAX
510 don't include opt_inet6.h for FreeBSD if KLD_MODULE is defined
512 Solaris must use copyin() for all types of ioctl() args
514 fix up screen/tty when leaving "top mode" of ipfstat
516 linked list for maptable not setup correctly in nat_hostmap()
518 check for maptable rather than nat_table[1] to see if malloc for maptable
519 succeeded in nat_init
521 fix handling of map NAT rules with "from/to" host specs
523 fix printout out of source address when using "from/to" with map rules
525 convert ip_len back to network byte order, not plen, for solaris as ip_len
526 may have been changed by NAT and plen won't reflect this
528 3.4 - 27/4/2000 - Released
530 source address spoofing can be turned on (fr_chksrc) without using
533 group numbers are now 32bits in size, up from 16bits
535 IPv6 filtering available
537 add frank volf's state-top patches
539 add load splitting and round-robin attribute to redirect rules
541 FreeBSD-4.0 support (including KLD)
543 add top-style operation mode for ipfstat (-t)
545 add save/restore of IP Filter state/NAT information (ipfs)
547 further ftp proxy security checks
549 support for adding and removing proxies at runtime
551 3.3.13 26/04/2000 - Released
553 Fix parsing of "range" with "portmap"
555 Relax checking of ftp replies, slightly.
557 Fix NAT timeouts for ICMP packets
559 SunOS4 patches for ICMP redirects from Jurgen Keil (jk@tools.de)
561 3.3.12 16/03/2000 - Released
563 tighten up ftp proxy behaviour. sigh. yuck. hate.
565 fix bug in range check for NAT where the last IP# was not used.
567 fix problem with icmp codes > 127 in filter rules caused bad things to
568 happen and in particular, where #18 caused the rule to be printed
571 fix bug with the spl level not being reset when returning EIO from
572 iplioctl due to ipfilter not being initialized yet.
574 3.3.11 04/03/2000 - Released
576 make "or-block" work with lines that start with "log"
578 fix up parsing and printing of rules with syslog levels in them
580 fix from Cy Schubert for calling of apr_fini only if non-null
583 3.3.10 24/02/2000 - Released
585 * fix back from guido for state tracking interfaces
587 * update for NetBSD pfil interface changes
589 * if attaching fails and we can abort, then cleanup when doing so.
592 * solaris.c (fr_precheck): After calling freemsg on mt, set it point to *mp.
593 * ipf.c (packetlogon): use flag to store the return value from get_flags.
594 * ipmon.c (init_tabs): General cleanup so we do not have to cast
595 an int s->s_port to u_int port and try to check if the u_int port
598 3.3.9 15/02/2000 - Released
600 fix scheduling of bad locking in fr_addstate() used when we attach onto
603 fix up ip_statesync() with storing interface names in ipstate_t
605 fix fr_running for LKM's - Eugene Polovnikov
607 junk using pullupmsg() for solaris - it's next to useless for what we
608 need to do here anyway - and implement what we require.
610 don't call fr_delstate() in fr_checkstate(), when compiled for a user
611 program, early but when we're finished with it (got fr & pass)
613 ipnat(5) fix from Guido
615 on solaris2, copy message and use that with filter if there is another
616 copy if it being used (db_ref > 1). bad for performance, but better
617 than causing a crash.
619 patch for solaris8-fcs compile from Casper Dik
621 3.3.8 01/02/2000 - Released
623 fix state handling of SYN packets.
625 add parsing recognition of extra icmp types/codes and fix handling of
626 icmp time stamps and mask requests - Frank volf
628 3.3.7 25/01/2000 - Released
630 sync on state information as well as NAT information when required
632 record nat protocol in all nat log records
634 don't reuse the IP# from an active NAT session if the IP# in the rule
635 has changed dynamically.
637 lookup the protocol for NAT log information in ipmon and pass that to
640 fix the bug with changing the outbound interface of a packet where it
641 would lead to a panic.
643 use fr_running instead of ipl_inited. (sysctl name change on freebsd)
645 return EIO if someone attempts an ioctl on state/nat if ipfilter is not
648 fix rule insertion bug
650 make state flushing clean anything that's not fully established (4/4)
652 call fr_state_flush() after we've released ipf_state so we don't generate
653 a recursive mutex acquisition panic
655 fix parsing of icmp code after return-icmp/return-icmp-as-dest and add
656 some patches to enhance parsing strength
658 3.3.6 28/12/1999 - Released
660 add in missing rwlock release in fr_checkicmpmatchingstate() and fix check
661 for ICMP_ECHO to only be for packet, not state entry which we don't have yet.
663 handle SIOCIPFFB in nat_ioctl() and fr_state_ioctl()
665 fix size of friostat for SunOS4
667 fix bug in running off the end of a buffer in real audio proxy
669 3.3.5 11/12/1999 - Released
671 fix parsing of "log level" and printing it back out too
673 <net/if_types.h> is only present on Solaris2.6/7/8
675 use send_icmp_err rather than icmp_error to send back a frag-needed error
678 do not use -b with add_drv on Solaris unless $BASEDIR is set.
680 fix problem where source address in icmp replies is reversed
682 fix yet another problem with real audio.
684 3.3.4 4/12/1999 - Released
686 fix up the real audio proxy to properly setup state information and NAT
687 entries, thanks to Laine Stump for testing/advice/fixes.
689 fix ipfr_fastroute to set dst->sin_addr (Sean Farley - appears to prevent
690 FreeBSD 3.3 from panic'ing) as this had been removed in prior hacks to this
693 fix kinstall for BSDI
695 support ICMP errors being allowed through for ICMP packets going out with
698 support hardware checksumming (gigabit ethernet cards) on Solaris thanks to
699 Tel.Net Media for providing hardware for testing.
701 patched from Frank Volf for ipmon (ICMP & fragmented packets) and allowing
702 ICMP responses to ICMP packets in the keep state table.
704 add in patches for hardware checksumming under solaris
706 Solaris install scripts now use $BASEDIR as appropriate.
710 fix "ipf -y" on solaris so that it rescans rules also for changes in
713 let ipmon become a daemon with -D if it is using syslog
715 fix parsing of return-icmp-as-dest(foo)
717 add reference to ipfstat -g to ipfstat.8
719 ipf_mutex needs to be declared for irix in ip_fil.c
721 3.3.3 22/10/1999 - Released
723 add -g command line option to ipfstat to show groups still define.
725 fix problem with fragment table not recording rule pointer when called
726 from state functions (fin_fr not set).
728 fixup fastroute problems with keep state rules.
730 load rules into inactive set first, so we don't disable things like NIS
731 lookups half way through processing - found by Kevin Littlejohn
733 fix handling of unaligned ip pointer for solaris
735 patch for fr_newauth from Rudi Sluijtman
737 fixed htons() bug in fr_tcpsum() where ip_p wasn't cast to u_short
739 3.3.2 23/09/1999 - Released
741 patches from Scott Presnell to fix rcmd proxy
743 patches from Greg to fix Solaris detachment of interfaces
745 add openbsd compatibility fixes
747 fix free'ing already freed memory in ipfr_slowtimer()
749 fix for deferencing invalid memory in cleaning up after a device disappears
751 3.3.1 14/8/1999 - Released
753 remove include file sys/user.h for irix
755 prevent people from running buildsunos directly
757 fix up some problems with the saving of rule pointers so that NAT saves
758 that information in case it should need to call fr_addstate() from a proxy.
760 fix up scanning for the end of FTP messages
762 don't remove /etc/opt/ipf in postremove
764 attempt to prevent people running buildsolaris script without doing a
767 fix timeout losing on freebsd3
769 3.3 7/8/1999 - Released
771 NAT: information (rules, mappings) are stored in hash tables; setup some
772 basic NAT regression testing.
774 display version name of installed kernel code when initializing.
776 add -V command line option to ipf, showing version (program and kernel
777 module) as well as the run-status of the kernel code.
779 fix problem with "log" rules actually affecting result of filtering.
781 automatically use SUNWspro if available and on a 64bit Solaris system for
784 add kernel proxies for rcmd(3) and RealAudio (PNA)
786 use timeout/untimeout on SunOS4/BSD platforms too rather than hijacking
789 fix IP headers generated through parsing of text information
791 fix NAT rules to be in the correct order again.
793 make keep-state work with to/fastroute keywords and enforce usage of those
796 update keep-state code with new algorithm from Guido
798 add FreeBSD-3 support
800 add return-icmp-as-dest option to retrun an ICMP packet using the original
801 destination as the source rather than a local IP address
803 add "level [facility.]<priority>" option to filter language
805 add changes from Guido to state code.
807 add code to return EPERM if the device is opened for writing and we're
808 in securelevel 2 or greater.
810 authentication code patches from Guido
814 fix ipmon rule printing of interfaces and add IN/OUT to the end of ipmon
817 fix bimap rules with hash tables
819 update addresses used in NAT mappings for 0/32 rules for any protocol but TCP
820 if it changes on the interface - check every ip_natexpire()
822 add redirect regression test
824 count buckets used in the state hash table.
826 fix sending of RST's with return-rst to use the ack number provided in
827 the packet being replied to in addition to the sequence number.
829 fix to compile as a 64bit application on solaris7-64bit
831 add NAT IP mapping to ranges of IP addresses that aren't CIDR specified
833 fix calculation of in_space parameter for NAT
835 fix `wrapping' when incrementing the next ip address for use in NAT
837 fix free'ing of kernel memory in ip_natunload on solaris
839 fix -l/-U command line options from interfering with each other
841 fix fastroute under solaris2 and cleanup compilation for solaris7
843 add install scripts and compile cleanly on BSD/OS 4.0
845 safely open files in /tmp for writing device output when testing.
847 fix uninitialized pointer bug in NAT
849 fix SIOCZRLST (zero list rule stats) bug with groups
851 change some usage of u_short to u_int in function calling
853 fix compilation for Solaris7 (SUNWspro)
855 change solaris makefiles to build for either sparc or i386 rather than
856 per-cpu (sun4u, etc).
860 add patches from George Michaelson for FreeBSD 3.0
862 add patch from Guido to provide ICMP checking for known state in the same
863 manner as is done for NAT.
865 enable FTP PASV proxying and enable wildcarding in NAT/state code for ports
866 for better PORT/PASV support with FTP.
868 bring into main tree static nat features: map-block and "auto" portmapping.
870 add in source host filtering for redirects (alan jones)
872 3.2.10 22/11/98 - Released
874 3.2.10beta9 17/11/98 - Released
876 fix fr_tcpsum problems in handling mbufs with an odd number of bytes
877 and/or split across an mbuf boundary
879 fix NAT list entry comparisons and allow multiple entries for the same
880 proxy (but on different ports).
882 don't create duplicate NAT entries for repeated PORT commands.
884 3.2.10beta8 14/11/98 - Released
886 always exit an rwlock before expecting to enter it again on solaris
888 fix loop in nat_new for pre-existing nat
890 don't setup state for an ftp connection if creating nat fails.
892 3.2.10beta7 05/11/98 - Released
894 set fake window in ipft_tx.c to ensure code passes tests.
896 cleaned up/enhanced ipnat -l/ipnat -lv output
898 fixed NAT handling of non-TCP/UDP packets, esp. for ICMP errors returned.
900 Solaris recusive mutex on icmp-error/tcp-reset - requires rwlock's rather
903 3.2.10beta6 03/11/98 - Released
905 fix mixed use of krwlock_t and kmutex_t on Solaris2
907 fix FTP proxy back up, splitting pasv code out of port code.
909 3.2.10beta5 02/11/98 - Released
911 fixed port translation in ICMP reply handling
913 3.2.10beta4 01/11/98 - Released
915 increase useful statistic collection on solaris
917 filter DL_UNITDATA_REQ as well as DL_UNITDATA_IND on solaris
919 disable PASV reply translation for now
921 fail with an error if we try to load a NAT rule with a non-existant
924 fix portmap usage with 0/0 and 0/32 map rules
926 remove ap_unload/ap_expire - automatically done when NAT is cleaned up
928 print "STATE:CLOSED" from ipmon if the connection progresses past established
929 rather than "STATE:EXPIRED"
931 3.2.10beta3 26/10/98 - Released
933 fixed traceroute/nat problem
935 rewrote nat/proxy interface
937 ipnat now lists associated proxy sessions for each NAT where applicable
939 3.2.10beta2 13/10/98 - Released
941 use KRWLOCK_T in place of krwlock_t for solaris as well as irix
943 disable use of read-write lock acquisition by default
945 add in mb_t for linux, non-kernel
947 some changes to progress compilation on linux with glibc
949 change PASV as well as PORT when passed through kernel ftp proxy.
951 don't allow window to become 0 in tcp state code
953 make ipmon compile cleaner
957 3.2.10beta 11/09/98 - Released
959 stop fr_tcpsum() thinking it has run out of data when it hasn't.
961 stop solaris panics due to fin_dp being something wild.
963 revisit usage of ATOMIC_*()
965 log closing state of TCP connection in "keep state"
967 fix fake-arp table code for ipsend.
969 ipmon now writes pid to a file.
971 fix "ipmon -a" to actually activate all logging devices.
973 add patches for BSDOS4.
975 perl scripts for log analysis donated.
977 3.2.9 22/06/98 - Released
979 fix byte order for ICMP packets generated on Solaris
981 fix some locking problems.
983 fix malloc bug in NAT (introduced in 3.2.8).
985 patch from guido for state connections that get fragmented
987 3.2.8 08/06/98 - Released
989 use readers/writers locks in Solaris2 in place of some mutexes.
991 Solaris2 installation enhancements - Martin Forssen (maf@carlstedt.se)
993 3.2.7 24/05/98 - Released
995 u_long -> u_32_t conversions
997 patches from Bernd Ernesti for NetBSD
999 fixup ipmon to actually handle HUP's.
1001 Linux fixes from Michael H. Warfield (mhw@wittsend.com)
1003 update for keep state patch (not security related) - Guido
1005 dumphex() uses stdout rather than log
1007 3.2.6 18/05/98 - Released
1009 fix potential security loop hole in keep state code.
1013 3.2.5 09/05/98 - Released
1015 BSD/OS 3.1 .o files added for the kernel.
1017 fix sequence # skew vs window size check.
1019 fix minimum ICMP header size check.
1021 remove references to Cybersource.
1023 fix my email address.
1025 remove ntohl in ipnat - Thomas Tornblom
1027 3.2.4 09/04/98 - Released
1029 add script to make devices for /dev on BSD boxes
1031 fixup building into the kernel for FreeBSD 2.2.5
1033 add -D command line option to ipmon to make it a daemon and SIGHUP causes
1034 it to close and reopen the logfile
1036 fixup make clean and make package for SunOS5 - Marc Boucher
1038 postinstall keeps adding "minor=ipf ipl" - George Ross <gdmr@dcs.ed.ac.uk>
1040 protected by IP Filter gif - Sergey Solyanik <solik@atom.ru>
1042 3.2.3 10/11/97 - Released
1044 fix some iplang bugs
1046 fix tcp checksum data overrun, sgi #define changes,
1047 avoid infinite loop when nat'ing to single IP# - Marc Boucher
1049 fixup DEVFS usage for FreeBSD
1051 fix sunos5 "make clean" cleaning up too much
1053 3.2.2 28/11/97 - Released
1055 change packet matching to return actual error, if bad packet, to facilitate
1058 allow ip:netmask in grammar too now - Guido
1060 assume IRIX has u_int32_t in sys/types.h (needed for R10000)
1062 rewrite parts of command line options for ipmon
1064 fix TCP urgent packet & offset testing and add LAND attack test for iptest
1066 fix grammar error in yacc grammar for iplang
1068 redirect (rdr) destination port bytes-wapped when it shouldn't be.
1070 general: fr_check now returns error code, such as EHOSTUNREACH or
1071 ECONNRESET (attempt to make ECONNRESET work for locally outbound
1074 linux: enable return-rst, need to filter tcp retransmits which are sent
1075 separately from normal packets
1077 memory leak plugged in ip_proxy.c
1079 BSDI compatibility patches from Guido
1081 tcp checksum fix - Marc Boucher
1083 recursive mutex and ioctl param fix - Marc Boucher
1085 3.2.1 12/11/97 - Released
1089 port to Linux 2.0.31
1091 patches to make "map a/m -> 0/0" work with ftp proxying properly - Marc Boucher
1093 add "ipf -F s" and "ipf -F S" to flush state table entries.
1095 announce if logging is on or off when ip filter initializes.
1097 "ipf -F a" doesn't flush groups properly for Solaris.
1099 3.2 30/10/97 - Released
1101 ipnat doesn't successfully remove proxy mappings with "-rf" -
1104 use K&R C function style for solaris kernel code
1106 use m_adj() to decrease packet size in ftp proxy
1108 use mbufchainlen rather than msgdsize,
1109 IRIX update - Marc Boucher
1111 fix NetBSD modunload bug (pfil_add_hook done twice)
1113 patches for OpenBSD 2.1 - Craig Bevins <craigb@bitcom.net.au>
1115 3.2beta10 24/10/97 - Released
1117 fix fragment table entries allocated for NAT.
1119 fix tcp checksum calculations over mbuf/mblk boundaries
1121 fix panic for blen < 0 in ftp kernel proxy - marc boucher
1123 fix flushing of rules which have been grouped.
1125 3.2beta9 20/10/97 - Released
1127 some nit picking on solaris2 with SUNWspro - Michael Lyle <mrl@rpnet.net>
1129 ftp kernel proxy patches from Marc Boucher
1131 3.2beta8 13/10/97 - Released
1133 add support for passing ICMP errors back through NAT.
1135 IRIX port update - Marc Boucher
1137 calculate correct MIN size of packet to log for UDP - Marc Boucher
1139 need htons(ETHERTYPE_x) on little endian BSD boxes - Dave Huang
1141 copyright header fixups
1143 3.2beta7 23/09/97 - Released
1145 fickup problems introduced by prior merges & changes.
1147 3.2beta6 23/09/97 - Released
1149 patch for spin-reading race condition - Marc Boucher.
1151 IRIX port by Marc Boucher.
1153 compatibility updates for Linux to ipsend
1155 3.2beta5 13/09/97 - Released
1157 patches from Bernd Ernesti for NetBSD integration (mostly prototyping and
1158 compiler warning things)
1160 ipf -y will resync IP#'s allocated with 0/32 in NAT to match interface if it
1163 update manual pages and other documentation updates.
1165 3.2beta4 27/8/97 - Released
1167 enable setting IP and TCP options for iplang/
1169 Solaris2 patches from Marc Boucher.
1171 add groups for filter rules.
1173 3.2beta3 21/8/97 - Released
1175 patches for Solaris2 (interface panic solution ?): fix FIONREAD and
1176 replacing q_qinfo points - Marc Boucher <marc@CAM.ORG>
1178 change ipsend/* and ipsd/* copyright notices to be the same as ip filter's
1180 patch for SYN-ACK skew testing fix from Eric V. Smith <EricSmith@windsor.com>
1182 3.2beta2 6/8/97 - Released
1184 make it load on Solaris 2.3
1186 rewrote logging to remove solaris errors, introduced checking to see if the
1187 same packet is logged successively.
1189 fix filter cache to work when there are no rules loaded.
1191 add "raw" option to ipresend to send entire ethernet frames.
1193 nat list corruption bug - NetBSD - Klaus Klein
1195 3.2beta1 5/7/97 - Released
1197 patches from Jason Thorpe fixing: UNSIGNED_CHAR lossage, off_t being 64bits
1198 lossage, and other NetBSD bits.
1202 fixup fwtk patches and add protocol field for SIOCGNATL.
1204 rdr bugs reported by Alexander Romanyu (alexr@aix.krid.crimea.ua), with
1206 * rdr matched all packets of a given protocol (ignored ports).
1207 * severe bug in nat_delete which caused system crash/freeze.
1209 change Makefile so that CC isn't passed on for FreeBSD/NetBSD (will use
1210 the default CC - cc, not gcc)
1212 3.2alpha9 16/6/97 - Released
1214 added "skip" keyword.
1216 implement preauthentication of packets, as outlined by Guido.
1218 Make it compile as cleanly as possible with -Wall & general code cleanup
1220 getopt returns int, not char. Bernd Ernesti
1222 3.2alpha8 13/6/97 - Released
1224 code added to support "auth" rules which require a user program to allow them
1225 through. First revision and much of the code came from Guido.
1227 hex output from ipmon doesn't goto syslog when recovering from out of sync
1228 error. Luke Mewburn (lukem@connect.com.au)
1230 fix solaris2.6 lookup of destination ire's.
1232 ipnat doesn't throw away unused bits (after masking), causing it to
1233 behave incorrectly. Carson Gaspar
1235 NAT code doesn't include inteface name when matching - Alexey Mavrin
1238 replace old SunOS tcpip.h with new tcpip.h (from 4.4BSD) - Jason Thorpe.
1240 update install procedures to include ip_proxy.c
1242 mask out unused bits in NAT/RDR rules.
1244 use a generic type (u_32_t) for 32bit variables, rather than rely on
1245 u_long being such - Jason Thorpe.
1247 create a local "netinet" directory and include from ~netinet/*" rather than
1248 just "*" to make keeping the code working on ports easier.
1250 add an m_copydata and m_copyback for SunOS4 (based on 4.4BSD-Lite versions)
1252 documentation updates.
1254 NetBSD update from Jason Thorpe <thorpej@netbsd.org>
1256 allow RST's through with a matching SEQ # and 0 ACK. Guido Van Rooij
1258 ipmon uses excessive amounts of CPU on Solaris2 - Reinhard Bertram
1259 <Reinhard.Bertram@KOM.th-darmstadt.de>
1261 3.2alpha7 25/5/97 - Released
1263 add strlen for pre-2.2 kernels - Doug Kite <dkite@websgi.icomnet.com>
1265 setup bits and pieces for compiling into a FreeBSD-2.2 kernel.
1267 split up "bsd" targets. Now a separate netbsd/freebsd/bsd target.
1268 mln_ipl.c has been split up into itself and mlf_ipl.c (for freebsd).
1270 fix (negative) host matching in filtering.
1272 add sysctl interface for some variables when compiled into FreeBSD-2.2 kernels
1275 make all the candidates for kernel compiling include "netinet/..." and build
1276 a subdirectory "netinet" when compiling and symlink all .h files into this.
1278 add install make target to Makefile.ipsend
1280 3.2alpha6 8/5/97 - Released
1282 Add "!" (not) to hostname/ip matching.
1284 Automatically add packet info to the fragment cache if it is a fragment
1285 and we're translating addreses for.
1287 Automatically add packet info to the fragment cache if it is a fragment
1288 and we're "keeping state" for the packet.
1290 Solaris2 patches - Anthony Baxter (arb@connect.com.au)
1292 change install procedure for FreeBSD 2.2 to allow building to a kernel
1293 which is different to the running kernel.
1295 add FIONREAD for Solaris2!
1297 when expiring NAT table entries, if we would set a time to fr_tcpclosed
1298 (which is 1), make it fr_tcplaskack(20) so that the state tables have a
1303 add proxying skeleton support and sample ftp transparent proxy code.
1305 add printfs at startup to tell user what is happening.
1307 add packets & bytes for EXPIRE NAT log records.
1309 fix the "install-bsd" target in the root Makefile. Chris Williams
1312 Fixes for FreeBSD 2.2 (and later revs) to prevent panics. Julian Assange.
1314 3.2alpha4 2/4/97 - Released
1316 Some compiler warnings cleaned up.
1318 FreeBSD-2.2 patches for LKM completed.
1320 3.2alpha3 31/3/97 - Released
1322 ipmon changes: -N for reading NAT logfile, -S for reading state logfile.
1323 -a for reading all. -n now toggles hostname resolution.
1325 Add logging of new state entries and expiration of old state entries.
1326 count log successes and failures.
1328 Add logging of new NAT entries and expiration of old NAT entries.
1329 count log successes and failures.
1331 Use u_quad_t for records of bytes & packets where kept
1332 (IP Accounting: fr_hits, fr_bytes; IP state: is_pkts, is_bytes).
1334 Fixup use of CPU and DCPU in Makefiles.
1336 Fix broken 0/32 NAT mapping. Carl Makin <cmakin@nla.gov.au>
1340 Implement mapping to 0/32 as being an alias for automatically using the
1341 interface's first IP address.
1343 Implement separate minor devices for both NAT and IP state code.
1345 Fully prototype all functions.
1347 Fix Makefile problem due to attempt to fix Sun compiling problems.
1349 3.1.10 23/3/97 - Released
1351 ipfstat -a requires a -i or -o command line option too. Print an error
1352 when not present rather than attempt to do something.
1354 patch updates for SunOS4 for kernel compiling.
1355 patch for ipmon -s (flush's syslog file which isn't good). Andrew J. Schorr
1356 <schorr@ead.dsa.com>
1358 too many people hit their heads hard when compiling code into the kernel
1359 that doesn't let any packets through. (fil.c - IPF_NOMATCH)
1361 icmp-type parsing doesn't return any errors when it isn't constructed
1362 correctly. Neil Readwin
1364 Using "-conf" with modload on SunOS4 doesn't work.
1365 Timothy Demarest <demarest@arraycomm.com>
1367 Need to define ARCH in makefile for SunOS4 building. "make sunos4"
1368 in INSTALL.SunOS is incorrect. James R Grinter <jrg@blodwen.demon.co.uk>
1369 [all SunOS targets now run buildsunos]
1371 NAT lookups are still incorrect, matching non-TCP/UDP with TCP/UDP
1372 information. ArkanoiD <ark@paranoid.convey.ru>
1374 Need to check for __FreeBSD_version being 199511 rather than 199607
1375 in mln_ipl.c. Eric Feillant <Eric.Feillant@EUnet.fr>
1377 3.1.9 8/3/97 - Released
1379 fixed incorrect lookup of active NAT entries.
1381 patch for ip_deq() wrong for pre 2.1.6 FreeBSD.
1382 fyeung@fyeung8.netific.com (Francis Yeung)
1384 check for out with return-rst/return-icmp at wrong place - Erkki Ritoniemi
1387 text_readip returns the interface pointer pointing to text on stack -
1390 fix from Pradeep Krishnan for printout rules "with not opt sec".
1392 3.1.8 18/2/97 - Released
1394 Diffs for ip_output.c and ip_input.c updated to fix bug with fastroute and
1395 compiling warnings about reuse of m0.
1397 prevent use of return-rst and return-icmp with rules blocking packets going
1398 out, preventing panics in certain situations.
1400 loop forms in frag cache table - Yury Pshenychny <yura@rd.zgik.zaporizhzhe.ua>
1402 should use SPLNET/SPLX around expire routines in NAT/frag/state code.
1404 redeclared malloc in 44arp.c -
1406 3.1.7 8/2/97 - Released
1408 Macros used for ntohs/htons supplied with gcc don't always work very well
1409 when the assignment is the same variable being converted.
1411 Filter matching doesn't not match rule which checks tcp flags on packets
1412 which are fragments - David Wilson
1414 3.1.7beta 30/1/97 - Released
1416 Fix up NAT bugs introduced in last major change (now tested), including
1417 nat_delete(), nat_lookupredir(), checksum changes, etc.
1419 3.1.7alpha 30/1/97 - Released
1421 Many changes to NAT code, including contributions from Laurent Joncheray
1424 Use "NO_SLEEP" when allocating memory under SunOS.
1426 Make kernel printf's nicer for BSD/SunOS4
1428 Always do a checksum for packets being filtered going out and being
1429 processed by fastroute.
1431 Leave kernel to play with cdevsw on *BSD systems with LKM's.
1433 ipnat.1 man page fixes.
1435 3.1.6 21/1/97 - Released
1437 Allow NAT to work on BSD systems in conjunction with "pass .. to ifname"
1439 Memory leak introduced in 3.1.3 in NAT lists, clearing of NAT table tried
1440 to free memory twice.
1442 NAT recalculates IP header checksum based on difference between IP#'s and
1443 port numbers - should be just IP#'s (Solaris2 only)
1445 3.1.5 13/1/97 - Released
1447 fixed setting of NAT timeouts and use different timeouts for concurrent
1448 TCP sessions using the same IP# mapping (when port mapping isn't used)
1450 multiple loading/unloading of LKM's doesn't clean up cdevsw properly for
1453 3.1.4 10/1/97 - Released
1455 add command line options -C and -F to ipnat to flush NAT list and table
1457 ipnat -l loops on output - Neil Readwin (nreadwin@nysales.micrognosis.com)
1459 NetBSD/FreeBSD kernel malloc changes - Daniel Carosone
1461 3.1.3 10/1/97 - Released
1463 NAT chains not constructed correctly in hash tables - Antony Y.R Lu
1464 (antony@hawk.ee.ncku.edu.tw)
1466 Updated INSTALL.NetBSD, INSTALL.FreeBSD and INSTALL.Sol2
1468 man page update (ipf.5) from Daniel Carosone (dan@geek.com.au)
1470 ICMP header checksum update now included in NAT.
1472 Solaris2 needs to modify IP header checksums in ip_natin and ip_natout.
1474 3.1.2 4/12/96 - Released
1476 ipmon doesn't use syslog all the time when given -s option
1478 fixed mclput panic in ip_input.c and replace ntohs() with NTOHS() macro
1480 check the results of hostname resolution in ipnat
1482 "make *install" fixed for subdirectories.
1484 problems with "ARCH:=" and gnu make resolved
1486 parser reports an error for lines with whitespaces only rather than skipping
1487 them. D.Carosone@abm.com.au (Daniel Carosone)
1489 patches for integration into NetBSD-current (post 1.2).
1491 add an option to allow non-IP packets going up/down the stream on Solaris2
1492 to be dropped. John Bass.
1494 3.1.2beta 21/11/96 - Released
1496 make ipsend compile on Linux 2.0.24
1498 changes to TCP kept state algorithm, making it watch state on TCP
1499 connections in both directions. Also use the same algorithm for NAT TCP.
1501 -Wall cleanup - Bernd Ernesti
1503 added "or-block" for "pass .. log or-block" after a suggestion from
1504 David Oppenheim (davido@optimation.com.au)
1506 added subdirectories for building IP Filter in SunOS5/BSD for different
1509 Solaris2 fixes to logging and pre-filtering packet processing - 3.1.1p2
1511 mbuf logging not using mtod(), remove iplbusy - 3.1.1p1 1/11/96
1513 3.1.1 28/10/96 - Released
1515 Installation script fixes and deinstall scripts for IP Filter on:
1516 SunOS4/FreeBSD/NetBSD
1518 Man page fixes - Paul Dubois (dubois@primate.wisc.edu)
1520 Fix use of SOLARIS macro in ipmon, rewrote ipllog() (again!)
1522 parsing isn't completely case insensitive - David Wilson
1523 (davidw@optimation.com.au)
1525 Release ipl_mutex across uiomove() calls
1527 print entire rule entries out for "ipf -z" when zero'ing per-rule stats.
1529 ipfstat returns same output for "hits" in "ipfstat -aio" - Terletsky Slavik
1530 (ts@polynet.lviv.ua)
1532 New algorithm for setting timeouts for TCP connection (more closely follow
1533 TCP FSM) - Pradeep Krishnan (pkrishna@netcom.com)
1535 Track both window sizes for TCP connections through "keep state".
1537 Solaris2 doesn't like _KERNEL defined in stdargs.h - Jos van Wezel
1540 3.1.1-beta2 6/10/96 - Released
1542 Solaris2 fastroute/dup-to/to now works
1544 ipmon `record' reading rewritten
1546 Added post-NetBSD1.2 packet filter patches - Mathew Green (mrg@eterna.com.au)
1548 Attempt to use in_proto.c.diff, not "..diffs" for SunOS4 - David Wilson
1549 (davidw@optimation.com.au)
1551 Michael Ryan (mike@NetworX.ie) reports the following:
1552 * The Trumpet WinSock under Windows always sends its SYN packet with an ACK
1553 value of 1, unlike any other implementation I've seen, which would set it
1554 to zero. The "keep state" feature of IP Filter doesn't work when receiving
1555 non-zero ACK values on new connection requests.
1556 * */Makefile install rule doesn't install all the binaries/man pages
1557 * Make ipnat use "tcp/udp" instead of "tcpudp"
1558 * Print out "tcp/udp" properly
1559 * ipnat "portmap tcp" matches "portmap udp" when adding/removing
1560 * NAT dest. ip# increased by one on mask of 0xffffffff when it shouldn't
1562 3.1.1-beta 1/9/96 - Released
1564 add better detection of TCP connections closing to TCP state monitoring.
1566 fr_addstate() not called correctly for fragments. "keep state" and
1567 "keep frag" code don't work together 100% - Songqing Cai
1568 (songqing_cai@sterling.com)
1570 call to fr_addstate() incorrect for adding state in combination with keeping
1571 fragment information - Songqing Cai (songqing_cai@sterling.com)
1573 KFREE() passed fp (incorrect) and not fr (correct) in ip_frag.c - John Hood
1574 (cgull@smoke.marlboro.vt.us)
1576 make ipf parser recognise '\\' as a `continued line' marker - Dima Ruban
1579 3.1.1-alpha 23/8/96 - Released
1581 kernel panic's when ICMP packets go through NAT code
1583 stats aren't zero'd properly with ipf -Z
1585 ipnat doesn't show port numbers correctly all the time and also add the
1586 protocol (tcp/udp/tcpudp) to rdr output - Carson Gaspar (carson@lehman.com)
1588 fast checksum fixing not 100% - backout patch - Bill Dorsey (dorsey@lila.com)
1590 NetBSD-1.2 patches from - VaX#n8 <vax@linkdead.paranoia.com>
1592 Usage() call error in fils.c - Ajay Shekhawat (ajay@cedar.buffalo.edu)
1594 ip_optcopy() staticly defined in ip_output.c in SunOS4 - Nick Hall
1595 (nrh@tardis.ed.ac.uk)
1597 3.1.0 7/7/96 - Released
1599 Reformatted ipnat output to be compatible with it's input, so that
1600 "ipnat -l | ipnat -rf -" is possible.
1602 3.1.0beta 30/6/96 - Released
1604 NetBSD-1.2 patches from Greg Woods (woods@most.weird.com)
1606 kernel module must not be installed stripped (Solaris2), as created by
1607 "make package" for Solaris2 - Peter Heimann
1608 (peter@i3.informatik.rwth-aachen.de)
1610 3.1.0alpha 5/6/96 - Released
1612 include examples in package for solaris2
1614 patches for removing an extra ip header checksum (FreeBSD/NetBSD/SunOS)
1616 removed trailing space from printouts of rules in ipf.
1618 ipresend supports the same range of inputs that ipftest does.
1620 sending a duplicate copy of a packet to another network devices is now
1621 supported. ("dup-to")
1623 sending a packet to an arbitary interface is now supported, irrespective
1624 of its actual route, with no ttl decrement. Can also be routed without
1625 the ttl being decremented. ("to" and "fastroute").
1627 "call" option added to support calling a generic function if a packet is
1630 show all (upto 4) recorded bytes from the interface name in logging from
1633 support for using unix file permissions for read/write access on the device
1636 recursive mutex in nat_new() for Solaris 2.x - Per L. Hagen <per@stibo.dk>
1638 ipftest doesn't call initparse() for THISHOST - Catherine Allen
1639 (cla@connect.com.au)
1641 Man page corrections from Rex Bona (rex@pengo.comsmiths.com.au)
1643 3.0.4 10/4/96 - Released
1645 looop in `parsing' IP packets with optlen 0 for ip options.
1647 rule number not initialized and resulted in unexpected results for state
1650 option parsing and printing bugs - Pradeep Krishnan
1652 3.0.4beta 25/3/96 - Released
1654 wouldn't parse "keep flags keep state" correctly.
1656 SunOS4.1.x ip_input.c doesn't recognise all 1s broadcast address - Nigel Verdon
1658 patches for BSDI's BSD/OS 2.1 and libpcap reader on little endian systems
1659 from Thorsten Lockert <tholo@tetherless.com>
1661 b* functions in fil.c on Solaris 2.4
1663 3.0.3 17/3/96 - Released
1665 added patches to support IP Filter initialisation when compiled into the
1668 added -x option to ipmon to display hex dumps of logged packets.
1670 added -H option to ipftest to allow ascii-hex formatted input to specify
1671 arbitary IP packets.
1673 Sending TCP RSTs as a response now work for Solaris2 x86
1675 add patches to make IP Filter compile into NetBSD kernels properly.
1677 patch to stop SunOS 4.1.x kernels panicing with "data traps".
1679 ipfboot script unloads and reloads ipf module on Solaris2 if it is already
1680 loaded into the kernel.
1682 Installation of IP Filter as a Solaris2 package is now supported.
1684 Man pages for ipnat.4, ipnat.5 added.
1686 added some more regression tests and fixed up IP Filter to pass the new tests
1687 (previous versions failed some of the tests in set 12).
1689 IP option filter processing has changed so that saying "with opt lsrr" will
1690 check only for that one, but not mask out other options, so a packet with
1691 strict source routing, along with loose source routing will match all of
1692 "with opt lsrr", "with opt ssrr" and "with opt lsrr,ssrr".
1694 IPL_NAME needed in ipnat.c - Kelly (kelly@count04.mry.scruznet.com)
1696 patches for clean NetBSD compilation from Bernd Ernesti (bernd@arresum.inka.de)
1698 make install is incorrect - Julian Briggs (julian@lightwork.co.uk)
1700 strtol() returns 0x7fffffff for all negative numbers,
1701 printfr() generates incorrect output for "opt sec-class *",
1702 handling of "not opt xxx opt yyy" incorrect.
1703 - Minh Tonthat (minht@sbei.com)/Pradeep Krishnan (pradeepk@sbei.com)
1705 m_pullup() called only for input and not output; caused problems
1706 with filtering icmp - Nigel Verdon (verdenn@gb.swissbank.com)
1708 parsing problem for "port 1" and NetBSD patches incorrect -
1709 Andreas Gustafsson (gson@guava.araneus.fi)
1711 3.0.2 4/2/96 - Released
1713 Corrected bug where NAT recalculates checksums for fragments.
1715 make NAT recalculate UDP checksums (rather than setting them to 0),
1716 if they're non-zero.
1718 DNS patches - Real Page (Real.Page@Matrox.com)
1720 alteration of checksum recalculations in NAT code and addition of
1721 redirection with NAT - Mike Neuman
1723 core dump, if tcp/udp is used with a port number and not service name,
1724 in ipf - Mike Neuman (mcn@engarde.com)
1726 initparse() call, missing to prime "<thishost>" hook - Craig Bishop
1728 3.0.1 14/1/96 - Released
1730 miscellaneous patches for Solaris2
1732 3.0 14/1/96 - Released
1734 Patch included for FDDI, from Richard Ohnemus
1735 (Richard_Ohnemus@dallas.csd.sterling.com)
1737 Code cleanup for release.
1741 recursive mutex in ipfr_slowtimer fixed, reported by Craig Bishop
1743 recursive mutex in sending TCP RSTs fixed, reported by Tony Becker
1747 FIxup for Solaris2.5 install and interface name bug in ipftest from
1748 Julian Briggs (julian@lightwork.co.uk)
1750 Byte order patches for ipmon from Tony Becker (tony@mcrsys.com)
1754 Added the (somewhat warped) IP accounting as it exists in ipfw on FreeBSD.
1755 Note, this isn't really what one would call IP account, when compared to
1756 process accounting, sigh.
1758 Split up ipresend into iptest/ipresend/ipsend
1760 Added another m_pullup() inside fr_check() for BSD style kernels and
1761 added some checks to ipllog() to not log more than is present (for short
1764 Fixed bug where failed hostname/netname resolution goes undetecte and
1765 becomes 0.0.0.0 (any) (reported Guido van Rooij)
1767 3.0beta 11/11/95 - Released
1769 Rewrote the way rule testing is done, reducing the number of files needed and
1772 SIOCIPFFL was incorrectly affected by IPFILTER_LOG (Mathew Green)
1774 Patches from Guido van Rooij to fix sending back TCP RSTs on Net-2/Net-3
1775 BSD based Unixes (panic'd)
1777 Patches for FreeBSD/i86 ipmon from Riku Kalinen <riku@tequila.nixu.fi>
1778 (I think someone else already told me about these but they got lost :-/)
1780 Changed Makefile structure to build object files for different operating
1781 systems in separate directories by default.
1783 BSDI has ef0 for first ethernet interface
1785 Allow for a "not" operator before optional keywords.
1787 The "rule number" was being incorrectly incremented every time it went through
1788 the loop rather than when it matched a rule.
1790 2.8.2 24/10/95 - Released
1792 Fixed up problems with "textip" for doing lots of testing.
1794 Fixed bug in detection of "short" tcp/ip packets (all reported as being short).
1796 Solaris 2.4 port now works 100%.
1798 Man page errors reported and fixed.
1800 Removed duplicate entry in etc/services for login on port 49 (Craig Bishop).
1802 Fixed ipmon output to put a space after the log-letter.
1804 Patch from Guido van Rooij to fix parsing problem.
1806 2.8.1 15/10/95 - Released
1808 Added ttl and tos filtering.
1810 Patches for fixing up compilation and port problems (little endian)
1811 from Guido van Rooij <guido@IAEhv.nl>.
1813 Man page problems reported and fixed by Carson Gaspar <carson@lehman.com>.
1815 ipsend doesn't compile properly on Solaris2.4
1817 Lots of work done for Solaris2.4 to make it MT/MP safe and work.
1819 2.8 15/9/95 - Released
1821 ipmon can now send messages to syslogd (-s) and use names instead of
1824 IP packets are now "compiled" into a structure only containing filterable
1827 Added regression testing in the test/ subdirectory, using a new option
1828 (-b) with the ipftest program.
1830 Added "nomatch" return to filter results. These are counted and show
1831 up in reports from ipfstat.
1833 Moved filter code out of ip_fil.c and into fil.c - there is now only one
1834 instance of it in the package.
1836 Added Solaris 2.4 support.
1838 Added IPSO basic security option filtering.
1840 Added name support for filtering on all 19 named IP options.
1842 Patches from Ivan Brawley to log packet contents as well as packet headers.
1844 Update for sun/conf.c.diff from Ivan Brawley <ibrawley@awadi.com.AU>
1846 Added patches for FreeBSD 1, and added two new switches (-E, -D) to ipf,
1847 along with a new ioctl, SIOCFRENB.
1848 From: Dieter Dworkin Muller <dworkin@village.org>
1850 2.7.3 31/7.95 - Released
1852 Didn't compile cleanly without IPFILTER_LOG defined (Mathew Green).
1854 ipftest now deals with tcpdump3 binary output files (from libpcap) with -P.
1856 Brought ipftest program upto date with actual filter code.
1858 Filter would cause a match to occur when it wasn't meant to if the packet
1859 had short headers and was missing portions that should have been there.
1860 Err, it would rightly not match on them, but their absence caused a match
1861 when it shouldn't have been.
1863 2.7.2 26/7/95 - Released
1865 Problem with filtering just SYN flagged packets reported by
1866 Dieter Dworkin Muller <dworkin@village.org>. To solve this
1867 problem, added support for masking TCP flags for comparison "flags X/Y".
1869 2.7.1 9/7/95 - Released
1871 Added ip_dirbroadcast support for Sun ip_input.c
1873 Fixed up the install scripts for FreeBSD/NetBSD to recognise where they are
1876 2.7 7/7/95 - Released
1878 Added "return-rst" to return TCP RST's to TCP packets.
1880 Actually ported it to FreeBSD-i386 2.0.0, so it works there properly now.
1882 Added insertion of filter rules. Use "@<#>" at the beginning of a filter
1883 to insert a rule at row #.
1885 Filter keeps track of how many times each rule is matched.
1887 Changed compile time things to match kernel option (IPFILTER_LKM &
1890 Updated ip_input.c and ip_output.c with paches for 3.5 Multicast IP.
1891 (No change required for 3.6)
1893 Now includes TCP fragments which start inside the TCP header as being short.
1894 Added counting the number of times each rule is matched.
1897 2.6 11/5/95 - Released
1899 Added -n option to ipf: when supplied, no changes are made to the kernel.
1901 Added installation scripts for SunOS 4.1.x and NetBSD/FreeBSD/BSDI.
1903 Rewrote filtering to use a more generic mask & match procedure for
1904 checking if a packet matches a rule.
1906 2.5.2 27/4/95 - Released
1908 "tcp/udp" and a non-initialised pointer caused the "proto" to become
1909 a `random' value; added "ip#/dotted.mask" notation to the BNF.
1910 From Adam W. Feigin <feigin@iis.ee.ethz.ch>
1912 2.5.1 22/3/95 - Released
1914 "tcp/udp" had a strange effect (undesired) on getserv*() functions,
1915 causing protocol/service lookups to fail. Reported by Matthew Green.
1917 2.5 17/3/95 - Released
1919 Added a new keyword "all" to BNF and parsing of tcpdump/etherfind/snoop
1920 output through the ipftest program. Suggestions from:
1921 Michael Ciavarella (mikec@phyto.apana.org.au)
1923 Conflicts occur when "general" filter rules are used for ports and the
1924 lack of a "proto" when used with "port" matches other packets when only
1925 TCP/UDP are implied.
1926 Reported Matthew Green (mrg@fulcom.com.au);
1927 reported & fixed 6-8/3/95
1929 Added filtering of short TCP packets using "with short" 28/2/95
1930 (These can possibly slip by checks for the various flags). Short UDP
1931 or ICMP are dropped to the floor and logged.
1933 Added filtering of fragmented packets using "with frag" 24/2/95
1935 Port to NetBSD-current completed 20/2/95, using LKM.
1937 Added logging of the rule # which caused the logging to happen and the
1938 interface on which the packet is currently as suggested by
1939 Andreas Greulich (greulich@math-stat.unibe.ch) 10/2/95
1941 2.4 9/2/95 - Released
1942 Fixed saving of IP headers in ICMP packets.
1945 Added ipf -F [in|out|all] to flush filter rule sets (SIOCIPFFL).
1946 Fixed iplread() and iplsave() with help from Marc Huber.
1948 2.2 7/1/95 - Released
1949 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
1950 its own major char number dynamically when modload'ing. Fixed up
1951 use of <, >, <=, >= and >< for ports.
1953 2.1 21/12/94 - Released
1954 repackaged to include the correct ip_output.c and ip_input.c *goof*
1956 2.0 18/12/94 - Released
1957 added code to check for port ranges - complete.
1958 rewrote to work as a loadable kernel module - complete.
1961 added code for ouput filtering as well as input filtering and added support for logging to a simple character device of packet headers.
1963 1.0 22/04/93 - Released