Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src Import IPFilter 4.1.33
details: https://anonhg.NetBSD.org/src/rev/c31826a7b118
branches: trunk
changeset: 746746:c31826a7b118
user: darrenr <darrenr%NetBSD.org@localhost>
date: Wed Aug 19 08:28:39 2009 +0000
description:
Import IPFilter 4.1.33
4.1.33 - Release 16 August 2009
2837931 wrong mode selected in ipf program for hash-entries
2826168 load_http can make ippool core dump
2825150 IPL_LOGMAX used to index some arrays
2825084 ipv6 fragments should not be allowed past 64k
2824713 ipfstat top output alternates between entries and nothing
2824712 ipfstat top output is shows negative ttl
2820965 a single bad ipv6 extension header should not impact others
2818197 ignored fragment bits defined as being reserved
2817667 IPv6 fragment header verification needs attention
2817098 fr_getrulen() finds the wrong rule
2817096 fr_rulen is unused
2741019 Lingering states (Established/Listen - 5/0) in state table
2702887 use of PBR/fastroute causes panic with ipv6
2671913 regression test in7 fails to execute
2598625 parsing empty config file results in an error
2698656 test parsing empty config files
2597956 not all pointers in a clone are reset
2543934 nat_t gets assigned ifp too early
2535795 No need to always bump fr_ref
2535778 Bad IPv6 packets droped by default
2031730 4.1.31 Nat drops fragmented packets after the first
2214661 ipf does not handle IPv6 fragments
2473273 NAT removed before RST/ICMP sent
2216500 fin_state serves no purpose
2424604 adding random MD5 data causes panic
2304435 Ineffecient lock usage in logging
2216491 fin_nat serves little purpose
2055619 duplicating a free-d packet will fail
2042949 Excessive locking when creating nat_t
2035610 nat_update does not need to get locks
2214658 ipf mostly ignores locking in NetBSD
1979427 Memory leak in user utilities - token never freed (rel br)
* SunOS4 does not have a curproc, but it does have u.
* The fix for 2020447 generated random port numbers but not within the
range specified in the map rule. Add in a regression test to verify
that the "random" part works.
2020447 NAT can undo name server random port selection
1988795 NetBSD does not build with kernel malloc stats
1988782 fr_movequeue can take a short cut
1988669 first nat creation failure prevents further success
1988668 hostmap searching does not work properly
* on some 64bit architectures (such as alpha), the addrfamily_t is packed
differently, throwing off the calculations for adf_len
* one too many READ_ENTERs in ip_sync code.
* clean up fr_fastroute a little by removing some #ifdefs and pushing the
code around a bit to use the same variables (NetBSD)
* more recent NetBSDs use VOP related macros differently
diffstat:
dist/ipf/arc4random.c | 275 ++++++++++++++++++++++++++++++++++++++
dist/ipf/ip_htable.c | 47 ++++-
dist/ipf/ip_irc_pxy.c | 14 +-
dist/ipf/ip_pool.c | 63 +++++---
dist/ipf/ip_pptp_pxy.c | 14 +-
dist/ipf/ip_rpcb_pxy.c | 15 +-
dist/ipf/ip_sync.c | 10 +-
dist/ipf/l4check/http.ok | 2 +-
dist/ipf/lib/load_hash.c | 5 +-
dist/ipf/perl/ipf-mrtg.pl | 2 +-
dist/ipf/perl/logfilter.pl | 2 +-
dist/ipf/samples/ipfilter-pb.gif | Bin
dist/ipf/test/expected/ipv6.6 | 5 +
dist/ipf/test/expected/n11 | 2 +-
dist/ipf/test/expected/n18 | 87 ++++++++++++
dist/ipf/test/expected/ni10 | 2 +-
dist/ipf/test/expected/ni11 | 2 +-
dist/ipf/test/expected/ni12 | 6 +-
dist/ipf/test/expected/ni19 | 12 +-
dist/ipf/test/expected/ni20 | 12 +-
dist/ipf/test/input/ipv6.6 | 7 +
dist/ipf/test/input/n18 | 8 +
dist/ipf/test/regress/i23 | 1 +
dist/ipf/test/regress/in7 | 1 +
dist/ipf/test/regress/ipv6.6 | 1 +
dist/ipf/test/regress/n18 | 3 +
dist/ipf/test/test.format | 3 +
dist/ipf/tools/ipftest.c | 38 ++++-
dist/ipf/tools/ipnat.c | 8 +-
dist/ipf/tools/ipsyncm.c | 6 +-
dist/ipf/tools/ipsyncs.c | 6 +-
regress/sys/kern/ipf/expected/n18 | 87 ++++++++++++
regress/sys/kern/ipf/input/n18 | 8 +
regress/sys/kern/ipf/regress/i23 | 1 +
regress/sys/kern/ipf/regress/in7 | 1 +
regress/sys/kern/ipf/regress/n18 | 3 +
36 files changed, 658 insertions(+), 101 deletions(-)
diffs (truncated from 1385 to 300 lines):
diff -r eb9c1986cdf7 -r c31826a7b118 dist/ipf/arc4random.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/dist/ipf/arc4random.c Wed Aug 19 08:28:39 2009 +0000
@@ -0,0 +1,275 @@
+/* $NetBSD$ */
+
+#ifdef NEED_LOCAL_RAND
+/*-
+ * THE BEER-WARE LICENSE
+ *
+ * <dan%FreeBSD.ORG@localhost> wrote this file. As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you
+ * think this stuff is worth it, you can buy me a beer in return.
+ *
+ * Dan Moschuk
+ */
+#if !defined(SOLARIS2) && !defined(__osf__)
+# include <sys/cdefs.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/param.h>
+#ifdef __FreeBSD__
+# include <sys/kernel.h>
+#endif
+#ifndef __osf__
+# include <sys/random.h>
+#endif
+#ifdef __FreeBSD__
+# include <sys/libkern.h>
+#endif
+#include <sys/lock.h>
+#ifndef __osf__
+# include <sys/mutex.h>
+#endif
+#include <sys/time.h>
+
+#if defined(SOLARIS2) && (SOLARIS2 < 9)
+# include <netinet/in_systm.h>
+#endif
+#include <sys/socket.h>
+#include <net/if.h>
+#ifdef __osf__
+# include <net/route.h>
+#endif
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include "netinet/ip_compat.h"
+#include "md5.h"
+
+#if !defined(__GNUC__)
+# define __inline
+#endif
+
+#define ARC4_RESEED_BYTES 65536
+#define ARC4_RESEED_SECONDS 300
+#define ARC4_KEYBYTES (256 / 8)
+
+static u_int8_t arc4_i, arc4_j;
+static int arc4_numruns = 0;
+static u_int8_t arc4_sbox[256];
+static time_t arc4_t_reseed;
+static ipfmutex_t arc4_mtx;
+static MD5_CTX md5ctx;
+
+static u_int8_t arc4_randbyte(void);
+static int ipf_read_random(void *dest, int length);
+
+static __inline void
+arc4_swap(u_int8_t *a, u_int8_t *b)
+{
+ u_int8_t c;
+
+ c = *a;
+ *a = *b;
+ *b = c;
+}
+
+/*
+ * Stir our S-box.
+ */
+static void
+arc4_randomstir (void)
+{
+ u_int8_t key[256];
+ int r, n;
+ struct timeval tv_now;
+
+ /*
+ * XXX read_random() returns unsafe numbers if the entropy
+ * device is not loaded -- MarkM.
+ */
+ r = ipf_read_random(key, ARC4_KEYBYTES);
+ GETKTIME(&tv_now);
+ MUTEX_ENTER(&arc4_mtx);
+ /* If r == 0 || -1, just use what was on the stack. */
+ if (r > 0) {
+ for (n = r; n < sizeof(key); n++)
+ key[n] = key[n % r];
+ }
+
+ for (n = 0; n < 256; n++) {
+ arc4_j = (arc4_j + arc4_sbox[n] + key[n]) % 256;
+ arc4_swap(&arc4_sbox[n], &arc4_sbox[arc4_j]);
+ }
+
+ /* Reset for next reseed cycle. */
+ arc4_t_reseed = tv_now.tv_sec + ARC4_RESEED_SECONDS;
+ arc4_numruns = 0;
+
+ /*
+ * Throw away the first N words of output, as suggested in the
+ * paper "Weaknesses in the Key Scheduling Algorithm of RC4"
+ * by Fluher, Mantin, and Shamir. (N = 256 in our case.)
+ */
+ for (n = 0; n < 256*4; n++)
+ arc4_randbyte();
+ MUTEX_EXIT(&arc4_mtx);
+}
+
+/*
+ * Initialize our S-box to its beginning defaults.
+ */
+static void
+arc4_init(void)
+{
+ int n;
+
+ MD5Init(&md5ctx);
+
+ MUTEX_INIT(&arc4_mtx, "arc4_mtx");
+ arc4_i = arc4_j = 0;
+ for (n = 0; n < 256; n++)
+ arc4_sbox[n] = (u_int8_t) n;
+
+ arc4_t_reseed = 0;
+}
+
+
+/*
+ * Generate a random byte.
+ */
+static u_int8_t
+arc4_randbyte(void)
+{
+ u_int8_t arc4_t;
+
+ arc4_i = (arc4_i + 1) % 256;
+ arc4_j = (arc4_j + arc4_sbox[arc4_i]) % 256;
+
+ arc4_swap(&arc4_sbox[arc4_i], &arc4_sbox[arc4_j]);
+
+ arc4_t = (arc4_sbox[arc4_i] + arc4_sbox[arc4_j]) % 256;
+ return arc4_sbox[arc4_t];
+}
+
+/*
+ * MPSAFE
+ */
+void
+arc4rand(void *ptr, u_int len, int reseed)
+{
+ u_int8_t *p;
+ struct timeval tv;
+
+ GETKTIME(&tv);
+ if (reseed ||
+ (arc4_numruns > ARC4_RESEED_BYTES) ||
+ (tv.tv_sec > arc4_t_reseed))
+ arc4_randomstir();
+
+ MUTEX_ENTER(&arc4_mtx);
+ arc4_numruns += len;
+ p = ptr;
+ while (len--)
+ *p++ = arc4_randbyte();
+ MUTEX_EXIT(&arc4_mtx);
+}
+
+uint32_t
+ipf_random(void)
+{
+ uint32_t ret;
+
+ arc4rand(&ret, sizeof ret, 0);
+ return ret;
+}
+
+
+static u_char pot[ARC4_RESEED_BYTES];
+static u_char *pothead = pot, *pottail = pot;
+static int inpot = 0;
+
+/*
+ * This is not very strong, and this is understood, but the aim isn't to
+ * be cryptographically strong - it is just to make up something that is
+ * pseudo random.
+ */
+void
+ipf_rand_push(void *src, int length)
+{
+ static int arc4_inited = 0;
+ u_char *nsrc;
+ int mylen;
+
+ if (arc4_inited == 0) {
+ arc4_init();
+ arc4_inited = 1;
+ }
+
+ if (length < 64) {
+ MD5Update(&md5ctx, src, length);
+ return;
+ }
+
+ nsrc = src;
+ mylen = length;
+
+#if defined(_SYS_MD5_H) && defined(SOLARIS2)
+# define buf buf_un.buf8
+#endif
+ MUTEX_ENTER(&arc4_mtx);
+ while ((mylen > 64) && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
+ MD5Update(&md5ctx, nsrc, 64);
+ mylen -= 64;
+ nsrc += 64;
+ if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
+ int left, numbytes;
+
+ numbytes = pot + sizeof(pot) - pottail;
+ bcopy(md5ctx.buf, pottail, numbytes);
+ left = sizeof(md5ctx.buf) - numbytes;
+ pottail = pot;
+ bcopy(md5ctx.buf + sizeof(md5ctx.buf) - left,
+ pottail, left);
+ pottail += left;
+ } else {
+ bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
+ pottail += sizeof(md5ctx.buf);
+ }
+ inpot += 64;
+ }
+ MUTEX_EXIT(&arc4_mtx);
+#if defined(_SYS_MD5_H) && defined(SOLARIS2)
+# undef buf
+#endif
+}
+
+
+static int
+ipf_read_random(void *dest, int length)
+{
+ if (length > inpot)
+ return 0;
+
+ MUTEX_ENTER(&arc4_mtx);
+ if (pothead + length > pot + sizeof(pot)) {
+ int left, numbytes;
+
+ left = length;
+ numbytes = pot + sizeof(pot) - pothead;
+ bcopy(pothead, dest, numbytes);
+ left -= numbytes;
+ pothead = pot;
+ bcopy(pothead, dest + length - left, left);
+ pothead += left;
+ } else {
+ bcopy(pothead, dest, length);
+ pothead += length;
+ }
+ inpot -= length;
+ if (inpot == 0)
+ pothead = pottail = pot;
+ MUTEX_EXIT(&arc4_mtx);
+
+ return length;
+}
+
+#endif /* NEED_LOCAL_RAND */
diff -r eb9c1986cdf7 -r c31826a7b118 dist/ipf/ip_htable.c
--- a/dist/ipf/ip_htable.c Wed Aug 19 08:24:43 2009 +0000
+++ b/dist/ipf/ip_htable.c Wed Aug 19 08:28:39 2009 +0000
@@ -1,9 +1,11 @@
-/* $NetBSD: ip_htable.c,v 1.1.1.5 2008/05/20 06:44:10 darrenr Exp $ */
+/* $NetBSD: ip_htable.c,v 1.1.1.6 2009/08/19 08:28:39 darrenr Exp $ */
/*
* Copyright (C) 1993-2001, 2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
+ *
+ * Copyright 2008 Sun Microsystems, Inc.
*/
#if defined(KERNEL) || defined(_KERNEL)
# undef KERNEL
@@ -53,7 +55,7 @@
/* END OF INCLUDES */
#if !defined(lint)
-static const char rcsid[] = "@(#)Id: ip_htable.c,v 2.34.2.11 2007/09/20 12:51:51 darrenr Exp";
Home |
Main Index |
Thread Index |
Old Index