PSARC 2006/082 IP Filter Code Merge on ip_fil4.1.9

4912568 ipftest ipf ipfstat ipnat ippool need a non-name resolution flag
5040248 ipfs -W fails to save kernel state tables
5081834 syntax parser reports wrong error position and line number
5094575 keyword "netmask" is un-supported in ipnat.conf (4)
6181751 ipf parser fails on wrong subnet notations
6181773 ipf parser fails on wrong port ranges
6248745 ipnat drops packets if the IP header is not 32 bit aligned
6340621 RFE: IP Filter code merge on ip_fil4.1.9
6359805 ipf command incorrectly check options in rules and core dumps
6395837 ipnat tcpudp parsing is incomplete
6426469 IPFilter rejects IPv6 neighbour discovery packets
6447872 usr/src/common/ipf/ip_compat.h should not be CDDL

--HG--
rename : usr/src/common/ipf/bpf-ipf.h => usr/src/uts/common/inet/ipf/bpf-ipf.h
rename : usr/src/common/ipf/fil.c => usr/src/uts/common/inet/ipf/fil.c
rename : usr/src/common/ipf/ip_auth.c => usr/src/uts/common/inet/ipf/ip_auth.c
rename : usr/src/common/ipf/ip_fil_solaris.c => usr/src/uts/common/inet/ipf/ip_fil_solaris.c
rename : usr/src/common/ipf/ip_frag.c => usr/src/uts/common/inet/ipf/ip_frag.c
rename : usr/src/common/ipf/ip_htable.c => usr/src/uts/common/inet/ipf/ip_htable.c
rename : usr/src/common/ipf/ip_log.c => usr/src/uts/common/inet/ipf/ip_log.c
rename : usr/src/common/ipf/ip_lookup.c => usr/src/uts/common/inet/ipf/ip_lookup.c
rename : usr/src/common/ipf/ip_nat.c => usr/src/uts/common/inet/ipf/ip_nat.c
rename : usr/src/common/ipf/ip_pool.c => usr/src/uts/common/inet/ipf/ip_pool.c
rename : usr/src/common/ipf/ip_proxy.c => usr/src/uts/common/inet/ipf/ip_proxy.c
rename : usr/src/common/ipf/ip_state.c => usr/src/uts/common/inet/ipf/ip_state.c
rename : usr/src/common/ipf/ipf.h => usr/src/uts/common/inet/ipf/ipf.h
rename : usr/src/common/ipf/ipmon.h => usr/src/uts/common/inet/ipf/ipmon.h
rename : usr/src/common/ipf/ipt.h => usr/src/uts/common/inet/ipf/ipt.h
rename : usr/src/common/ipf/Makefile => usr/src/uts/common/inet/ipf/netinet/Makefile
rename : usr/src/common/ipf/ip_auth.h => usr/src/uts/common/inet/ipf/netinet/ip_auth.h
rename : usr/src/common/ipf/ip_compat.h => usr/src/uts/common/inet/ipf/netinet/ip_compat.h
rename : usr/src/common/ipf/ip_fil.h => usr/src/uts/common/inet/ipf/netinet/ip_fil.h
rename : usr/src/common/ipf/ip_frag.h => usr/src/uts/common/inet/ipf/netinet/ip_frag.h
rename : usr/src/common/ipf/ip_ftp_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_ftp_pxy.c
rename : usr/src/common/ipf/ip_h323_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_h323_pxy.c
rename : usr/src/common/ipf/ip_htable.h => usr/src/uts/common/inet/ipf/netinet/ip_htable.h
rename : usr/src/common/ipf/ip_ipsec_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_ipsec_pxy.c
rename : usr/src/common/ipf/ip_irc_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_irc_pxy.c
rename : usr/src/common/ipf/ip_lookup.h => usr/src/uts/common/inet/ipf/netinet/ip_lookup.h
rename : usr/src/common/ipf/ip_nat.h => usr/src/uts/common/inet/ipf/netinet/ip_nat.h
rename : usr/src/common/ipf/ip_netbios_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_netbios_pxy.c
rename : usr/src/common/ipf/ip_pool.h => usr/src/uts/common/inet/ipf/netinet/ip_pool.h
rename : usr/src/common/ipf/ip_proxy.h => usr/src/uts/common/inet/ipf/netinet/ip_proxy.h
rename : usr/src/common/ipf/ip_raudio_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_raudio_pxy.c
rename : usr/src/common/ipf/ip_rcmd_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_rcmd_pxy.c
rename : usr/src/common/ipf/ip_rpcb_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_rpcb_pxy.c
rename : usr/src/common/ipf/ip_state.h => usr/src/uts/common/inet/ipf/netinet/ip_state.h
rename : usr/src/common/ipf/ipl.h => usr/src/uts/common/inet/ipf/netinet/ipl.h
rename : usr/src/common/ipf/opts.h => usr/src/uts/common/inet/ipf/opts.h
rename : usr/src/common/ipf/radix.c => usr/src/uts/common/inet/ipf/radix.c
rename : usr/src/common/ipf/radix.h => usr/src/uts/common/inet/ipf/radix.h
rename : usr/src/common/ipf/solaris.c => usr/src/uts/common/inet/ipf/solaris.c
rename : usr/src/uts/common/inet/ipf/compat.h => usr/src/uts/common/inet/pfil/compat.h
rename : usr/src/uts/common/inet/ipf/misc.c => usr/src/uts/common/inet/pfil/misc.c
rename : usr/src/uts/common/inet/ipf/ndd.c => usr/src/uts/common/inet/pfil/ndd.c
rename : usr/src/uts/common/inet/ipf/os.h => usr/src/uts/common/inet/pfil/os.h
rename : usr/src/uts/common/inet/ipf/pfil.c => usr/src/uts/common/inet/pfil/pfil.c
rename : usr/src/uts/common/inet/ipf/pfil.conf => usr/src/uts/common/inet/pfil/pfil.conf
rename : usr/src/uts/common/inet/ipf/pfil.h => usr/src/uts/common/inet/pfil/pfil.h
rename : usr/src/common/ipf/pfild.h => usr/src/uts/common/inet/pfil/pfild.h
rename : usr/src/uts/common/inet/ipf/pfildrv.c => usr/src/uts/common/inet/pfil/pfildrv.c
rename : usr/src/uts/common/inet/ipf/pfilstream.c => usr/src/uts/common/inet/pfil/pfilstream.c
rename : usr/src/uts/common/inet/ipf/pkt.c => usr/src/uts/common/inet/pfil/pkt.c
rename : usr/src/uts/common/inet/ipf/qif.c => usr/src/uts/common/inet/pfil/qif.c
rename : usr/src/uts/common/inet/ipf/qif.h => usr/src/uts/common/inet/pfil/qif.h

1 files changed, 52 insertions, 132 deletions

diff --git a/usr/src/cmd/ipf/lib/common/printnat.c b/usr/src/cmd/ipf/lib/common/printnat.c
index 2f6c058bc4..0e228652fa 100644
--- a/usr/src/cmd/ipf/lib/common/printnat.c
+++ b/usr/src/cmd/ipf/lib/common/printnat.c
@@ -5,7 +5,7 @@
  *
  * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
  *
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -16,84 +16,9 @@
 
 
 #if !defined(lint)
-static const char rcsid[] = "@(#)$Id: printnat.c,v 1.14 2003/04/13 06:39:16 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: printnat.c,v 1.22.2.9 2005/06/12 07:18:43 darrenr Exp $";
 #endif
 
-
-void printactivenat(nat, opts)
-nat_t *nat;
-int opts;
-{
-	u_int hv1, hv2;
-
-	printf("%s", getnattype(nat->nat_ptr));
-
-	if (nat->nat_flags & SI_CLONE)
-		printf(" CLONE");
-
-	printf(" %-15s", inet_ntoa(nat->nat_inip));
-
-	if ((nat->nat_flags & IPN_TCPUDP) != 0)
-		printf(" %-5hu", ntohs(nat->nat_inport));
-
-	printf(" <- -> %-15s",inet_ntoa(nat->nat_outip));
-
-	if ((nat->nat_flags & IPN_TCPUDP) != 0)
-		printf(" %-5hu", ntohs(nat->nat_outport));
-
-	printf(" [%s", inet_ntoa(nat->nat_oip));
-	if ((nat->nat_flags & IPN_TCPUDP) != 0)
-		printf(" %hu", ntohs(nat->nat_oport));
-	printf("]");
-
-	if (opts & OPT_VERBOSE) {
-		printf("\n\tage %lu use %hu sumd %s/",
-			nat->nat_age, nat->nat_use, getsumd(nat->nat_sumd[0]));
-                if ((nat->nat_flags & SI_WILDP) == 0) {
-                        hv1 = NAT_HASH_FN(nat->nat_inip.s_addr,
-                                        nat->nat_inport, 0xffffffff);
-                        hv1 = NAT_HASH_FN(nat->nat_oip.s_addr,
-                                        hv1 + nat->nat_oport, NAT_TABLE_SZ);
-                        hv2 = NAT_HASH_FN(nat->nat_outip.s_addr,
-                                        nat->nat_outport, 0xffffffff);
-                        hv2 = NAT_HASH_FN(nat->nat_oip.s_addr,
-                                        hv2 + nat->nat_oport, NAT_TABLE_SZ);
-                } else {
-                        hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0,
-                                        0xffffffff);
-                        hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1,
-                                        NAT_TABLE_SZ);
-                        hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0,
-                                        0xffffffff);
-                        hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2,
-                                        NAT_TABLE_SZ);
-                }
-		printf("%s pr %u bkt %d/%d flags %x\n",
-			getsumd(nat->nat_sumd[1]), nat->nat_p,
-			hv1, hv2, nat->nat_flags);
-		printf("\tifp %s", getifname(nat->nat_ifps[0]));
-		printf(",%s ", getifname(nat->nat_ifps[1]));
-#ifdef	USE_QUAD_T
-		printf("bytes %qu/%qu pkts %qu/%qu",
-			(unsigned long long)nat->nat_bytes[0],
-			(unsigned long long)nat->nat_bytes[1],
-			(unsigned long long)nat->nat_pkts[0],
-			(unsigned long long)nat->nat_pkts[1]);
-#else
-		printf("bytes %lu/%lu pkts %lu/%lu", nat->nat_bytes[0],
-			nat->nat_bytes[1], nat->nat_pkts[0], nat->nat_pkts[1]);
-#endif
-#if SOLARIS
-		printf(" %lx", nat->nat_ipsumd);
-#endif
-	}
-
-	putchar('\n');
-	if (nat->nat_aps)
-		printaps(nat->nat_aps, opts);
-}
-
-
 /*
  * Print out a NAT rule
  */
@@ -102,7 +27,6 @@ ipnat_t *np;
 int opts;
 {
 	struct	protoent	*pr;
-	struct	servent	*sv;
 	int	bits;
 
 	pr = getprotobynumber(np->in_p);
@@ -167,33 +91,26 @@ int opts;
 			printf("%s", inet_ntoa(np->in_out[0].in4));
 			bits = count4bits(np->in_outmsk);
 			if (bits != -1)
-				printf("/%d ", bits);
+				printf("/%d", bits);
 			else
-				printf("/%s ", inet_ntoa(np->in_out[1].in4));
-			printf("port %d", ntohs(np->in_pmin));
-			if (np->in_pmax != np->in_pmin)
-				printf("-%d", ntohs(np->in_pmax));
+				printf("/%s", inet_ntoa(np->in_out[1].in4));
+			if (np->in_flags & IPN_TCPUDP) {
+				printf(" port %d", ntohs(np->in_pmin));
+				if (np->in_pmax != np->in_pmin)
+					printf("-%d", ntohs(np->in_pmax));
+			}
 		}
 		printf(" -> %s", inet_ntoa(np->in_in[0].in4));
 		if (np->in_flags & IPN_SPLIT)
 			printf(",%s", inet_ntoa(np->in_in[1].in4));
-		if (np->in_inip == 0) {
-			bits = count4bits(np->in_inmsk);
-			printf("/%d", bits);
+		if (np->in_flags & IPN_TCPUDP) {
+			if ((np->in_flags & IPN_FIXEDDPORT) != 0)
+				printf(" port = %d", ntohs(np->in_pnext));
+			else
+				printf(" port %d", ntohs(np->in_pnext));
 		}
-		printf(" port %d", ntohs(np->in_pnext));
-		if ((np->in_flags & IPN_TCPUDP) == IPN_TCPUDP)
-			printf(" tcp/udp");
-		else if ((np->in_flags & IPN_TCP) == IPN_TCP)
-			printf(" tcp");
-		else if ((np->in_flags & IPN_UDP) == IPN_UDP)
-			printf(" udp");
-		else if (np->in_p == 0)
-			printf(" ip");
-		else if (pr != NULL)
-			printf(" %s", pr->p_name);
-		else
-			printf(" %d", np->in_p);
+		putchar(' ');
+		printproto(pr, np->in_p, np);
 		if (np->in_flags & IPN_ROUNDR)
 			printf(" round-robin");
 		if (np->in_flags & IPN_FRAG)
@@ -205,19 +122,14 @@ int opts;
 			printf(" sticky");
 		if (np->in_mssclamp != 0)
 			printf(" mssclamp %d", np->in_mssclamp);
-		if (*np->in_plabel != '\0') {
-			printf(" proxy %.*s/", (int)sizeof(np->in_plabel),
+		if (*np->in_plabel != '\0')
+			printf(" proxy %.*s", (int)sizeof(np->in_plabel),
 				np->in_plabel);
-			if (pr != NULL)
-				fputs(pr->p_name, stdout);
-			else
-				printf("%d", np->in_p);
-		}
+		if (np->in_tag.ipt_tag[0] != '\0')
+			printf(" tag %-.*s", IPFTAG_LEN, np->in_tag.ipt_tag);
 		printf("\n");
 		if (opts & OPT_DEBUG)
-			printf("\tspc %lu flg %#x max %u use %d\n",
-			       np->in_space, np->in_flags,
-			       np->in_pmax, np->in_use);
+			printf("\tpmax %u\n", np->in_pmax);
 	} else {
 		if (!(np->in_flags & IPN_FILTER)) {
 			printf("%s/", inet_ntoa(np->in_in[0].in4));
@@ -240,26 +152,21 @@ int opts;
 				printf("%s", inet_ntoa(np->in_out[1].in4));
 		}
 		if (*np->in_plabel != '\0') {
-			printf(" proxy port");
+			printf(" proxy port ");
 			if (np->in_dcmp != 0)
 				np->in_dport = htons(np->in_dport);
 			if (np->in_dport != 0) {
-				if (pr != NULL)
-					sv = getservbyport(np->in_dport,
-							   pr->p_name);
-				else
-					sv = getservbyport(np->in_dport, NULL);
-				if (sv != NULL)
-					printf(" %s", sv->s_name);
+				char *s;
+
+				s = portname(np->in_p, ntohs(np->in_dport));
+				if (s != NULL)
+					fputs(s, stdout);
 				else
-					printf(" %hu", ntohs(np->in_dport));
+					fputs("???", stdout);
 			}
 			printf(" %.*s/", (int)sizeof(np->in_plabel),
 				np->in_plabel);
-			if (pr != NULL)
-				fputs(pr->p_name, stdout);
-			else
-				printf("%d", np->in_p);
+			printproto(pr, np->in_p, NULL);
 		} else if (np->in_redir == NAT_MAPBLK) {
 			if ((np->in_pmin == 0) &&
 			    (np->in_flags & IPN_AUTOPORTMAP))
@@ -269,13 +176,12 @@ int opts;
 			if (opts & OPT_DEBUG)
 				printf("\n\tip modulous %d", np->in_pmax);
 		} else if (np->in_pmin || np->in_pmax) {
-			printf(" portmap");
-			if ((np->in_flags & IPN_TCPUDP) == IPN_TCPUDP)
-				printf(" tcp/udp");
-			else if (np->in_flags & IPN_TCP)
-				printf(" tcp");
-			else if (np->in_flags & IPN_UDP)
-				printf(" udp");
+			if (np->in_flags & IPN_ICMPQUERY) {
+				printf(" icmpidmap ");
+			} else {
+				printf(" portmap ");
+			}
+			printproto(pr, np->in_p, np);
 			if (np->in_flags & IPN_AUTOPORTMAP) {
 				printf(" auto");
 				if (opts & OPT_DEBUG)
@@ -287,7 +193,11 @@ int opts;
 				printf(" %d:%d", ntohs(np->in_pmin),
 				       ntohs(np->in_pmax));
 			}
+		} else if (np->in_flags & IPN_TCPUDP || np->in_p) {
+			putchar(' ');
+			printproto(pr, np->in_p, np);
 		}
+
 		if (np->in_flags & IPN_FRAG)
 			printf(" frag");
 		if (np->in_age[0] != 0 || np->in_age[1] != 0) {
@@ -295,16 +205,26 @@ int opts;
 		}
 		if (np->in_mssclamp != 0)
 			printf(" mssclamp %d", np->in_mssclamp);
+		if (np->in_tag.ipt_tag[0] != '\0')
+			printf(" tag %s", np->in_tag.ipt_tag);
 		printf("\n");
 		if (opts & OPT_DEBUG) {
 			struct in_addr nip;
 
 			nip.s_addr = htonl(np->in_nextip.s_addr);
 
-			printf("\tspace %lu nextip %s pnext %d", np->in_space,
+			printf("\tnextip %s pnext %d\n",
 			       inet_ntoa(nip), np->in_pnext);
-			printf(" flags %x use %u\n",
-			       np->in_flags, np->in_use);
 		}
 	}
+
+	if (opts & OPT_DEBUG) {
+		printf("\tspace %lu use %u hits %lu flags %#x proto %d hv %d\n",
+			np->in_space, np->in_use, np->in_hits,
+			np->in_flags, np->in_p, np->in_hv);
+		printf("\tifp[0] %p ifp[1] %p apr %p\n",
+			np->in_ifps[0], np->in_ifps[1], np->in_apr);
+		printf("\ttqehead %p/%p comment %p\n",
+			np->in_tqehead[0], np->in_tqehead[1], np->in_comment);
+	}
 }