PSARC 2006/082 IP Filter Code Merge on ip_fil4.1.9

4912568 ipftest ipf ipfstat ipnat ippool need a non-name resolution flag
5040248 ipfs -W fails to save kernel state tables
5081834 syntax parser reports wrong error position and line number
5094575 keyword "netmask" is un-supported in ipnat.conf (4)
6181751 ipf parser fails on wrong subnet notations
6181773 ipf parser fails on wrong port ranges
6248745 ipnat drops packets if the IP header is not 32 bit aligned
6340621 RFE: IP Filter code merge on ip_fil4.1.9
6359805 ipf command incorrectly check options in rules and core dumps
6395837 ipnat tcpudp parsing is incomplete
6426469 IPFilter rejects IPv6 neighbour discovery packets
6447872 usr/src/common/ipf/ip_compat.h should not be CDDL

--HG--
rename : usr/src/common/ipf/bpf-ipf.h => usr/src/uts/common/inet/ipf/bpf-ipf.h
rename : usr/src/common/ipf/fil.c => usr/src/uts/common/inet/ipf/fil.c
rename : usr/src/common/ipf/ip_auth.c => usr/src/uts/common/inet/ipf/ip_auth.c
rename : usr/src/common/ipf/ip_fil_solaris.c => usr/src/uts/common/inet/ipf/ip_fil_solaris.c
rename : usr/src/common/ipf/ip_frag.c => usr/src/uts/common/inet/ipf/ip_frag.c
rename : usr/src/common/ipf/ip_htable.c => usr/src/uts/common/inet/ipf/ip_htable.c
rename : usr/src/common/ipf/ip_log.c => usr/src/uts/common/inet/ipf/ip_log.c
rename : usr/src/common/ipf/ip_lookup.c => usr/src/uts/common/inet/ipf/ip_lookup.c
rename : usr/src/common/ipf/ip_nat.c => usr/src/uts/common/inet/ipf/ip_nat.c
rename : usr/src/common/ipf/ip_pool.c => usr/src/uts/common/inet/ipf/ip_pool.c
rename : usr/src/common/ipf/ip_proxy.c => usr/src/uts/common/inet/ipf/ip_proxy.c
rename : usr/src/common/ipf/ip_state.c => usr/src/uts/common/inet/ipf/ip_state.c
rename : usr/src/common/ipf/ipf.h => usr/src/uts/common/inet/ipf/ipf.h
rename : usr/src/common/ipf/ipmon.h => usr/src/uts/common/inet/ipf/ipmon.h
rename : usr/src/common/ipf/ipt.h => usr/src/uts/common/inet/ipf/ipt.h
rename : usr/src/common/ipf/Makefile => usr/src/uts/common/inet/ipf/netinet/Makefile
rename : usr/src/common/ipf/ip_auth.h => usr/src/uts/common/inet/ipf/netinet/ip_auth.h
rename : usr/src/common/ipf/ip_compat.h => usr/src/uts/common/inet/ipf/netinet/ip_compat.h
rename : usr/src/common/ipf/ip_fil.h => usr/src/uts/common/inet/ipf/netinet/ip_fil.h
rename : usr/src/common/ipf/ip_frag.h => usr/src/uts/common/inet/ipf/netinet/ip_frag.h
rename : usr/src/common/ipf/ip_ftp_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_ftp_pxy.c
rename : usr/src/common/ipf/ip_h323_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_h323_pxy.c
rename : usr/src/common/ipf/ip_htable.h => usr/src/uts/common/inet/ipf/netinet/ip_htable.h
rename : usr/src/common/ipf/ip_ipsec_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_ipsec_pxy.c
rename : usr/src/common/ipf/ip_irc_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_irc_pxy.c
rename : usr/src/common/ipf/ip_lookup.h => usr/src/uts/common/inet/ipf/netinet/ip_lookup.h
rename : usr/src/common/ipf/ip_nat.h => usr/src/uts/common/inet/ipf/netinet/ip_nat.h
rename : usr/src/common/ipf/ip_netbios_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_netbios_pxy.c
rename : usr/src/common/ipf/ip_pool.h => usr/src/uts/common/inet/ipf/netinet/ip_pool.h
rename : usr/src/common/ipf/ip_proxy.h => usr/src/uts/common/inet/ipf/netinet/ip_proxy.h
rename : usr/src/common/ipf/ip_raudio_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_raudio_pxy.c
rename : usr/src/common/ipf/ip_rcmd_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_rcmd_pxy.c
rename : usr/src/common/ipf/ip_rpcb_pxy.c => usr/src/uts/common/inet/ipf/netinet/ip_rpcb_pxy.c
rename : usr/src/common/ipf/ip_state.h => usr/src/uts/common/inet/ipf/netinet/ip_state.h
rename : usr/src/common/ipf/ipl.h => usr/src/uts/common/inet/ipf/netinet/ipl.h
rename : usr/src/common/ipf/opts.h => usr/src/uts/common/inet/ipf/opts.h
rename : usr/src/common/ipf/radix.c => usr/src/uts/common/inet/ipf/radix.c
rename : usr/src/common/ipf/radix.h => usr/src/uts/common/inet/ipf/radix.h
rename : usr/src/common/ipf/solaris.c => usr/src/uts/common/inet/ipf/solaris.c
rename : usr/src/uts/common/inet/ipf/compat.h => usr/src/uts/common/inet/pfil/compat.h
rename : usr/src/uts/common/inet/ipf/misc.c => usr/src/uts/common/inet/pfil/misc.c
rename : usr/src/uts/common/inet/ipf/ndd.c => usr/src/uts/common/inet/pfil/ndd.c
rename : usr/src/uts/common/inet/ipf/os.h => usr/src/uts/common/inet/pfil/os.h
rename : usr/src/uts/common/inet/ipf/pfil.c => usr/src/uts/common/inet/pfil/pfil.c
rename : usr/src/uts/common/inet/ipf/pfil.conf => usr/src/uts/common/inet/pfil/pfil.conf
rename : usr/src/uts/common/inet/ipf/pfil.h => usr/src/uts/common/inet/pfil/pfil.h
rename : usr/src/common/ipf/pfild.h => usr/src/uts/common/inet/pfil/pfild.h
rename : usr/src/uts/common/inet/ipf/pfildrv.c => usr/src/uts/common/inet/pfil/pfildrv.c
rename : usr/src/uts/common/inet/ipf/pfilstream.c => usr/src/uts/common/inet/pfil/pfilstream.c
rename : usr/src/uts/common/inet/ipf/pkt.c => usr/src/uts/common/inet/pfil/pkt.c
rename : usr/src/uts/common/inet/ipf/qif.c => usr/src/uts/common/inet/pfil/qif.c
rename : usr/src/uts/common/inet/ipf/qif.h => usr/src/uts/common/inet/pfil/qif.h

1 files changed, 36 insertions, 8 deletions

diff --git a/usr/src/cmd/ipf/lib/common/printstate.c b/usr/src/cmd/ipf/lib/common/printstate.c
index 369c1665bf..b0a58abfd7 100644
--- a/usr/src/cmd/ipf/lib/common/printstate.c
+++ b/usr/src/cmd/ipf/lib/common/printstate.c
@@ -10,11 +10,15 @@
 #define	PRINTF	(void)printf
 #define	FPRINTF	(void)fprintf
 
-ipstate_t *printstate(sp, opts)
+ipstate_t *printstate(sp, opts, now)
 ipstate_t *sp;
 int opts;
+u_long now;
 {
 	ipstate_t ips;
+#ifdef	IPFILTER_SYNC
+	synclist_t ipsync;
+#endif
 
 	if (kmemcpy((char *)&ips, (u_long)sp, sizeof(ips)))
 		return NULL;
@@ -23,7 +27,7 @@ int opts;
 	PRINTF("%s pass %#x pr %d state %d/%d bkt %d\n",
 		hostname(ips.is_v, &ips.is_dst.in4), ips.is_pass, ips.is_p,
 		ips.is_state[0], ips.is_state[1], ips.is_hv);
-	PRINTF("\ttag %u age %lu/%lu", ips.is_tag, ips.is_die, ips.is_touched);
+	PRINTF("\ttag %u ttl %lu", ips.is_tag, ips.is_die - now);
 
 	if (ips.is_p == IPPROTO_TCP) {
 		PRINTF("\n\t%hu -> %hu %x:%x %hu<<%d:%hu<<%d\n",
@@ -45,10 +49,13 @@ int opts;
 		printsbuf(ips.is_sbuf[1]);
 		PRINTF("]\n");
 #endif
-	} else if (ips.is_p == IPPROTO_UDP)
+	} else if (ips.is_p == IPPROTO_UDP) {
 		PRINTF(" %hu -> %hu\n", ntohs(ips.is_sport),
 			ntohs(ips.is_dport));
-	else if (ips.is_p == IPPROTO_ICMP
+	} else if (ips.is_p == IPPROTO_GRE) {
+		PRINTF(" call %hx/%hx\n", ntohs(ips.is_gre.gs_call[0]),
+		       ntohs(ips.is_gre.gs_call[1]));
+	} else if (ips.is_p == IPPROTO_ICMP
 #ifdef	USE_INET6
 		 || ips.is_p == IPPROTO_ICMPV6
 #endif
@@ -57,7 +64,7 @@ int opts;
 			ntohs(ips.is_icmp.ici_seq), ips.is_icmp.ici_type);
 
 #ifdef        USE_QUAD_T
-	PRINTF("\tforward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd\n\tbackward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd",
+	PRINTF("\tforward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd\n\tbackward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd\n",
 		ips.is_pkts[0], ips.is_bytes[0],
 		ips.is_pkts[1], ips.is_bytes[1],
 		ips.is_pkts[2], ips.is_bytes[2],
@@ -126,16 +133,19 @@ int opts;
 	if (ips.is_pass & FR_KEEPFRAG)
 		PRINTF(" keep frags");
 	/* a given; no? */
-	if (ips.is_pass & FR_KEEPSTATE)
+	if (ips.is_pass & FR_KEEPSTATE) {
 		PRINTF(" keep state");
+		if (ips.is_pass & FR_STATESYNC)	
+			PRINTF(" ( sync )");
+	}
 	PRINTF("\tIPv%d", ips.is_v);
 	PRINTF("\n");
 
 	PRINTF("\tpkt_flags & %x(%x) = %x,\t",
 		ips.is_flags & 0xf, ips.is_flags,
 		ips.is_flags >> 4);
-	PRINTF("\tpkt_options & %x = %x\n", ips.is_optmsk,
-		ips.is_opt);
+	PRINTF("\tpkt_options & %x = %x, %x = %x \n", ips.is_optmsk[0],
+		ips.is_opt[0], ips.is_optmsk[1], ips.is_opt[1]);
 	PRINTF("\tpkt_security & %x = %x, pkt_auth & %x = %x\n",
 		ips.is_secmsk, ips.is_sec, ips.is_authmsk,
 		ips.is_auth);
@@ -159,5 +169,23 @@ int opts;
 		PRINTF("/%p", ips.is_ifp[3]);
 	PRINTF("]\n");
 
+#ifdef	IPFILTER_SYNC
+	if (ips.is_sync != NULL) {
+
+		if (kmemcpy((char *)&ipsync, (u_long)ips.is_sync, sizeof(ipsync))) {
+	
+			PRINTF("\tSync status: status could not be retrieved\n");
+			return NULL;
+		}
+
+		PRINTF("\tSync status: idx %d num %d v %d pr %d rev %d\n",
+			ipsync.sl_idx, ipsync.sl_num, ipsync.sl_v,
+			ipsync.sl_p, ipsync.sl_rev);
+		
+	} else {
+		PRINTF("\tSync status: not synchronized\n");
+	}
+#endif
+
 	return ips.is_next;
 }