File	Date	Author	Commit
4bsd	2006-06-15	Darren Reed	[93a482] import_msg_v41
AIX	2018-09-14	WHR	[df8bf9] Clean up bpf_filter from Makefiles
BSD	2018-09-15	WHR	[33f6fd] Fix warnings; make ar(1) command line looks bet...
BSDOS	2006-06-15	Darren Reed	[93a482] import_msg_v41
BSDOS3	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
BSDOS4	2006-06-15	Darren Reed	[93a482] import_msg_v41
FWTK	2006-06-15	cvs2git	[dcb22b] This commit was manufactured by cvs2git to crea...
FreeBSD	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
FreeBSD-2.2	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
FreeBSD-3	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
FreeBSD-4.0	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
HPUX	2018-09-15	WHR	[d309e6] ipfboot: fix usage message
IRIX	2018-09-15	WHR	[d309e6] ipfboot: fix usage message
Linux	2018-09-15	WHR	[33f6fd] Fix warnings; make ar(1) command line looks bet...
NetBSD	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
NetBSD-1.2	2006-06-15	Darren Reed	[93a482] import_msg_v41
OSF	2018-09-14	WHR	[df8bf9] Clean up bpf_filter from Makefiles
OpenBSD	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
OpenBSD-2	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
OpenBSD-3	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
SunOS4	2018-09-14	WHR	[df8bf9] Clean up bpf_filter from Makefiles
SunOS5	2018-09-29	WHR	[9331f9] Fix unreleased writer lock in function ipf_find...
etc	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
iplang	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
ipsd	2018-09-15	WHR	[caf8a0] More usage message fixes
ipsend	2018-09-18	WHR	[58bce5] ipsend: fix usage message format; Linux module:...
l4check	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
lib	2018-09-17	WHR	[8029aa] ipfstat: print correct tag keyword to match inp...
man	2024-11-15	WHR	[3957cb] ipmon: make sleep interval configurable via opt...
perl	2018-09-16	WHR	[935b03] Why use uppercase is those file names?
rules	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
samples	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
test	2011-12-13	Darren Reed	[091e0c] 3428002 ip_ttl is too low
tools	2024-11-15	WHR	[b123c5] ipmon: use select(2) to wait for data from devi...
.cvsignore	2007-09-24	Darren Reed	[1ca37d] add three entries that pop up on freebsd builds
BNF	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
BugReport	2007-08-21	Darren Reed	[cfcad7] update to 4.1.20
COMPILE.2.5	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
COMPILE.Solaris2	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
FAQ.FreeBSD	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
HISTORY	2010-03-11	Darren Reed	[3ad40a] ready for 4.1.34
IMPORTANT	2006-06-15	Darren Reed	[93a482] import_msg_v41
INST.FreeBSD-2.2	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
INSTALL.BSDOS	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
INSTALL.BSDOS3	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
INSTALL.FreeBSD	2007-09-29	Darren Reed	[b73bac] update intstructions for installation
INSTALL.IRIX	2006-06-15	Darren Reed	[93a482] import_msg_v41
INSTALL.Linux	2009-07-18	Darren Reed	[acb616] 2787359 ipfilter 4.1.32rc5 won't build on RHEL 5.3
INSTALL.NetBSD	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
INSTALL.Sol2	2006-06-15	Darren Reed	[93a482] import_msg_v41
INSTALL.SunOS	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
INSTALL.Tru64	2006-06-15	Darren Reed	[83f3fb] head_v413
INSTALL.xBSD	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
IPF.KANJI	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
IPFILTER.LICENCE	2011-10-20	Darren Reed	[b723ed] 3426558 resistence is futile
Makefile	2018-09-12	WHR	[400706] Add support for FreeBSD 10.1+
NAT.FreeBSD	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
README	2006-06-15	Darren Reed	[93a482] import_msg_v41
STYLE.TXT	2006-06-15	Darren Reed	[93a482] import_msg_v41
WhatsNew40.txt	2006-06-15	Darren Reed	[93a482] import_msg_v41
Y2K	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
arc4random.c	2020-05-08	WHR	[86b415] Fix over-read of 'mblk_t' causing kernel page f...
bsdinstall	2006-06-15	Darren Reed	[93a482] import_msg_v41
buildsunos	2018-09-08	WHR	[567838] Fixes for Solaris 11
fil.c	2020-05-10	WHR	[ee411e] Fix duplicated word in comment
hpux.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
ip_auth.c	2010-02-10	Darren Reed	[ca8b47] 2949139 FR_T_BUILTIN masked out incorrectly
ip_auth.h	2008-03-16	Darren Reed	[92209c] preserve and restore the fin_flx bits from the ...
ip_compat.h	2019-06-26	WHR	[9d50f0] Make fastroute for local output TCP packets wor...
ip_fil.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_fil.h	2018-09-18	WHR	[9bb6c6] Fix unremovable rules
ip_fil_aix.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required
ip_fil_compat.c	2010-02-26	Darren Reed	[7cad56] 2959506 ipfstat does not display rules with compat
ip_fil_freebsd.c	2018-09-12	WHR	[400706] Add support for FreeBSD 10.1+
ip_fil_hpux.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required
ip_fil_irix.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required
ip_fil_linux.c	2018-09-14	WHR	[7f0c93] Sync GNU/Linux support
ip_fil_netbsd.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_fil_openbsd.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_fil_osf.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_fil_solaris.c	2018-09-15	WHR	[8c1ac5] Make fastroute for local output packets works o...
ip_fil_sunos4.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required
ip_frag.c	2009-05-13	Darren Reed	[725385] 2787870 4,1,32rc5 ipfstat -nio causes oops on F...
ip_frag.h	2009-01-01	Darren Reed	[59ee68] 2214661 ipf doesn't handle IPv6 fragments
ip_ftp_pxy.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_htable.c	2009-05-13	Darren Reed	[725385] 2787870 4,1,32rc5 ipfstat -nio causes oops on F...
ip_htable.h	2007-08-21	Darren Reed	[6b3320] update to 4.1.17
ip_ipsec_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_irc_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_log.c	2009-07-22	Darren Reed	[1a17b0] 2825150 IPL_LOGMAX used to index some arrays
ip_lookup.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_lookup.h	2010-02-19	Darren Reed	[f36ca1] 2825150 IPL_LOGMAX used to index some arrays
ip_nat.c	2024-10-08	WHR	[80ff65] Make functions 'fr_checknatout' and 'fr_checkna...
ip_nat.h	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_netbios_pxy.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
ip_pool.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_pool.h	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_pptp_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_proxy.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_proxy.h	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
ip_raudio_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_rcmd_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_rpcb_pxy.c	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_scan.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
ip_scan.h	2007-08-21	Darren Reed	[6b03a3] update to 4.1.14
ip_state.c	2011-12-12	Darren Reed	[f1ed04] v4.1.35
ip_state.h	2008-11-06	Darren Reed	[a2db2c] 2216500 fin_state serves no purpose
ip_sync.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required
ip_sync.h	2007-08-21	Darren Reed	[6b03a3] update to 4.1.14
ipf.h	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
ipl.h	2020-05-08	WHR	[86b415] Fix over-read of 'mblk_t' causing kernel page f...
ipmon.h	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
ipt.h	2006-06-15	Darren Reed	[93a482] import_msg_v41
kmem.h	2006-06-15	Darren Reed	[93a482] import_msg_v41
linux.c	2018-09-18	WHR	[58bce5] ipsend: fix usage message format; Linux module:...
linux.h	2006-06-15	Darren Reed	[93a482] import_msg_v41
md5.c	2018-09-08	WHR	[045fc6] Fix implicit declaration of bcopy(3)
md5.h	2007-09-09	Darren Reed	[0b7189] Make IPFilter 4.1.x run on Solaris10Update4
mkfilters	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
ml_ipl.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlf_ipl.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlf_rule.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlfk_ipl.c	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
mlfk_rule.c	2006-06-15	Darren Reed	[83f3fb] head_v413
mlh_rule.c	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
mli_ipl.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mln_ipl.c	2008-07-17	Darren Reed	[1e6f77] more recent NetBSDs use VOP related macros diff...
mln_rule.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlo_ipl.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlo_rule.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mls_ipl.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mls_rule.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
mlso_rule.c	2007-10-26	Martti Kuparinen	[6d3457] Backout the "Indent K&R style functions' argume...
opts.h	2006-06-15	cvs2git	[554011] This commit was manufactured by cvs2git to crea...
radix_ipf.c	2018-09-14	WHR	[7f0c93] Sync GNU/Linux support
radix_ipf.h	2011-12-12	Darren Reed	[f1ed04] v4.1.35
snoop.h	2006-06-15	Darren Reed	[93a482] import_msg_v41
solaris.c	2020-05-08	WHR	[86b415] Fix over-read of 'mblk_t' causing kernel page f...
todo	2007-10-25	Martti Kuparinen	[4a04f4] Removed trailing spaces and tabs.
tru64.c	2009-12-19	Darren Reed	[d4e3b9] 2917501 whitespace cleanup required

Read Me

IP Filter - What's this about ?
============================
Web site: http://coombs.anu.edu.au/~avalon/ip-filter.html
How-to: http://www.obfuscation.org/ipf/ipf-howto.txt

  The idea behind this package is allow those who use Unix workstations as
routers (a common occurance in Universities it appears) to apply packet
filtering to packets going in and out of them.  This package has been
tested on all versions of SunOS 4.1 and Solaris 2.4/2.5, running on Sparcs.
It is also quite possible for this small kernel extension to be installed
and used effectively on Sun workstations which don't route IP, just for
added security.  It can also be integrated with the multicast patches.
It has also been tested successfully on all of the modern free BSDs as
well as BSDI, and SGI's IRIX 6.2.

   The filter keeps a rule list for both inbound and outbound sides of
the IP packet queue and a check is made as early as possible, aiming to
stop the packet before it even gets as far as being checked for source
route options.  In the file "BNF", a set of rules for constructing filter
rules understood by this package is given.  The files in the directory
"rules", "example.1" ... "example.sr" show example rules you might apply.

   In practise, I've successfully isolated a workstation from all
machines except the NFS file servers on its local subnets (yeah, ok, so
this doesn't really increase security, because of NFS, but you get the
drift on how it can be applied and used).  I've also successfully
setup and maintained my own firewalls using it with TIS's Firewall Toolkit,
including using it on an mbone router.

   When using it with multicast IP, the calls to fr_check() should be
before the packet is unwrapped and after it is encapsulated.  So the
filter routines will see the packet as a UDP packet, protocol XYZ.
Whether this is better or worse than having it filter on class D addresses
is debateable, but the idea behind this package is to be able to
discriminate between packets as they are on the 'wire', before they
get routed anywhere, etc.

   It is worth noting, that it is possible, using a small MTU and
generating tiny fragmented IP packets to generate a TCP packet which
doesn't contain enough information to filter on the "flags".  Filtering
on these types of packets is possible, but under the more general case
of the packets being "short".  ICMP and UDP packets which are too small
(they don't contain a complete header) are dropped and logged, no questions
asked.  When filtering on fragmented packets, the last fragment will get
through for TCP/UDP/ICMP packets.

Bugs/Problems
-------------
If you have a problem with IP Filter on your operating system, please email
a copy of the file "BugReport" with the details of your setup as required
and email to darrenr@pobox.com.

Some general notes.
-------------------
   To add/delete a rule from memory, access to the device in /dev is needed,
allowing non-root maintenaince.  The filter list in kernel memory is built
from the kernel's heap.  Each packet coming *in* or *out* is checked against
the appropriate list, rejects dropped, others passed through.  Thus this will
work on an individual host, not just gateways.  Presently there is only one
list for all interfaces, the changes required to make it a per-interface list
require more .o replacements for the kernel.  When checking a packet, the
packet is compared to the entire list from top to bottom, the last matching
line being effective.


What does what ?
----------------
if_fil.o  (Loadable kernel module)
	- additional kernel routines to check an access list as to whether
	  or not to drop or pass a packet.  It currently defaults to pass
	  on all packets.

ipfstat
	- digs through your kernel (need to check #define VMUNIX in fils.c)
	  and /dev/kmem for the access filter list and mini stats table.
	  Obviously needs to be run priviledged if required.

ipf
	- reads the files passed as parameters as input files containing new
	  filter rules to add/delete to the kernel list.  The lines are
	  inserted in order; the first line is inserted first, and ends up
	  first on the list.  Subsequent invocations append to the list
	  unless specified otherwise.

ipftest
	- test the ruleset given by filename.  Reads in the ruleset and then
	  waits for stdin.

	  See the man pages (ipf.1, ipftest.1, ipfstat.8) for more detailed
	  information on what the above do.

mkfilters
	- suggests a set of filter rules to employ and suggests how to add
	  routes to back these up.

BNF
	- BNF rule set for the filter rules

Darren Reed
darrenr@pobox.com
http://coombs.anu.edu.au/~avalon/ip-filter.html