NameDateSize

..27-Jun-202090

arc4random.c04-Feb-20195 KiB

BNF07-Sep-20133.5 KiB

bpf-ipf.h06-Nov-201214 KiB

bpf_filter.c15-Apr-201612.3 KiB

BugReport06-Nov-2012409

genmask.c07-Sep-20131.1 KiB

HISTORY07-Sep-201355.4 KiB

ip_dstlist.c04-Feb-201943.8 KiB

ip_dstlist.h07-Sep-20131.4 KiB

ip_fil.c04-Feb-201914.1 KiB

ip_fil_compat.c04-Feb-2019122.1 KiB

ip_msnrpc_pxy.c06-Nov-20126.3 KiB

ipf.h31-Mar-202012.1 KiB

ipf_rb.h07-Sep-201310.4 KiB

iplang/05-Aug-20208

ipmon.h07-Sep-20133.3 KiB

ipsend/28-Sep-202025

ipt.h07-Sep-2013536

kmem.h07-Sep-2013578

l4check/07-Sep-20137

lib/30-Sep-2020145

LICENCE06-Nov-2012612

Makefile07-Sep-201314.5 KiB

man/24-Jul-202024

md5.c04-Feb-201911.4 KiB

md5.h06-Nov-20123.2 KiB

mkfilters07-Sep-20132.6 KiB

mlfk_rule.c07-Sep-20131.2 KiB

NAT.FreeBSD07-Sep-20132.8 KiB

opt_inet6.h06-Nov-201214

opts.h29-Aug-20161.5 KiB

pcap-ipf.h07-Sep-2013642

radix_ipf.c16-Mar-201741.9 KiB

radix_ipf.h07-Sep-20132.6 KiB

README06-Nov-20124.5 KiB

rules/07-Sep-201329

samples/07-Sep-20137

snoop.h07-Sep-2013664

STYLE.TXT06-Nov-20122 KiB

sys/07-Sep-20133

tools/19-Jul-202024

WhatsNew50.txt07-Sep-20132.3 KiB

Y2K06-Nov-201248

README

1IP Filter - What's this about ?
2============================
3Web site: http://coombs.anu.edu.au/~avalon/ip-filter.html
4How-to: http://www.obfuscation.org/ipf/ipf-howto.txt
5
6  The idea behind this package is allow those who use Unix workstations as
7routers (a common occurance in Universities it appears) to apply packet
8filtering to packets going in and out of them.  This package has been
9tested on all versions of SunOS 4.1 and Solaris 2.4/2.5, running on Sparcs.
10It is also quite possible for this small kernel extension to be installed
11and used effectively on Sun workstations which don't route IP, just for
12added security.  It can also be integrated with the multicast patches.
13It has also been tested successfully on all of the modern free BSDs as
14well as BSDI, and SGI's IRIX 6.2.
15
16   The filter keeps a rule list for both inbound and outbound sides of
17the IP packet queue and a check is made as early as possible, aiming to
18stop the packet before it even gets as far as being checked for source
19route options.  In the file "BNF", a set of rules for constructing filter
20rules understood by this package is given.  The files in the directory
21"rules", "example.1" ... "example.sr" show example rules you might apply.
22
23   In practise, I've successfully isolated a workstation from all
24machines except the NFS file servers on its local subnets (yeah, ok, so
25this doesn't really increase security, because of NFS, but you get the
26drift on how it can be applied and used).  I've also successfully
27setup and maintained my own firewalls using it with TIS's Firewall Toolkit,
28including using it on an mbone router.
29
30   When using it with multicast IP, the calls to fr_check() should be
31before the packet is unwrapped and after it is encapsulated.  So the
32filter routines will see the packet as a UDP packet, protocol XYZ.
33Whether this is better or worse than having it filter on class D addresses
34is debateable, but the idea behind this package is to be able to
35discriminate between packets as they are on the 'wire', before they
36get routed anywhere, etc.
37
38   It is worth noting, that it is possible, using a small MTU and
39generating tiny fragmented IP packets to generate a TCP packet which
40doesn't contain enough information to filter on the "flags".  Filtering
41on these types of packets is possible, but under the more general case
42of the packets being "short".  ICMP and UDP packets which are too small
43(they don't contain a complete header) are dropped and logged, no questions
44asked.  When filtering on fragmented packets, the last fragment will get
45through for TCP/UDP/ICMP packets.
46
47Bugs/Problems
48-------------
49If you have a problem with IP Filter on your operating system, please email
50a copy of the file "BugReport" with the details of your setup as required
51and email to darrenr@pobox.com.
52
53Some general notes.
54-------------------
55   To add/delete a rule from memory, access to the device in /dev is needed,
56allowing non-root maintenaince.  The filter list in kernel memory is built
57from the kernel's heap.  Each packet coming *in* or *out* is checked against
58the appropriate list, rejects dropped, others passed through.  Thus this will
59work on an individual host, not just gateways.  Presently there is only one
60list for all interfaces, the changes required to make it a per-interface list
61require more .o replacements for the kernel.  When checking a packet, the
62packet is compared to the entire list from top to bottom, the last matching
63line being effective.
64
65
66What does what ?
67----------------
68if_fil.o  (Loadable kernel module)
69	- additional kernel routines to check an access list as to whether
70	  or not to drop or pass a packet.  It currently defaults to pass
71	  on all packets.
72
73ipfstat
74	- digs through your kernel (need to check #define VMUNIX in fils.c)
75	  and /dev/kmem for the access filter list and mini stats table.
76	  Obviously needs to be run priviledged if required.
77
78ipf
79	- reads the files passed as parameters as input files containing new
80	  filter rules to add/delete to the kernel list.  The lines are
81	  inserted in order; the first line is inserted first, and ends up
82	  first on the list.  Subsequent invocations append to the list
83	  unless specified otherwise.
84
85ipftest
86	- test the ruleset given by filename.  Reads in the ruleset and then
87	  waits for stdin.
88
89	  See the man pages (ipf.1, ipftest.1, ipfstat.8) for more detailed
90	  information on what the above do.
91
92mkfilters
93	- suggests a set of filter rules to employ and suggests how to add
94	  routes to back these up.
95
96BNF
97	- BNF rule set for the filter rules
98
99Darren Reed
100darrenr@pobox.com
101http://coombs.anu.edu.au/~avalon/ip-filter.html
102