Changes and fixes

Makefile

@@ -1,21 +1,32 @@
-# @(#)51  1.1  src/ipfl/Makefile, ipflt, 53ipfl53H, 0619A_53ipfl53H 5/8/06 07:32:08
-# IBM_PROLOG_BEGIN_TAG 
-# This is an automatically generated prolog. 
-#  
-# 53ipfl53H src/ipfl/Makefile 1.1 
-#  
-# Licensed Materials - Property of IBM 
-#  
-# Restricted Materials of IBM 
-#  
-# (C) COPYRIGHT International Business Machines Corp. 2006 
-# All Rights Reserved 
-#  
-# US Government Users Restricted Rights - Use, duplication or 
-# disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
-#  
-# IBM_PROLOG_END_TAG 
-SUBDIRS = kernext usr
-EXPLIB_SUBDIRS = usr
+SUBDIRS = usr/lib usr/sbin usr/lib/methods kernext
 
-.include <$(RULES_MK)>
+all: kernext/sys/socketvar.h kernext/sys/ioctl.h
+	touch kernext/sys/libsysp.h
+	for i in $(SUBDIRS); do \
+		(cd $$i && $(MAKE) $(MAKEFLAGS)); \
+	done
+
+bff:	all
+	mkdir -p usr/lib/drivers
+	cp kernext/ipf usr/lib/drivers/
+	rm -rf .info
+	sed "s#<scriptdir>#`pwd`#g" ipfilter.tmpl >ipfilter.t
+	mkinstallp -d . -T ipfilter.t
+
+clean:
+	rm -f kernext/sys/socketvar.h
+	for i in $(SUBDIRS); do \
+		(cd $$i && $(MAKE) $(MAKEFLAGS) clean); \
+	done
+	rm -f usr/lib/drivers/ipf
+	rmdir usr/lib/drivers || true
+	rm -f ipfilter.t
+	rm -rf .info
+
+kernext/sys/socketvar.h: /usr/include/sys/socketvar.h
+	mkdir -p kernext/sys
+	sed "s#free_sock_hash_table\[\]#*free_sock_hash_table#g" $^ > $@
+
+kernext/sys/ioctl.h: /usr/include/sys/ioctl.h
+	mkdir -p kernext/sys
+	sed "s#(0x40000000<<1)#(0x80000000)#" $^ | sed "s#((sizeof(t)\&IOCPARM_MASK)#(int)((sizeof(t)\&IOCPARM_MASK)#g" > $@

ipfilter.rte.copyright

@@ -0,0 +1,9 @@
+Copyright 2020 Cisco Systems, Inc. All rights reserved.
+Copyright International Business Machines Corp. 2006, 2017.
+Copyright Ryan Beasley, 2002-2003.
+Copyright The Regents of the University of California, 1982-1983, 1986, 1988-1989, 1990-1997.
+Copyright Digital Equipment Corporation, 1993.
+Copyright Paul J. Ledbetter III, 2002-2003.
+Copyright Darren Reed and Guido van Rooij, 1998-2003.
+Copyright Darren Reed, 1993-2005.
+Copyright RSA Data Security, Inc. 1990.

ipfilter.tmpl

@@ -0,0 +1,35 @@
+Package Name: ipfl
+Package VRMF: 5.3.1.0
+Update: N
+Fileset
+  Fileset Name: ipfl.rte
+  Fileset VRMF: 5.3.1.0
+  Fileset Description: Ipfilter
+  Bosboot required: N
+  Copyright file path: <scriptdir>/ipfilter.rte.copyright
+  License agreement acceptance required: N
+  Include license files in this package: N
+  Requisites:
+  USRFiles
+        /usr/sbin/ipf
+        /usr/sbin/ipfs
+        /usr/sbin/ipfstat
+        /usr/sbin/ipnat
+        /usr/sbin/ippool
+        /usr/sbin/ipscan
+        /usr/sbin/ipmon
+        /usr/sbin/ipsyncm
+        /usr/sbin/ipsyncs
+        /usr/lib/methods/cfg_ipf
+        /usr/lib/drivers/ipf
+  EOUSRFiles
+  USRLIBLPPFiles
+     Pre-installation Script: <scriptdir>/ipfilter.rte.pre_i
+     Post-installation Script: <scriptdir>/ipfilter.rte.post_i
+     Unpost-installation Script: <scriptdir>/ipfilter.rte.unpost_i
+  EOUSRLIBLPPFiles
+  ROOT Part: N
+  ROOTFiles
+  EOROOTFiles
+  Relocatable: Y
+EOFileset

kernext/Makefile

@@ -15,47 +15,48 @@
 # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
 #  
 # IBM_PROLOG_END_TAG 
-.include <${MAKETOP}bos/kernext/Kernext.mk>
 
-VPATH = .:${MAKETOP}/bos/kernel/exp:${MAKETOP}/bos/kernext/inet
+MAKETOP=../..
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet -include strings.h
+CC = gcc
 
-DUALMODE_KEXT   = true
+all:   ipf
 
-KERNEL_EXT = ipf
-KERNEL_EXT32 = ipf32
-KERNEL_EXT64 = ipf64
-
-IDIR            = /usr/lib/drivers/
-ILIST           = ${KERNEL_EXT}
-
-LIBS            = ${KERNEXT_LIBS}
-
-ipf32_ENTRYPOINT = ipfconfig
-ipf64_ENTRYPOINT = ipfconfig
+clean:
+	rm -f *.o ipf
 
 KERNEXT_IMPORTS += sockets.exp kernex.exp netinet.exp statcmd.exp 
 
-INCFLAGS = -I./netinet
-CFLAGS = -DAIX -D_AIX -D_AIX51 -DIPFILTER_LKM -DIPFILTER_LOG \
-	-DIPFILTER_LOOKUP -DIPFILTER_SCAN -DKERNEL -D_KERNEL -DINET
+INCFLAGS = -I. -I./netinet -include strings.h
+CFLAGS = -O2 -nostdlib -DAIX -D_AIX -D_AIX51 -DIPFILTER_LKM -DIPFILTER_LOG \
+	-DIPFILTER_LOOKUP -DIPFILTER_SCAN -DKERNEL -D_KERNEL -DINET ${INCFLAGS}
 FIXRADIX = -Dradix_node=ipf_radix_node -Dradix_node_head=ipf_radix_node_head \
 	-Drn_inithead=ipf_rn_inithead -Drn_walktree=ipf_rn_walktree
 
-fil.o_CFLAGS = ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS
-ip_state.o_CFLAGS = ${CFLAGS} -DIPSTATE_SIZE=127
-ip_pool.o_CFLAGS = ${CFLAGS} ${FIXRADIX}
-ip_lookup.o_CFLAGS = ${CFLAGS} ${FIXRADIX}
+fil.o:  fil.c
+	${CC} -maix64 ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS -c $< -o $@
+
+ip_state.o: ip_state.c
+	${CC} -maix64 ${CFLAGS} -DIPSTATE_SIZE=249989 -DIPSTATE_MAX=1000000 -DIPSTATE_MAXBUCKET=256 -c $< -o $@
+
+ip_pool.o: ip_pool.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
 
-fil.64o_CFLAGS = ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS
-ip_state.64o_CFLAGS = ${CFLAGS} -DIPSTATE_SIZE=127
-ip_pool.64o_CFLAGS = ${CFLAGS} ${FIXRADIX}
-ip_lookup.64o_CFLAGS = ${CFLAGS} ${FIXRADIX}
+ip_lookup.o: ip_lookup.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
+
+radix.o: radix.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
+
+ip_fil_aix.o: ip_fil_aix.c
+	${CC} ${CFLAGS} -maix64 -c $< -o $@
+
+%.o:  %.c
+	${CC} ${CFLAGS} -maix64 -c $< -o $@
 
 OBJFILES = ip_fil_aix.o fil.o md5.o ip_nat.o ip_frag.o ip_state.o \
 	ip_proxy.o ip_auth.o ip_log.o ip_pool.o ip_htable.o \
-	ip_lookup.o ip_sync.o ip_scan.o ip_rules.o radix.o
-
-ipf32_OFILES = ${OBJFILES}
-ipf64_OFILES = ${OBJFILES:.o=.64o}
+	ip_lookup.o ip_sync.o ip_scan.o ip_rules.o radix.o log.o
 
-.include <${RULES_MK}>
+ipf: ${OBJFILES}
+	ld -b64 -o $@ $^ -bI:/usr/lib/kernex.exp -bI:/usr/lib/netinet.exp -bI:/usr/lib/sockets.exp -bI:/usr/lib/statcmd.exp -e ipfconfig -l csys -l sys

kernext/fil.c

@@ -1363,7 +1363,10 @@ fr_info_t *fin;
 	if (off != 0) {
 		fi->fi_flx |= FI_FRAG;
 		off &= IP_OFFMASK;
-		if (off != 0) {
+		//check if we have IP_MF bit set in offset, if yes then only,
+		//go to loop and validate it with given condition
+		// else that would be the last fragment and should not be validated
+		if ((off & ~IP_OFFMASK) != 0) {
 			fin->fin_flx |= FI_FRAGBODY;
 			off <<= 3;
 			if ((off + fin->fin_dlen > 65535) || 

kernext/ip_lookup.c

@@ -57,6 +57,7 @@ struct file;
 # include "radix_ipf_local.h"
 # define _RADIX_H_
 #endif
+#include <netinet/in.h>
 #include <net/if.h>
 #if defined(__FreeBSD__)
 #  include <sys/cdefs.h>
@@ -68,7 +69,6 @@ struct file;
 #  include <sys/mbuf.h>
 # endif
 #endif
-#include <netinet/in.h>
 
 #include "netinet/ip_compat.h"
 #include "netinet/ip_fil.h"

kernext/ip_pool.c

@@ -78,8 +78,8 @@ struct file;
 # include "radix_ipf_local.h"
 # define _RADIX_H_
 #endif
-#include <net/if.h>
 #include <netinet/in.h>
+#include <net/if.h>
 #if defined(_KERNEL) && defined(AIX)
 # include <sys/mbuf.h>
 #endif

kernext/ip_state.c

@@ -174,7 +174,7 @@ int	fr_statemax = IPSTATE_MAX,
 	fr_statesize = IPSTATE_SIZE;
 int	fr_state_doflush = 0,
 	fr_state_lock = 0,
-	fr_state_maxbucket = 0,
+	fr_state_maxbucket = IPSTATE_MAXBUCKET,
 	fr_state_maxbucket_reset = 1,
 	fr_state_init = 0;
 ipftq_t	ips_tqtqb[IPF_TCP_NSTATES],

kernext/log.c

@@ -0,0 +1,22 @@
+#include <syslog.h>
+#include <net/proto_uipc.h>
+#include <stdio.h>
+#include <stdarg.h>
+
+int puts(const char *str)
+{
+  bsdlog(LOG_DEBUG | LOG_KERN, "%.1000s\n",str);
+}
+
+int printf(const char *fmt, ...)
+{
+  int rc;
+  char buf[1024];
+  va_list arg; 
+  va_start(arg, fmt); 
+
+  rc = vsnprintf_np(buf, 1024, fmt, arg);
+  rc = puts(buf);
+  va_end(arg);
+  return rc;
+}

kernext/netinet/ip_state.h

@@ -40,6 +40,9 @@ struct ipscan;
 #ifndef	IPSTATE_MAX
 # define	IPSTATE_MAX	4013	/* Maximum number of states held */
 #endif
+#ifndef IPSTATE_MAXBUCKET
+# define        IPSTATE_MAXBUCKET 0
+#endif
 
 #define	PAIRS(s1,d1,s2,d2)	((((s1) == (s2)) && ((d1) == (d2))) ||\
 				 (((s1) == (d2)) && ((d1) == (s2))))

kernext/radix.c

@@ -118,9 +118,9 @@ static char *rn_zeros = NULL, *rn_ones = NULL;
 #undef Bcmp
 #define Bcmp(a, b, l) (l == 0 ? 0 : bcmp((caddr_t)(a), (caddr_t)(b), (u_long)l))
 
-static int rn_satisfies_leaf __P((char *, struct radix_node *, int));
-static int rn_lexobetter __P((void *, void *));
-static struct radix_mask *rn_new_radix_mask __P((struct radix_node *,
+int rn_satisfies_leaf __P((char *, struct radix_node *, int));
+int rn_lexobetter __P((void *, void *));
+struct radix_mask *rn_new_radix_mask __P((struct radix_node *,
     struct radix_mask *));
 static int rn_freenode __P((struct radix_node *, void *));
 #if defined(AIX) && !defined(_KERNEL)
@@ -247,7 +247,7 @@ rn_lookup(v_arg, m_arg, head)
 	return x;
 }
 
-static int
+int
 rn_satisfies_leaf(trial, leaf, skip)
 	char *trial;
 	struct radix_node *leaf;
@@ -561,7 +561,7 @@ rn_addmask(n_arg, search, skip)
 	return (x);
 }
 
-static int	/* XXX: arbitrary ordering for non-contiguous masks */
+int	/* XXX: arbitrary ordering for non-contiguous masks */
 rn_lexobetter(m_arg, n_arg)
 	void *m_arg, *n_arg;
 {
@@ -576,7 +576,7 @@ rn_lexobetter(m_arg, n_arg)
 	return 0;
 }
 
-static struct radix_mask *
+struct radix_mask *
 rn_new_radix_mask(tt, next)
 	struct radix_node *tt;
 	struct radix_mask *next;

usr/lib/Makefile

@@ -21,8 +21,11 @@ LIBRARIES = libipf.a
 EXPLIB_TARGETS = export_libipf.a
 EXPDIR = /usr/lib/ipfilter/
 
-INCFLAGS = -I${MAKETOP}/ipfl/kernext -I${MAKETOP}/ipfl/kernext/netinet
-CFLAGS = -D_AIX -D_AIX51 -DAIX -qlanglvl=ansi
+MAKETOP=../..
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet -include strings.h
+CC = gcc -maix64
+AR = /usr/bin/ar
+CFLAGS = -O2 -D_AIX -D_AIX51 -DAIX -D_NOGETDELIM ${INCFLAGS}
 
 OFILES = addicmp.o addipopt.o bcopywrap.o \
      binprint.o buildopts.o checkrev.o count6bits.o count4bits.o \
@@ -45,4 +48,9 @@ OFILES = addicmp.o addipopt.o bcopywrap.o \
      to_interface.o var.o verbose.o v6ionames.o v6optvalue.o
 OFILES64 = ${OFILES:.o=.64o}
 
-.include <${RULES_MK}>
+all:	$(LIBRARIES)
+clean:
+	rm -f *.o
+
+$(LIBRARIES):	$(OFILES)
+	$(AR) -Xany $(ARFLAGS) $@ $(OFILES)

usr/lib/checkrev.c

@@ -32,6 +32,7 @@ static char sccsid[] = "@(#)03  1.1  src/ipfl/usr/lib/checkrev.c, ipflt, 53ipfl5
 int checkrev(ipfname)
 char *ipfname;
 {
+#ifdef CHECK_IPL_VERSION
 	static int vfd = -1;
 	struct friostat fio, *fiop = &fio;
 	ipfobj_t ipfo;
@@ -57,5 +58,6 @@ char *ipfname;
 	if (strncmp(IPL_VERSION, fio.f_version, sizeof(fio.f_version))) {
 		return -1;
 	}
+#endif
 	return 0;
 }

usr/lib/load_pool.c

@@ -59,8 +59,13 @@ ioctlfunc_t iocfunc;
 	if ((opts & OPT_REMOVE) == 0) {
 		if ((*iocfunc)(poolfd, SIOCLOOKUPADDTABLE, &op))
 			if ((opts & OPT_DONOTHING) == 0) {
-				perror("load_pool:SIOCLOOKUPADDTABLE");
-				return -1;
+				if (errno == EEXIST) {
+					fprintf(stderr, "Warning load_pool : Pool %s already exists\n", op.iplo_name);
+					return errno;
+				} else {
+					perror("load_pool:SIOCLOOKUPADDTABLE");
+					return -1;
+				}
 			}
 	}
 
@@ -79,8 +84,16 @@ ioctlfunc_t iocfunc;
 	if ((opts & OPT_REMOVE) != 0) {
 		if ((*iocfunc)(poolfd, SIOCLOOKUPDELTABLE, &op))
 			if ((opts & OPT_DONOTHING) == 0) {
-				perror("load_pool:SIOCLOOKUPDELTABLE");
-				return -1;
+				if (errno == EBUSY) {
+					fprintf(stderr,"Warning load_pool : Pool %s still used\n", op.iplo_name);
+					return errno;
+				} else if (errno == ESRCH) {
+					fprintf(stderr,"Warning load_pool : Pool %s does not exist\n", op.iplo_name);
+					return errno;
+				} else {
+					perror("load_pool:SIOCLOOKUPDELTABLE");
+					return -1;
+				}
 			}
 	}
 	return 0;

usr/lib/load_poolnode.c

@@ -69,8 +69,16 @@ ioctlfunc_t iocfunc;
 
 	if (err != 0) {
 		if ((opts & OPT_DONOTHING) == 0) {
-			perror("load_pool:SIOCLOOKUP*NODE");
-			return -1;
+			if (errno == EEXIST) {
+				fprintf(stderr, "Warning load_poolnode : Pool %s already contains %s\n", op.iplo_name, inet_ntoa(pn.ipn_addr.adf_addr.in4));
+				return errno;
+			} else if (errno == ENOENT) {
+				fprintf(stderr, "Warning load_poolnode : Pool %s does not contain %s\n", op.iplo_name, inet_ntoa(pn.ipn_addr.adf_addr.in4));
+				return errno;
+			} else	{
+				perror("load_pool:SIOCLOOKUP*NODE");
+				return -1;
+			}
 		}
 	}