Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_input.c =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_input.c (revision 20287) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_input.c (working copy) @@ -3164,7 +3164,9 @@ client_pcb = (clickpcb_t *)(nat_entry->client_pcb); server_pcb = (clickpcb_t *)(nat_entry->server_pcb); - if (response_icmp->icmp_type == ICMP_ECHOREPLY) { + // Jason Chou add type ICMP_TSTAMPREPLY + if (response_icmp->icmp_type == ICMP_ECHOREPLY || + response_icmp->icmp_type == ICMP_TSTAMPREPLY) { /* change of ICMP ID will lead to change of ICMP checksum */ response_icmp->icmp_id = htons(client_pcb->cp_localport); response_icmp->icmp_cksum = incr_check_s(response_icmp->icmp_cksum, Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/net/click_ether.c =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/net/click_ether.c (revision 20287) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/net/click_ether.c (working copy) @@ -139,7 +139,7 @@ static char *i_type[] = { "echoreply", "", "", "", "", "", "", "", "echorequest", "", - "", "", "", "", "", + "", "", "", "timerequest", "timereply", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", @@ -210,6 +210,10 @@ tp->sport = ICMP_ECHO + 1; } else if (icmph->icmp_type == ICMP_ECHO) { tp->sport = ICMP_ECHOREPLY + 1; + } else if (icmph->icmp_type == ICMP_TSTAMP) { /* Jason Chou */ + tp->sport = ICMP_TSTAMPREPLY + 1; + } else if (icmph->icmp_type == ICMP_TSTAMPREPLY) { /* Jason Chou */ + tp->sport = ICMP_TSTAMP + 1; } else { m_freem(m); return FW_ERROR; @@ -577,6 +581,11 @@ tp->sport = htons(icmph->icmp_type + 1);/* fake, network order */ tp->dport = 0; break; + case ICMP_TSTAMP: /* Jason Chou */ + case ICMP_TSTAMPREPLY: + tp->sport = htons(icmph->icmp_type + 1);/* fake, network order */ + tp->dport = 0; + break; case ICMP_TIMXCEED: case ICMP_UNREACH: m = m_pull(m, 2 * sizeof(struct ip) + 8); @@ -864,6 +873,11 @@ tp->sport = icmph->icmp_type + 1;/* need host order */ tp->dport = icmph->icmp_id; break; + case ICMP_TSTAMP: /* Jason Chou */ + case ICMP_TSTAMPREPLY: + tp->sport = icmph->icmp_type + 1;/* need host order */ + tp->dport = icmph->icmp_id; + break; case ICMP_TIMXCEED: case ICMP_UNREACH: iph = mtod(m, struct ip*); Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_icmp.c =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_icmp.c (revision 20287) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_icmp.c (working copy) @@ -96,7 +96,9 @@ ih = GETHDR(ip, icmp); ic_ip = &ih->icmp_ip; - if (ih->icmp_type == ICMP_ECHO || ih->icmp_type == ICMP_ECHOREPLY) { + /* Add ICMP_TSTAMP and ICMP_TSTAMPREPLY by Jason Chou */ + if (ih->icmp_type == ICMP_ECHO || ih->icmp_type == ICMP_ECHOREPLY || + ih->icmp_type == ICMP_TSTAMP || ih->icmp_type == ICMP_TSTAMPREPLY) { if (click_ww_mode == WW_MODE_NORMAL) { ww_res = webwall_check(m); } else if (click_ww_mode == WW_MODE_PASS) { Index: /branches/rel_ag_9_4_5/firewall/user_app/cafw.c =================================================================== --- /branches/rel_ag_9_4_5/firewall/user_app/cafw.c (revision 20287) +++ /branches/rel_ag_9_4_5/firewall/user_app/cafw.c (working copy) @@ -106,6 +106,52 @@ } /* + * accesslist permit icmp timestamp request ... Jason Chou + */ +int +accesslist_permit_icmp_timerequest(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp request is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMP + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_PERMIT, FW_ADD); +} + +/* + * accesslist permit icmp timestamp reply ... Jason Chou + */ +int +accesslist_permit_icmp_timereply(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp reply is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMPREPLY + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_PERMIT, FW_ADD); +} + +/* * accesslist permit tcp ... */ int @@ -200,6 +246,52 @@ } /* + * accesslist deny icmp timestamp request ... Jason Chou + */ +int +accesslist_deny_icmp_timerequest(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp request is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMP + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_DENY, FW_ADD); +} + +/* + * accesslist deny icmp timestamp reply ... Jason Chou + */ +int +accesslist_deny_icmp_timereply(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp reply is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMPREPLY + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_DENY, FW_ADD); +} + +/* * accesslist deny tcp ... */ int @@ -294,6 +386,52 @@ } /* + * no accesslist permit icmp timestamp request ... Jason Chou + */ +int +no_accesslist_permit_icmp_timerequest(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp request is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMP + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_PERMIT, FW_DEL); +} + +/* + * no accesslist permit icmp timestamp reply ... Jason Chou + */ +int +no_accesslist_permit_icmp_timereply(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp reply is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMPREPLY + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_PERMIT, FW_DEL); +} + +/* * no accesslist permit tcp ... */ int @@ -388,6 +526,52 @@ } /* + * no accesslist deny icmp timestamp request ... Jason Chou + */ +int +no_accesslist_deny_icmp_timerequest(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp request is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMP + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_DENY, FW_DEL); +} + +/* + * no accesslist deny icmp timestamp reply ... Jason Chou + */ +int +no_accesslist_deny_icmp_timereply(char* sip, uint32_t smask, + char* dip, uint32_t dmask, + uint16_t list_id) +{ + uint16_t sport; + uint8_t proto; + + if(strstr(sip, ".") == NULL){ + ui_fail(ERR_INTERNAL, "timestamp reply is not support in IPv6\n"); + return FW_ERROR; + }else{ + sport = ICMP_TSTAMPREPLY + 1; + proto = IPPROTO_ICMP; + } + + return accesslist(sip, smask, sport, dip, dmask, 0, + list_id, proto, FW_DENY, FW_DEL); +} + +/* * no accesslist deny tcp ... */ int @@ -728,7 +912,8 @@ "esp", "ah","", "", "" }; static char *fw_itype[] = { "", "echoreply", "", "", "", "", - "", "", "", "echorequest", "" }; + "", "", "", "echorequest", "", "", "", + "", "timerequest", "timereply"}; /* get the list of accesslists */ len = sizeof(ca); if (sysctlbyname("kern.clickbuf", &ca, &len, NULL, 0) < 0) { Index: /branches/rel_ag_9_4_5/restfulapi/proxy/ag/models/system/__init__.py =================================================================== --- /branches/rel_ag_9_4_5/restfulapi/proxy/ag/models/system/__init__.py (revision 20292) +++ /branches/rel_ag_9_4_5/restfulapi/proxy/ag/models/system/__init__.py (working copy) @@ -237,6 +237,8 @@ icmp_type = EnumField(verbose_name=_('ICMP Type'), default = 'echorequest', condition=ValueCondition('protocol',['icmp']), values=( ('echorequest', 'Echorequest'), ('echoreply', 'Echoreply'), + ('timerequest', 'Timerequest'), + ('timereply', 'Timereply'), )) class Meta: verbose_name = _('Access List') Index: /branches/rel_ag_9_4_5/restfulapi/proxy/media/docs/rest/ag_2017_03_08/system/accesslist.html =================================================================== --- /branches/rel_ag_9_4_5/restfulapi/proxy/media/docs/rest/ag_2017_03_08/system/accesslist.html (revision 20292) +++ /branches/rel_ag_9_4_5/restfulapi/proxy/media/docs/rest/ag_2017_03_08/system/accesslist.html (working copy) @@ -158,7 +158,7 @@ default icmp_type enum - Available values:
+ Available values:
@@ -429,7 +429,7 @@ icmp_type enum - Available values:
+ Available values:
@@ -679,7 +679,7 @@ default icmp_type enum - Available values:
+ Available values:
Index: /branches/rel_ag_9_4_5/ui/generator/commands.pm =================================================================== --- /branches/rel_ag_9_4_5/ui/generator/commands.pm (revision 20287) +++ /branches/rel_ag_9_4_5/ui/generator/commands.pm (working copy) @@ -2831,6 +2831,90 @@ }, { obj_type => "ITEM", + name => "timerequest", + module => "network", + menu => "root_accesslist_permit_icmp", + help_string => "Add an accesslist permit icmp timestamp-request rule", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + function_name => "accesslist_permit_icmp_timerequest", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Permit source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Permit source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Permit destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Permit destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", + name => "timereply", + module => "network", + menu => "root_accesslist_permit_icmp", + help_string => "Add an accesslist permit icmp timestamp-reply rule", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + function_name => "accesslist_permit_icmp_timereply", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Permit source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Permit source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Permit destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Permit destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", name => "tcp", module => "network", menu => "root_accesslist_permit", @@ -3139,6 +3223,90 @@ }, { obj_type => "ITEM", + name => "timerequest", + module => "network", + menu => "root_accesslist_deny_icmp", + help_string => "Add an accesslist deny icmp timestamp-request rule", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + function_name => "accesslist_deny_icmp_timerequest", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Deny source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Deny source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Deny destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Deny destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_name", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", + name => "timereply", + menu => "root_accesslist_deny_icmp", + module => "network", + help_string => "Add an accesslist deny icmp timestamp-reply rule", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + function_name => "accesslist_deny_icmp_timereply", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Deny source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Deny source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Deny destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name =>"dest_mask", + help_string => "Deny destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", name => "tcp", module => "network", menu => "root_accesslist_deny", @@ -3457,6 +3625,90 @@ }, { obj_type => "ITEM", + name => "timerequest", + module => "network", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + menu => "root_no_accesslist_permit_icmp", + help_string => "Remove an accesslist permit icmp timestamp-request rule", + function_name => "no_accesslist_permit_icmp_timerequest", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Permit source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Permit source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Permit destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Permit destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", + name => "timereply", + module => "network", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + menu => "root_no_accesslist_permit_icmp", + help_string => "Remove an accesslist permit icmp timestamp-reply rule", + function_name => "no_accesslist_permit_icmp_timereply", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Permit source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Permit source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Permit destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Permit destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", name => "tcp", module => "network", cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", @@ -3729,6 +3981,90 @@ function_args => [ { type => "IPADDR", name => "source_ip", + help_string => "Deny source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Deny source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Deny destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Deny destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", + name => "timerequest", + module => "network", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + help_string => "Remove an accesslist deny icmp timestamp-request rule", + menu => "root_no_accesslist_deny_icmp", + function_name => "no_accesslist_deny_icmp_timerequest", + function_args => [ { + type => "IPADDR", + name => "source_ip", + help_string => "Deny source IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "source_mask", + help_string => "Deny source mask", + optional => "NO", + }, + { + type => "IPADDR", + name => "dest_ip", + help_string => "Deny destination IP", + optional => "NO", + }, + { + type => "IPMASK", + name => "dest_mask", + help_string => "Deny destination mask", + optional => "NO", + }, + { + type => "U16", + name => "acc_list_id", + help_string => "Access list ID (1-999)", + optional => "NO", + min => "1", + max => "ACC_LIST_ID_MAX", + }, ], + }, + { + obj_type => "ITEM", + name => "timereply", + module => "network", + cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_GLOBAL", + user_level => "CLI_LEVEL_CONFIG", + help_string => "Remove an accesslist deny icmp timestamp-reply rule", + menu => "root_no_accesslist_deny_icmp", + function_name => "no_accesslist_deny_icmp_timereply", + function_args => [ { + type => "IPADDR", + name => "source_ip", help_string => "Deny source IP", optional => "NO", }, Index: /branches/rel_ag_9_4_5/webui/proxy/new/incGlobal/sysConfig/webwall/class.cliWrap_gWebwallACLAddEntry.php =================================================================== --- /branches/rel_ag_9_4_5/webui/proxy/new/incGlobal/sysConfig/webwall/class.cliWrap_gWebwallACLAddEntry.php (revision 20287) +++ /branches/rel_ag_9_4_5/webui/proxy/new/incGlobal/sysConfig/webwall/class.cliWrap_gWebwallACLAddEntry.php (working copy) @@ -90,7 +90,7 @@ $this->gPermissionArr = array("PERMIT", "DENY"); $this->gProtocolArr = array("ICMP", "TCP", "UDP","AH","ESP"); - $this->gIcmpArr = array("Echorequest", "Echoreply"); + $this->gIcmpArr = array("Echorequest", "Echoreply", "Timerequest", "Timereply"); // ------------------------------------------------------------ // Determine which tab (Add or Edit page) we are in so that we can use Index: /branches/rel_ag_9_4_5/webui/proxy/webwall/accessgroups.html =================================================================== --- /branches/rel_ag_9_4_5/webui/proxy/webwall/accessgroups.html (revision 20287) +++ /branches/rel_ag_9_4_5/webui/proxy/webwall/accessgroups.html (working copy) @@ -72,7 +72,7 @@ ICMP Type: -