| Age | Commit message (Collapse) | Author |
|---|
|
From: "Alexey E. Suslikov" <cruel@texnika.com.ua>
|
|
option to log. so, 'log-all' becomes 'log (all)'.
|
|
|
|
inserted the rule which causes the logging. secondly, the uid/pid of the
process in case the logged packet is delivered to/from a local socket.
a lookup of the local socket can be forced for logged packets with a new
option, 'log (user)'. make tcpdump print the additional information when
-e and -v is used. note: this changes the pflog header struct, rebuild all
dependancies. ok bob@, henning@.
|
|
'keep state'), as a condition to branch into the anchor. suggested
by Bill Marquette.
|
|
ok dhartmei
|
|
from camield@. use #defines PF_LOG, PF_LOGALL instead of magic constants.
ok frantzen@, camield@
|
|
ok dhartmei mcbride
|
|
useless layers of indirection and make the code way cleaner overall.
this is just the start, more to come...
worked very hard on by Ryan and me in Montreal last week, on the airplane to
vancouver and yesterday here in calgary. it hurt.
ok ryan theo
|
|
if there are flags on the lefthandside that are masked off by the
righthand side.
ok mcbride@ (long time ago) dhartmei@ henning@
|
|
From: Andrey Matveev <andrushock@korovino.net>
|
|
PR4134 / geoff@collyer.net and a longer mail exhcange with han boetes
|
|
syntax, instead of the cryptic hex flags output.
|
|
ok henning@, deraadt@
|
|
is infinite... Andrey Matveev <andrushock@korovino.net> spotted a few again!
|
|
|
|
found by Peter Fraser, ok henning@
|
|
"(10.1.2.3)" that results from a simple typo like "$(ext_ip)" instead of
"$(ext_if)".
|
|
they are reset to default values if omitted from a subsequent ruleset load.
Also:
- make sure 'set ...' options are not loaded in anchors.
- add a -m ("merge") flag to pfctl which allows an individual option to be set
without reseting the others, eg:
# echo "set loginterface fxp0" | pfctl -mf -
ok henning@ dhartmei@
|
|
|
|
using regress test pf84
|
|
packet filtering should occur (like loopback, for instance).
Code from Max Laier, with minor improvements based on feedback from
deraadt@. ok mcbride@, henning@
|
|
|
|
pass in from route dtag keep state queue reallyslow
tested by Gabriel Kihlman <gk@stacken.kth.se> and
Michael Knudsen <e@molioner.dk> and ryan
ok ryan
|
|
fix some cut-n-paste mayhem in other related checks.
|
|
pfvar.h. builds kernel and userland.
|
|
|
|
|
|
----
Change the default for 'overload <table> flush' to flush only states from the
offending source created by the rule. 'flush global' flushes all states
originating from the offending source. ABI change, requires kernel and pfctl
to be in sync.
ok deraadt@ henning@ dhartmei@
|
|
offending source created by the rule. 'flush global' flushes all states
originating from the offending source. ABI change, requires kernel and pfctl
to be in sync.
ok deraadt@ henning@ dhartmei@
|
|
|
|
keep state (max-src-conn 1000, max-src-conn-rate 100/10, overflow <bad> flush)
allow a maximum of 1000 open connections or 100 new connections in 10 seconds.
The addresses of offenders are added to the <bad> table which can be used in
the ruleset, and existing states from that host are flushed.
ok deraadt@ dhartmei@
|
|
First match wins, just like "no {binat,nat,rdr}". henning@, dhartmei@ ok
|
|
this was meant to verify that ne3 is a valid interface that could show
up, but bogus0 is not. while this might sound like a good idea it is
completely broken and causes a shitload of problems. just allow for anything
as interface name, the kernel abstracts that nice enough. if no interface
by that name exists (or shows up) the rule never matches; that matches
pf semantics used everywhere else.
this also fixes the "pfctl always has to run as root" issue that cedric
did not fix over the last 6 months despite being bugged to regularily.
help & ok mcbride@
|
|
a interface name's slack space past the \0. will be needed for the optimizer.
ok henning@
|
|
ok canacar@ mcbride@
|
|
|
|
keyword in C++. ok henning@, cedric@
|
|
the parser now needs quotes around paths containing separators.
ok mcbride@
|
|
levels deep). More work required, but this is already
functional. authpf users will need to adjust their anchor
calls, but this will change again soon. ok beck@, cedric@,
henning@, mcbride@
|
|
|
|
|
|
|
|
|
|
|
|
ok mcbride@ pb@ dhartmei@
|
|
plug a memory leak in the lexer.
the issue is this code fragement from yylex():
. token = lookup(buf);
. yylval.v.string = strdup(buf);
. if (yylval.v.string == NULL)
. err(1, "yylex: strdup");
. return (token);
lookup() tries to match buf against a list of keywords, and returns the
associated token if it has a match, or the token STRING otherwise.
STRING is the only token that needs (and free()s) yylval.v.string. however,
we assigned memory for it with the strdup in yylex for each and every token.
the fix is obviously only setting yylval.v.string when lookup() returns STRING.
Patrick Latifi noticed that something was leaking with token handling,
analysis and fix by me.
ok deraadt@
|
|
ok henning@, cedric@
|
|
unless 'source-track global' is explicit, in which case error out. Lots of
help from cedric@.
ok cedric@ henning@
|
|
|
