summaryrefslogtreecommitdiff
path: root/sbin/pfctl/pfctl.c
AgeCommit message (Collapse)Author
2005-07-11clear PFI_IFLAG_SKIP when clearing interface flags, found by David Hill,Daniel Hartmeier
ok henning@
2005-06-13make the packet and byte counters on rules and src nodes per direction,Henning Brauer
matches the counters on states now. also fix the counting on scrub rules where we previously did not handle the byte counters at all. extend pfctl -sl output to include the new seperate in/out counters hacked on the ferry from Earls Cove to Saltery Bay ok ryan
2005-06-13free memory in show_src_nodes and show_states, as reported byJared Yanovich
Henrik Gustafsson <openbsd@fnord.se> via tech@. ok henning
2005-05-28don't print the "[ Inserted: uid pid ]" line when -g is used, so theDaniel Hartmeier
regress tests don't have to deal with it (and it's a useless thing to check from there).
2005-05-27log two pairs of uid/pid through pflog: the uid/pid of the process thatDaniel Hartmeier
inserted the rule which causes the logging. secondly, the uid/pid of the process in case the logged packet is delivered to/from a local socket. a lookup of the local socket can be forced for logged packets with a new option, 'log (user)'. make tcpdump print the additional information when -e and -v is used. note: this changes the pflog header struct, rebuild all dependancies. ok bob@, henning@.
2005-05-23change pool allocation of table entries, no longer use the oldnointrDaniel Hartmeier
allocator and two pools, but PR_WAITOK when called from non-interrupt context (ioctl). add configurable hard limits for tables and table entries (set limit tables/table-entries), defaulting to 1000/100000. ok aaron@, henning@, mcbride@, art@
2005-05-22Add support to kill states that match networks.Marco Pfatschbacher
man page from jmc@ OK dhartmei@
2005-05-21clean up and rework the interface absraction code big time, rip out multipleHenning Brauer
useless layers of indirection and make the code way cleaner overall. this is just the start, more to come... worked very hard on by Ryan and me in Montreal last week, on the airplane to vancouver and yesterday here in calgary. it hurt. ok ryan theo
2005-05-05typoJoel Knight
2005-03-07fd leaks in error paths, From: Andrey Matveev <andrushock@korovino.net>Henning Brauer
2005-03-06print "set skip on" with -v in such a way that the output is valid inputDaniel Hartmeier
syntax, instead of the cryptic hex flags output.
2005-01-06Missing braces in pfctl_load_debug(), pointed out by camield@Ryan Thomas McBride
2005-01-05Modify pfctl behaviour so that 'set ...' options are no longer "sticky", ie.Ryan Thomas McBride
they are reset to default values if omitted from a subsequent ruleset load. Also: - make sure 'set ...' options are not loaded in anchors. - add a -m ("merge") flag to pfctl which allows an individual option to be set without reseting the others, eg: # echo "set loginterface fxp0" | pfctl -mf - ok henning@ dhartmei@
2004-12-29change last commit so that the test for PF_OPT_NOACTION is actually inDan Harnett
pfctl_clear_interface_flags(). suggested by and ok henning@
2004-12-29don't clear interface flags if '-n' option was given.Dan Harnett
ok henning@
2004-12-29be quiet about resetting the interface flags omn ruleset load, onlyHenning Brauer
print that info on manual flushes. noticed by marc@
2004-12-28reset skip interface flags on reloads and for -FallHenning Brauer
from max, this time working :)
2004-12-27unbreak treeTheo de Raadt
2004-12-27reset skip interface flags on reloads and for -FallHenning Brauer
from max
2004-12-22Introduce 'set skip on <ifspec>' to support a list of interfaces where noDaniel Hartmeier
packet filtering should occur (like loopback, for instance). Code from Max Laier, with minor improvements based on feedback from deraadt@. ok mcbride@, henning@
2004-09-21Implement "no scrub" to allow exclusion of specific traffic from scrub rules.Aaron Campbell
First match wins, just like "no {binat,nat,rdr}". henning@, dhartmei@ ok
2004-08-26sync usage for -aJared Yanovich
reminded by jmc, ok deraadt
2004-08-08spacingTheo de Raadt
2004-07-23- make SYNOPSIS and usage() clear that -t precedes -T;Jason McIntyre
spotted by Tamas Tevesh, via dhartmei@; also, add -o to usage(), and note that /ruleset is now the correct syntax, not :ruleset; ok dhartmei@
2004-07-19print the correct labels when displaying timeouts with pfctl (eg, pfctl -st).David Gwynne
From Chris Pascoe. ok dhartmei@
2004-07-16'pfctl -o' ruleset optimizer that doesnt change the meaning of the final rulesetMike Frantzen
- remove identical and subsetted rules - when advantageous merge rules w/ similar addresses into a table and one rule - re-order rules to improve skip step performance (can do better w/ kernel mods) - 'pfctl -oo' will load the currently running ruleset and use it as a profile to direct the optimization of quicked rules ok henning@ mcbride@. man page help from jmc@
2004-05-21Use '/' instead of ':' as separator for anchor path components. Note thatDaniel Hartmeier
the parser now needs quotes around paths containing separators. ok mcbride@
2004-05-19Allow recursive anchors (anchors within anchors, up to 64Daniel Hartmeier
levels deep). More work required, but this is already functional. authpf users will need to adjust their anchor calls, but this will change again soon. ok beck@, cedric@, henning@, mcbride@
2004-05-05Use RFC1323 PAWS timestamps as a logical extension to the conventional TCPMike Frantzen
sequence numbers by taking advantage of the maximum 1KHz clock as an upperbound on the timestamp. Typically gains 10 to 18 bits of additional security against blind data insertion attacks. More if the TS Echo wasn't optional :-( Enabled with: scrub on !lo0 all reassemble tcp ok dhartmei@. documentation help from jmc@
2004-04-09Do not try to load directories. found+ok mpech@Cedric Berger
2004-03-20make pfctl -s osfp work and remove -o option from manpage; ok deraadt@David Krause
pointed out by David Hill <davidh at wmis dot net>
2004-03-15cast %llu arguments to unsigned long long, from Max Laier,Daniel Hartmeier
ok henning@ cedric@
2004-03-03no newline in errx, bad cedric; spotted by teduTheo de Raadt
2004-02-27make pfctl -s all a bit more useful again by not printing a lllooooooottttt ofHenning Brauer
OS fingerprints and a list of interface drivers... cedric deraadt ok
2004-02-26Fix/Simplify printing of titles with "pfctl -s all". ok mcbride@Cedric Berger
2004-02-25Don't clear global stuff when an anchor is given in addition to -Fa.Cedric Berger
Ok mcbride@ pb@
2004-02-19Makes pfctl -ss and pfctl -sq use optional -i argument.Cedric Berger
ok dhartmei@ markus@ mcbride@
2004-02-19Makes pfctl -Fs and pfctl -w works with the optional -i specifier.Cedric Berger
Kernel/Userland Sync needed. ok dhartmei@ jmc@ markus@ mcbride@
2004-02-17add -i flag, use it for -sI as a start. ok henning@, ok+test mcbride@Cedric Berger
2004-02-12- sort SYNOPSIS and options listJason McIntyre
- add -p to SYNOPSIS - uppercase start of sentence - sync usage() w/ SYNOPSIS
2004-02-12add -p flag to specify the device - ok mcbride@, henning@ with no objectionsBob Beck
from deraadt@
2004-02-10KNFDaniel Hartmeier
2004-02-10KNFHenning Brauer
2004-02-04Fix a number of bugs with setting pool limits which I introduced withRyan Thomas McBride
source-tracking. Found by Pyun YongHyeon. Also add support to pfctl to set the src-nodes pool limit. "Luckily" some of the bugs cancel each other out; update kernel before pfctl. ok dhartmei@
2004-01-29Clean up 'pfctl -s all' output.Ryan Thomas McBride
ok deraadt@ henning@
2003-12-31spacing. note this, cedricTheo de Raadt
2003-12-31Many improvements to the handling of interfaces in PF.Cedric Berger
1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
2003-12-19i wrote much of these, assert my copyrightHenning Brauer
2003-12-16hostid is stored in network byte order, print in host byte order.Ryan Thomas McBride
2003-12-15Add initial support for pf state synchronization over the network.Ryan Thomas McBride
Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@