summaryrefslogtreecommitdiff
path: root/sbin/pfctl/pfctl.c
AgeCommit message (Collapse)Author
2005-03-07fd leaks in error paths, From: Andrey Matveev <andrushock@korovino.net>Henning Brauer
2005-03-06print "set skip on" with -v in such a way that the output is valid inputDaniel Hartmeier
syntax, instead of the cryptic hex flags output.
2005-01-06Missing braces in pfctl_load_debug(), pointed out by camield@Ryan Thomas McBride
2005-01-05Modify pfctl behaviour so that 'set ...' options are no longer "sticky", ie.Ryan Thomas McBride
they are reset to default values if omitted from a subsequent ruleset load. Also: - make sure 'set ...' options are not loaded in anchors. - add a -m ("merge") flag to pfctl which allows an individual option to be set without reseting the others, eg: # echo "set loginterface fxp0" | pfctl -mf - ok henning@ dhartmei@
2004-12-29change last commit so that the test for PF_OPT_NOACTION is actually inDan Harnett
pfctl_clear_interface_flags(). suggested by and ok henning@
2004-12-29don't clear interface flags if '-n' option was given.Dan Harnett
ok henning@
2004-12-29be quiet about resetting the interface flags omn ruleset load, onlyHenning Brauer
print that info on manual flushes. noticed by marc@
2004-12-28reset skip interface flags on reloads and for -FallHenning Brauer
from max, this time working :)
2004-12-27unbreak treeTheo de Raadt
2004-12-27reset skip interface flags on reloads and for -FallHenning Brauer
from max
2004-12-22Introduce 'set skip on <ifspec>' to support a list of interfaces where noDaniel Hartmeier
packet filtering should occur (like loopback, for instance). Code from Max Laier, with minor improvements based on feedback from deraadt@. ok mcbride@, henning@
2004-09-21Implement "no scrub" to allow exclusion of specific traffic from scrub rules.Aaron Campbell
First match wins, just like "no {binat,nat,rdr}". henning@, dhartmei@ ok
2004-08-26sync usage for -aJared Yanovich
reminded by jmc, ok deraadt
2004-08-08spacingTheo de Raadt
2004-07-23- make SYNOPSIS and usage() clear that -t precedes -T;Jason McIntyre
spotted by Tamas Tevesh, via dhartmei@; also, add -o to usage(), and note that /ruleset is now the correct syntax, not :ruleset; ok dhartmei@
2004-07-19print the correct labels when displaying timeouts with pfctl (eg, pfctl -st).David Gwynne
From Chris Pascoe. ok dhartmei@
2004-07-16'pfctl -o' ruleset optimizer that doesnt change the meaning of the final rulesetMike Frantzen
- remove identical and subsetted rules - when advantageous merge rules w/ similar addresses into a table and one rule - re-order rules to improve skip step performance (can do better w/ kernel mods) - 'pfctl -oo' will load the currently running ruleset and use it as a profile to direct the optimization of quicked rules ok henning@ mcbride@. man page help from jmc@
2004-05-21Use '/' instead of ':' as separator for anchor path components. Note thatDaniel Hartmeier
the parser now needs quotes around paths containing separators. ok mcbride@
2004-05-19Allow recursive anchors (anchors within anchors, up to 64Daniel Hartmeier
levels deep). More work required, but this is already functional. authpf users will need to adjust their anchor calls, but this will change again soon. ok beck@, cedric@, henning@, mcbride@
2004-05-05Use RFC1323 PAWS timestamps as a logical extension to the conventional TCPMike Frantzen
sequence numbers by taking advantage of the maximum 1KHz clock as an upperbound on the timestamp. Typically gains 10 to 18 bits of additional security against blind data insertion attacks. More if the TS Echo wasn't optional :-( Enabled with: scrub on !lo0 all reassemble tcp ok dhartmei@. documentation help from jmc@
2004-04-09Do not try to load directories. found+ok mpech@Cedric Berger
2004-03-20make pfctl -s osfp work and remove -o option from manpage; ok deraadt@David Krause
pointed out by David Hill <davidh at wmis dot net>
2004-03-15cast %llu arguments to unsigned long long, from Max Laier,Daniel Hartmeier
ok henning@ cedric@
2004-03-03no newline in errx, bad cedric; spotted by teduTheo de Raadt
2004-02-27make pfctl -s all a bit more useful again by not printing a lllooooooottttt ofHenning Brauer
OS fingerprints and a list of interface drivers... cedric deraadt ok
2004-02-26Fix/Simplify printing of titles with "pfctl -s all". ok mcbride@Cedric Berger
2004-02-25Don't clear global stuff when an anchor is given in addition to -Fa.Cedric Berger
Ok mcbride@ pb@
2004-02-19Makes pfctl -ss and pfctl -sq use optional -i argument.Cedric Berger
ok dhartmei@ markus@ mcbride@
2004-02-19Makes pfctl -Fs and pfctl -w works with the optional -i specifier.Cedric Berger
Kernel/Userland Sync needed. ok dhartmei@ jmc@ markus@ mcbride@
2004-02-17add -i flag, use it for -sI as a start. ok henning@, ok+test mcbride@Cedric Berger
2004-02-12- sort SYNOPSIS and options listJason McIntyre
- add -p to SYNOPSIS - uppercase start of sentence - sync usage() w/ SYNOPSIS
2004-02-12add -p flag to specify the device - ok mcbride@, henning@ with no objectionsBob Beck
from deraadt@
2004-02-10KNFDaniel Hartmeier
2004-02-10KNFHenning Brauer
2004-02-04Fix a number of bugs with setting pool limits which I introduced withRyan Thomas McBride
source-tracking. Found by Pyun YongHyeon. Also add support to pfctl to set the src-nodes pool limit. "Luckily" some of the bugs cancel each other out; update kernel before pfctl. ok dhartmei@
2004-01-29Clean up 'pfctl -s all' output.Ryan Thomas McBride
ok deraadt@ henning@
2003-12-31spacing. note this, cedricTheo de Raadt
2003-12-31Many improvements to the handling of interfaces in PF.Cedric Berger
1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
2003-12-19i wrote much of these, assert my copyrightHenning Brauer
2003-12-16hostid is stored in network byte order, print in host byte order.Ryan Thomas McBride
2003-12-15Add initial support for pf state synchronization over the network.Ryan Thomas McBride
Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@
2003-12-15Add support to track stateful connections by source ip. This allows usRyan Thomas McBride
to: - Ensure that clients get a consistent IP mapping with load-balanced translation/routing rules - Limit the number of simultaneous connections a client can make - Limit the number of clients which can connect through a rule ok dhartmei@ deraadt@
2003-11-14allow the debuglevel to be set from pf.conf (set debug)Henning Brauer
ok cedric@
2003-11-06KNFHenning Brauer
2003-10-02clean up p = realloc(pRyan Thomas McBride
ok deraadt@ henning@
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-08-29Document interactions between tables and anchors.Cedric Berger
Add a warning on global/anchor name clashes to help prevent mistakes from our users during the 3.3 -> 3.4 switch. ok henning@
2003-08-22move pfctl_file_fingerprints() call, table commands can use -f themselvesDaniel Hartmeier
(like pfctl -t spammers -vvTt -f file, causing EPERM on DIOCOSFPFLUSH).
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
2003-08-04Not every suggested patch is perfect :)Daniel Hartmeier
ERRX() has two effects: the message printing and goto _error; which causes exit(1). While we don't want the message if pfctl was invoked with -n, we DO want to abort. Otherwise subsequent 'load anchor' statements will get executed, for instance, and the return value is handy for scripts.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-06 06:22:18 +0000