summaryrefslogtreecommitdiff
path: root/sbin/pfctl/pfctl.c
AgeCommit message (Collapse)Author
2003-11-14allow the debuglevel to be set from pf.conf (set debug)Henning Brauer
ok cedric@
2003-11-06KNFHenning Brauer
2003-10-02clean up p = realloc(pRyan Thomas McBride
ok deraadt@ henning@
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-08-29Document interactions between tables and anchors.Cedric Berger
Add a warning on global/anchor name clashes to help prevent mistakes from our users during the 3.3 -> 3.4 switch. ok henning@
2003-08-22move pfctl_file_fingerprints() call, table commands can use -f themselvesDaniel Hartmeier
(like pfctl -t spammers -vvTt -f file, causing EPERM on DIOCOSFPFLUSH).
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
2003-08-04Not every suggested patch is perfect :)Daniel Hartmeier
ERRX() has two effects: the message printing and goto _error; which causes exit(1). While we don't want the message if pfctl was invoked with -n, we DO want to abort. Otherwise subsequent 'load anchor' statements will get executed, for instance, and the return value is handy for scripts.
2003-08-04don't whine about "cannot load ruleset" when ruleset load wasn't desiredHenning Brauer
(with pfctl -n) Jared Yanovich <phirerunner@comcast.net>
2003-07-31Make table tickets per-ruleset instead of global.Cedric Berger
Make table tickets u_int32_t for consistency with other parts of PF. Ok dhartmei@ henning@
2003-07-18Simplify handling of flags (-R, -N...). Remove PFCTL_FLAG_ALL.Cedric Berger
ok dhartmei@
2003-07-11Better parsing and -v support for tables:Cedric Berger
- remove the tableaddrs and tableaddr yacc production and reuse host_list instead. - produce better error messages. - do not load addresses from external file when it is not required (like with -R option). - store initializers in a new node_tinit linked list before putting them into the address buffer (see next point). - add a new print_tabledef() function, which makes "pfctl -nvf" print something useful for table definitions, which in turn makes it possible to write better regress tests (see first chunk of the diff) and bring table definition consistant with other parsed rules. ok dhartmei@
2003-07-03Bye bye atexit(), bye bye globals...Cedric Berger
The pfctl.c part will probably need some further improvements. ok henning@
2003-07-03This patch finally cleanup pfctl_table.c. No more global buffer,Cedric Berger
and a couple of parsing functions moved to parse.y or pfctl_parser where they belong. I also took the opportunity to replace "void" functions with exit(1) or err() inside by "int" functions, with the caller checking the return value for errors (much cleaner and an old request from Theo) ok dhartmei@ henning@
2003-06-29Replace assert(3) calls with warnx(3), if the warning is relevant at all.Daniel Hartmeier
2003-06-13Make "show Anchor" obey quiet flag.Cedric Berger
ok henning@
2003-06-03process show options before ruleset reloadHenning Brauer
2003-05-19don't print altq en-/disabled - there's no point, you can't turn them onHenning Brauer
and off independently. so only complain if there's a real error. ok dhartmei@ pb@ camield@
2003-05-19style consistencyHenning Brauer
2003-05-18in the pfctl -vsr output (-vvsr/-gvvsr as well), indent instead of extraHenning Brauer
newline. requested by markus@, dhartmei and myself agree
2003-05-17A little bugfix. We want pfioc_states, not pfioc_state.Ryan Thomas McBride
ok henning@
2003-05-12Adaptive timeout value scaling. Allows to reduce timeout values as theDaniel Hartmeier
number of state table entries grows, so entries time out faster before the table fills up. Works both globally and per-rule. ok frantzen@
2003-05-10support loading of anchors from within the main ruleset viaHenning Brauer
load anchor anchorname:rulesetname file /path/to/file ok pb@ dhartmei@ cedric@
2003-04-30kill globals anchorname and rulesetname; have them in main instead and passHenning Brauer
to the functions that need them. makes the code easier and cleaner in some places and will be needed for other things to come soon ok cedric@
2003-04-30Allow tables to be loaded into anchors.Cedric Berger
Most pfctl table commands (excluding 'show' and 'flush') support the "-a" modifier. ok dhartmei@
2003-04-03Simplify pfctl printing code.Cedric Berger
ok dhartmei@ henning@
2003-04-02no \n w/ errx(3), reminded by andrushockHenning Brauer
2003-04-02better error handlingHenning Brauer
2003-04-02better error messageHenning Brauer
2003-03-27minor tweaks from Andrey Matveev, ok henning@ and cedric@Daniel Hartmeier
2003-03-27lotsa const char *Henning Brauer
from David Hill <david at phobia.ms> a while ago
2003-03-11On pfctl -a foo -Fn/-Fr, traverse all subrulesets in the anchor andDaniel Hartmeier
clear nat/rules, like -sn/-sr already does. Reported by Julien Bordet. ok henning@, cedric@
2003-03-11fix format strings in debugging output, qid is unsignedHenning Brauer
ok cedric@ mcbride@
2003-03-10it doesn't make sense to mimic pfctl -vsr output in pfctl -vsl (same forHenning Brauer
-vvsr ./. -vvsl). this resulted in more or less garbage in pfctl -vsl and -vvsl output. so ignore the extra verbosity flags for -sl. found by pb@ ok pb@ dhartmei@
2003-03-08inlcude queue interals in -gsr and -gsq output; will make debugging easier.Henning Brauer
ok cedric@ pb@
2003-03-07don't include debugging output, namely, the result of teh skip stepsHenning Brauer
calculation, in verbose output (pfctl -vvsr). Instead, use a new flag -g for that. result of a longer discussion with dhartmei@ and jakob@ ok cedric@ pb@
2003-02-20extra plurals; openbsd@davidkrause.comTheo de Raadt
2003-02-20Fix table syntax documentation, from David Krause.Cedric Berger
2003-02-19cmdline options in alphabetical order in usage() and manpage; and sync themHenning Brauer
from krause
2003-02-18fix load option handling (-A, -N, -R) for options.Henning Brauer
due to a bug in the loadopt check options were always loaded no matter which loadopts where specified. while beeing there, move the prints for that to where they belong, into the appropriate pfctl_set_* functions, and thus only print when the options are actually loaded. fixes regress tests pfopt3, pfopt4, pfopt5 I added earlier. ok dhartmei@
2003-02-17pfctl_clear_pool doesn't need to be prototyped twice eitherHenning Brauer
2003-02-17no need to prototype pfctl_add_pool twiceHenning Brauer
2003-02-17We want err() after failed ioctl() here too.Mike Pechkin
mcbride@, dhartmei@ ok
2003-02-14remove explicit table creation ( -T create ), it's useless.Henning Brauer
ok pb@ mcbride@ deraadt@
2003-02-11allow macro definition on the command line:Henning Brauer
pfctl -Dextif=wi0 -f /etc/pf.conf command line macro definitions override the ones made in the file (idea theo), very handy if your notebook has another NIC at some conference, as well as for debugging etc. idea rezine@mistrusted.net via pb@ hacked live at FOSDEM ok pb@ dhartmei@ cedric@
2003-02-05Simplify more.Cedric Berger
2003-02-05Simplify.Cedric Berger
2003-02-03remove loadopt global definition and cleanup a bit.Cedric Berger
ok henning@
2003-02-03zap dead codeHenning Brauer
2003-02-03fix a problem with queue definitions when load options (like -N etc) areHenning Brauer
given; they used to check for their parent interface/queue even in this case. ok dhartmei@ cedric@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-20 13:30:35 +0000