| Age | Commit message (Collapse) | Author |
|---|
|
fix a check of the return value to cope woth that
inspired by PR3675 from Marc Huber <Marc.Huber@web.de>, fixed slightly
different.
|
|
ok dhartmei@ henning@
|
|
source-tracking. Found by Pyun YongHyeon.
Also add support to pfctl to set the src-nodes pool limit.
"Luckily" some of the bugs cancel each other out; update kernel before
pfctl.
ok dhartmei@
|
|
we need to save the unexpanded tag/tagged strings before entering the
expansion loop, and at each loop, start with the unexpanded tag, so that
on subsequent loops the macros are replaced with current values and not
the values from previous loop persist
ryan theo ok
|
|
==
to parse v4 adresses, only use inet_net_pton when we find a /, otherwise
use inet_pton.
helps bob who likes to type 1.2 3.4 instead of 1.2.3.4 and wonders why this
results in two addresses.
PR3638, bob ok
==
make sure bits is either 32 or what inet_net_pton tells us, and always call
set_ipmask to mask the boring bits away
ok dhartmei@ mcbride@ david@
|
|
ok deraadt@ henning@
|
|
1.2.3.4/0 is not equal to 1.2.3.4... this "helped" to make failure already
only omit the netmask when both the addr and the mask itself are all zero
(the "any" case)
ok dhartmei@ mcbride@
|
|
extremely unfluffy, King Bula is coming for your head.
|
|
use inet_pton.
helps bob who likes to type 1.2 3.4 instead of 1.2.3.4 and wonders why this
results in two addresses.
PR3638, bob ok
|
|
identifiers without embedded meanings.
this also allows us to make the semantics of the qid assignment in line
with the tag assignment in the next step.
ok, henning@
|
|
|
|
tests otto@, okay millert@
|
|
|
|
|
|
1) PF should do the right thing when unplugging/replugging or cloning/
destroying NICs.
2) Rules can be loaded in the kernel for not-yet-existing devices
(USB, PCMCIA, Cardbus). For example, it is valid to write:
"pass in on kue0" before kue USB is plugged in.
3) It is possible to write rules that apply to group of interfaces
(drivers), like "pass in on ppp all"
4) There is a new ":peer" modifier that completes the ":broadcast"
and ":network" modifiers.
5) There is a new ":0" modifier that will filter out interface aliases.
Can also be applied to DNS names to restore original PF behaviour.
6) The dynamic interface syntax (foo) has been vastly improved, and
now support multiple addresses, v4 and v6 addresses, and all userland
modifiers, like "pass in from (fxp0:network)"
7) Scrub rules now support the !if syntax.
8) States can be bound to the specific interface that created them or
to a group of interfaces for example:
- pass all keep state (if-bound)
- pass all keep state (group-bound)
- pass all keep state (floating)
9) The default value when only keep state is given can be selected by
using the "set state-policy" statement.
10) "pfctl -ss" will now print the interface scope of the state.
This diff change the pf_state structure slighltly, so you should
recompile your userland tools (pfctl, authpf, pflogd, tcpdump...)
Tested on i386, sparc, sparc64 by Ryan
Tested on macppc, sparc64 by Daniel
ok deraadt@ mcbride@
|
|
TAILQ_REMOVE is a no-no within a TAILQ_FOREACH loop.
also free the symbol itself after removal.
all found while hacking bgpd which incorporates pfctl's sym code (macros).
ok cedric@
|
|
ok deraadt@ cedric@
|
|
|
|
|
|
|
|
.Nm does not need an argument;
dashes should be escaped;
|
|
|
|
|
|
|
|
|
|
Implemented as an in-kernel multicast IP protocol.
Turn it on like this:
# ifconfig pfsync0 up syncif fxp0
There is not yet any authentication on this protocol, so the syncif
must be on a trusted network. ie, a crossover cable between the two
firewalls.
NOTABLE CHANGES:
- A new index based on a unique (creatorid, stateid) tuple has been
added to the state tree.
- Updates now appear on the pfsync(4) interface; multiple updates may
be compressed into a single update.
- Applications which use bpf on pfsync(4) will need modification;
packets on pfsync no longer contains regular pf_state structs,
but pfsync_state structs which contain no pointers.
Much more to come.
ok deraadt@
|
|
to:
- Ensure that clients get a consistent IP mapping with load-balanced
translation/routing rules
- Limit the number of simultaneous connections a client can make
- Limit the number of clients which can connect through a rule
ok dhartmei@ deraadt@
|
|
excluding boundaries) is legal. already supported by kernel, requires only
removal of three error messages. ok henning@
|
|
to commit a diff from 11/6...
do not insert the "block in on ! interface" rule for antispoof statements when
the interface in question does not have any IP address, because that then
expands to
block in on ! interface all
which is obviously bad.
niklas@ found it, dhartmei@ ok, and I think some more ppl ok I don't remember
|
|
-print debuglevel "Loud", this was omitted before (catched by mpech@)
-use the fine PF_DEBUG_* defines instead of magic numbers
ok markus
|
|
ok cedric@
|
|
created by this rule from appearing on the pfsync(4) interface. e.g.
pass in proto tcp to self flags S/SA keep state (no-sync)
ok cedric@ henning@ dhartmei@
|
|
|
|
|
|
|
|
|
|
the idea is not mine and I'dlove to get credit, but I cannot find the mail
any more :-((
ok canacar@ dhartmei@
|
|
|
|
int is not the same as u_long
caused an integer overflow on our 64 bit archs and thus made pf not working
there
ok mcbride@ marc@ millert@ cedric@
|
|
ok deraadt@ henning@
|
|
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command.
(some splxxx work remain in the kernel). Basically, improvements are:
- Anchors/Rulesets cannot disappear unexpectedly anymore.
- No more leftover in the kernel if "pfctl -f" fail.
- Commit is now done in a single atomic IOCTL.
WARNING: The kernel code is fully backward compatible, but the new
pfctl/authpf userland utilities will only run on a new kernel.
The following ioctls are deprecated (i.e. will be deleted sooner or
later, depending on how many 3rd party utilities use them and how soon
they can be upgraded):
- DIOCBEGINRULES
- DIOCCOMMITRULES
- DIOCBEGINALTQS
- DIOCCOMMITALTQS
- DIOCRINABEGIN
- DIOCRINADEFINE
They are replaced by the following ioctls (yes, PF(4) will follow)
which operate on a vector of rulesets:
- DIOCXBEGIN
- DIOCXCOMMIT
- DIOCXROLLBACK
Ok dhartmei@ mcbride@
|
|
ok henning@ mcbride@
|
|
ok henning@
|
|
|
|
|
|
Add a warning on global/anchor name clashes to help prevent mistakes from our
users during the 3.3 -> 3.4 switch.
ok henning@
|
|
You MUST test nework stack changes on BOTH BYTE-ORDERS.
Someone can fix this later, but right now I need to get the damn
firewall up. Grr.
|
|
ok frantzen@
|
|
|
|
|
