| Age | Commit message (Collapse) | Author |
|---|
|
"no priority" priority named "none". This makes 'pfctl -x none'
equivalent to 'pfctl -x crit'.
ok mcbride@ henning@
|
|
no-df, random-id, set-tos for IPv6 rules. Check this in pfctl and
document it in pf.conf(5).
ok henning@ jmc@
|
|
From: Thomas Pfaff <tpfaff@tp76.info>
|
|
ok henning@ mcbride@
|
|
order and therefore a ntohs is needed to show the rdomain correctly.
OK henning@ dlg@
|
|
who decided to just do it on their own. henning, mcbride, jsing -- shame
on you -- if you had shown this diff to just 1 other network developer,
the astounding mistake in it would have been noticed. Start practicing
inclusionary development instead of going alone.
ok claudio
|
|
by mcbride@.
ok mcbride@ henning@
|
|
correctly. A zero address field is used to identify divert-reply
rules. If the rule's address family is unspecified, PF_AZERO()
always returns false. So use AF_INET6 as address family, to check
all bits of the address.
ok markus@
|
|
|
|
convert a long .Op line into a few lines of .Xo ... .Xc. no "binary" change
with mandoc.
|
|
by numeric ID in combination with the "-s rules" or "-s labels" options.
For example, this allows you to dump the statistics of a specified rule
only (pfctl -sr -v -R 0).
ok henning@
|
|
both now can be used in both directions. the kernel allowed that ever since
we did the great NAT rewrite.
still enforce that a direction is given, a rule with rdr-to and/or nat-to
and no direction is pretty certainly an error (which it would work,
technically)
ok ryan claudio dlg
|
|
awesome for debugging, a rule like
match log(matches) from $testbox
will show you exactly which subsequent rules match on that packet
real ok theo assumed oks ryan & dlg bikeshedding many
implementation time ~1 min bikeshedding about the keyword longish.
i voted for "matches" since i like to play with matches
idea was theo's, actually
|
|
|
|
While here, remove .Xo macros that were ugly workarounds
to deal with groff-1.15 bugs, but are required neither by modern groff
nor by mandoc nor by any documentation we are aware of.
Problem originally noticed by jmc@ running mandoc -Tlint;
patch ok by jmc@.
|
|
worded. i think what is there now is clear enough.
|
|
- note that -f replaces the current ruleset
based on a diff from Anders Langworthy, but altered by mcbride and henning;
ok henning
|
|
|
|
written with help from henning@, who suggested ensuring that there
are no changes in the digests for object files, thanks!
ok henning@
|
|
to recursively print anchors with wildcards when not
requested via the command line but in practice only
applied to automatically generated inline anchors
(which don't have wildcards) or when recursion
was requested.
Found by the clang static analyser and behaviour explained
by mcbride@
ok henning@ mcbride@
|
|
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?
|
|
|
|
printing, both of inline anchors and when requested explicitly with a '*'
in the anchor.
- Correct recursive printing of wildcard anchors (recurse into child anchors
rather than rules, which don't exist)
- Print multi-part anchor paths correctly (pr6065)
- Fix comments and prevent users from specifying multi-component names for
inline anchors.
tested by phessler
ok henning
|
|
will be getting cleaned up soon.
ok henning
|
|
ok mcbride
|
|
ok henning@ krw@
|
|
- 'make -Fi' reset ALL the interface statistics
can be restricted with -i ifname
- 'make -Fa -i ifname' fail (it's meaningless)
- get rid of a silly little struct that's only used for one thing
ok henning
|
|
it is violating the transactional model we have and made stronger in
pf, it is broken in some cases and since some options are passed to the
kernel while some are userland only and affect how the rules are
parsed it is complete bullshit anyway - obviously, changing options
that affect ruleset parsing without reloading and thus reparsing the
ruleset cannot work. so stop pretending it could and cut the crap.
ok dlg krw deraadt
|
|
program does not free(3) it.
|
|
ALTQ transactions when anchors are loaded.
Fixes pfctl when using 'load anchor ... from' as seen by beck@
and Toni Mueller, which stopped working after r1.295 removed loadopt
(which was overloaded to do this job as well as indicate command-
line flags).
ok henning@
|
|
|
|
the partial loading of a ruleset (leaving ancors aside) is wrong and
conflicts with the general idea of how pf works. last not least it breaks
with the optimizer generating tables automagically.
ok deraadt sthen krw manpage jmc
|
|
need to free it with free(3).
from zinovik
|
|
Found by Marcus Muelbuesch. ok henning@
|
|
definition of DPFPRINTF(), and log priorities from syslog.h. Old debug
levels will still work for now, but will eventually be phased out.
discussed with henning, ok dlg
|
|
ok mcbride
|
|
|
|
ok mcbride@ henning@
|
|
address family is selected; don't print the v6 mask if it's a v4 address.
|
|
tests for illegal conditions in translation/routing.
|
|
collapsing into tables, so that we can handle all possible address family
expansions.
|
|
like a dynamic one in the routespec.
|
|
|
|
Fix binat-to sanity checks.
|
|
|
|
- purge irrelevant addresses from the lists before collapsing
- ensure the lists are freed after they're collapsed
- more careful ifname copying, avoiding double-free / use-after-free traps
|
|
|
|
actions. Allow interfaces to be specified in special table entries for
the routing actions. Lists of addresses can now only be done using tables,
which pfctl will generate automatically from the existing syntax.
Functionally, this deprecates the use of multiple tables or dynamic
interfaces in a single nat or rdr rule.
ok henning dlg claudio
|
|
lookahead in the parser
ok henning otto
|
|
10.0.0.1 })
should be folded in the parser to any, not to 10.0.0.1. How long this bug has
been with us is unclear.
ok guenther mcbride
|
