summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2002-07-08Don't allow 'flags' option in non-TCP rules, found by mpech@Daniel Hartmeier
2002-07-05unbreak.Henning Brauer
2002-07-05another small bug I found while installing a -current pf firewall.Henning Brauer
we don't support pass/block in on ! <interface> (at least, not yet) let the parser complain instead of ignoring the '!' ok pb@, dhartmei@
2002-07-05allow unsetting the statusinterface viaHenning Brauer
set loginterface none ok dhartmei@
2002-07-01streamline parse buffer handling (no need to copy value that is notMarc Espie
going to go away). add explicit pushback buffer, to be able to push IPv6 failed parses back. handle pushback + parse buffer interactions by using negative indices. okay dhartmei@, deraadt@
2002-07-01KNFTheo de Raadt
2002-06-28Don't check for address family conflicts in nat/rdr before expansion,Daniel Hartmeier
rules will expand to all valid combinations, and there's an error when none is found. Makes "nat on tun0 from 10.0.0.0/8 to any -> (tun0)" work (again).
2002-06-27fix synopsis, closes pr2775Henning Brauer
ok pb@
2002-06-27repair formatting - the new "enabled since" format is longer than the oldHenning Brauer
one and thus the field lengths need to be adjusted. ok dhartmei@, pb@
2002-06-25move pfctl options -t, -m, -O and -l to pf.conf. These are set using theHenning Brauer
"set" keyword. example rulefile: set optimization aggressive set timeout { tcp.closing 6, tcp.opening 6 } set limit { states 1000, frags 1000 } set loginterface wi0 pass out all keep state label "$nr:$srcaddr:$srcport:$dstaddr:$dstport" block in all fries@ is working on an updated pf.conf(5) discussed at c2k2 and on icb ok dhartmei@, kjell@
2002-06-24Use interface when specified in scrub rule. No support for ! or {} yet.Daniel Hartmeier
2002-06-23uid_t and gid_t are unsignedTheo de Raadt
2002-06-20Copy address family from inet/inet6 keyword, if specified.Daniel Hartmeier
2002-06-19"Enabled for Ss" -> "Enabled for D days HH:MM:SS", ok frantzen@Daniel Hartmeier
2002-06-18propogate a '!' when a host resolves to multiple IP addressesMike Frantzen
ok dhartmei@
2002-06-18don't allow individual keep state rules to specify timeouts for 'interval' andMike Frantzen
'frag' -- they aren't applied anyway ok dhartmei@ and henning@
2002-06-16Rules must in order -> Rules must be in orderAaron Campbell
2002-06-15Reset rulestate in parse_rules(), so consecutive calls (like from authpf)Daniel Hartmeier
will not fail. Reported by Chris Kuethe.
2002-06-14make the output of pfctl -k look nice againHenning Brauer
noticed by pb@ ok dhartmei@
2002-06-13Fix the numbering of scrub rules. pointed out and oked by frantzen@Kjell Wooding
2002-06-12this stuff really belongs to stderr, not stdoutHenning Brauer
pointed out by ho@ ok dhartmei@, kjell@
2002-06-12Fix uninitialized access. Spotted by danh@ This is a good reason toKjell Wooding
develop with "ln -s 'J' /etc/malloc.conf" enabled. ok henning@
2002-06-11split the grammar of scrub(fragcache) into scrub ... 'fragment reassemble',Mike Frantzen
'fragment crop' or a new 'fragment drop-ovl' which will drop overlapping fragments and all corresponding ones ok kjell@ with feedback from kjell@ and deraadt@. the rest are slacking
2002-06-11Typo in err()Kjell Wooding
2002-06-11nuke an unused parameter in pfctl_timeout. ok frantzen@Kjell Wooding
2002-06-11Add -N, -RKjell Wooding
2002-06-11Add -N and -R options. When used in conjunction withKjell Wooding
pfctl -f <rulefile> they allow just the nat or filter rules to be reloaded, respectively. The default (no flags) is to load everything. If -N is specified, any existing filter rules are retained, similarly for -R. ok deraadt@, dhartmei@
2002-06-11sync with realityHenning Brauer
ok dhartmei@
2002-06-11KNF, remove function parameter namesDaniel Hartmeier
2002-06-11Remove parse_nat() prototype, it's gone. Yes, authpf is broken at theDaniel Hartmeier
moment.
2002-06-11Add $OpenBSD, license, include guards and remove one superfluousDaniel Hartmeier
prototype. From Chris Kuethe
2002-06-11print a string for UDP and OTHER state level instead of a numeric levelMike Frantzen
ok dhartmei@, henning@
2002-06-11SCRUB(fragcache) to do gap tracking and overlap pruning of IPv4 fragmentsMike Frantzen
without the memory overhead of the conventional defrag in SCRUB ok dhartmei@, idea by deraadt@
2002-06-11sync usage() with realityHenning Brauer
2002-06-11Make NAT proxy port range configurable per rule, for instance privilegedDaniel Hartmeier
source ports can mapped to privileged proxy ports, or source port 500 to proxy port 500. ok frantzen@
2002-06-11rework pfctl statistics displayHenning Brauer
move FCNT_NAMES from pfvar.h to pfctl_parser.h, only used by pfctl some input by nick@ ok frantzen@, dhartmei@
2002-06-10Merge the NAT and rules files into a single rulefile. Rules must beKjell Wooding
in this order, to remove any ambiguity about what order things happen in: scrub rules nat rules filter rules The -N and -R modifiers go away. Rulefiles are now loaded with the more POSIXly-correct '-f' ok frantzen@
2002-06-10Allow ports to be specified in nat rules, useful later on for individualDaniel Hartmeier
proxy port ranges.
2002-06-10Move enum out of struct (gcc 3.1 wasn't happy), from David KrauseDaniel Hartmeier
2002-06-10some olde version piece crept into my diffski; pt out by dfa@Michael Shalayeff
2002-06-10split scrub rule processing into its own yacc target,Kjell Wooding
for imminent config file merge. ok frantzen@
2002-06-09Make pf_nat.saddr/daddr a pf_rule_addr instead of pf_addr_wrap, so itDaniel Hartmeier
includes ports and operator.
2002-06-09spaced out developers...Theo de Raadt
2002-06-09Add list parsing in RDR rules: e.g.Kjell Wooding
rdr on $IFLIST proto tcp from $SRC_LIST to $DST_LIST port 21 \ -> 127.0.0.1 port 8021 ok dhartmei@
2002-06-09use strchr() instead of index()Theo de Raadt
2002-06-08nuke unused parameter af to expand_label_portHenning Brauer
ok dhartmei@, pb@
2002-06-08Change remaining read-only lookup tables to const, suggestion drahn@Daniel Hartmeier
2002-06-08comment on IPv6 link-local twistsJun-ichiro itojun Hagino
2002-06-08pf_timeouts is shared between pfctl and authpf, put it in the shared file.Dale Rahn
unbreak build.
2002-06-08add list expansion to src/dest in NAT rules. i.e.Kjell Wooding
nat on fxp0 from { 10.0.0.0/24, 10.0.1.0/24 } to \ { 172.6.1.1, 172.14.1.2/32 } -> fxp0 ok theo, dhartmei@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-26 22:24:45 +0000