summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2017-05-28print_ioctl() is unused if not debugging. Found with clang, afterMichal Mazurek
marking the function "static". Use OSFP_DEBUG, in a similar fashion to OPT_DEBUG (pfctl_optimize.c). OK bluhm@
2017-05-27Move includes.Michal Mazurek
This reduces the diff with usr.sbin/tcpdump/pfctl_osfp.c. The change from tcpdump is newer, so change pfctl. No binary change. OK deraadt@
2017-05-15Fixup printing of queue bandwidth specificationsMike Belopuhov
Reported by Carl Mascott, thanks! OK sthen
2017-05-15Put the closing parenthesis in the right spot and fix std-dev calculationMike Belopuhov
2017-05-15Hook up FQ-CoDel to the tree and enable configuration in the pfctl(8)Mike Belopuhov
OK sthen, visa
2017-04-28Remove double assignmentsMike Belopuhov
2017-04-26Perform H-FSC root queue allocation in the kernelMike Belopuhov
Since only leaf queues can have packets assigned to them, H-FSC requires the user specified root queue to have a parent. To simplify userland tools and the configuration interface, the kernel can be leveraged to set it up. ok henning
2017-04-23oops, this was meant to be committed with the pfctl.8 change:Jason McIntyre
sync usage() with SYNOPSIS;
2017-04-23trim the documentation for -k: make it more consistent,Jason McIntyre
and do not try to do all the documenting in SYNOPSIS/usage(); ok deraadt
2017-04-21Add "key" modifier for -k to make pfctl can kill a state by specifyingYASUOKA Masahiko
the key of the state. ok sasha
2017-04-13fix wrongly indented linesJonathan Gray
2017-03-27rather than printing the wrong function name, dont print it at all.Sebastian Benoit
found by Klemens Nanni
2017-01-26one more fix i requested for previous;Jason McIntyre
2017-01-26Select the routing domain to be used for kill states by host or bySebastian Benoit
label, by adding a -V <rdomain> option. written by Bertrand Provost, provost DOT bertrand AT gmail DOT com, thanks. ok florian@, with feedback from florian and jmc.
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-11-23Explicitly forbid to combine af-to with route-to in pfctl. TheAlexander Bluhm
parser cannot handle that correctly and is is unclear wether the kernel code would work. Remove the feature until someone needs it and properly implements and tests it. OK mike@ sashan@ mpi@
2016-10-26When using a /32 IPv4 interface address, pfctl(8) reports a 0.0.0.0Alexander Bluhm
as broadcast address. The kernel does not consider this a broadcast address and ifconfig(8) has a check to exclude it. Use the same check in pfctl(8). Found by regress/sbin/pfctl pfi2; OK mikeb@
2016-09-03err->errx, errno info is not related to the failure modeJeremie Courreges-Anglas
ok mikeb@
2016-09-03pfctl mixes up anchorname with anchorpathAlexandr Nedvedicky
OK mikeb@
2016-09-03Let purge thread to remove once rules, not packets.Alexandr Nedvedicky
Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
2016-08-26Add <time.h> for time(); sort <*.h> includesPhilip Guenther
ok deraadt@
2016-08-03A couple of "a->blah == a->blah" -> "a->blah == b->blah".Kenneth R Westerback
Spotted by the Echelon team with AppChecker static analyzer. ok sashan@
2016-07-18no more cbq_opts - CBQ is gone, ok mpi phessler bennoHenning Brauer
2016-07-18g/c unused (global!) var: oqueues isn't used any more. ALTQ leftover; notHenning Brauer
noticed since struct node_queue stayed. ok claudio benno gcc
2016-06-22Add curly braces that were missed in rev 1.651. Add parenthesis to make theMark Kettenis
condition in the if statement more readable while I'm there. ok phessler@, benno@, florian@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2016-06-21the manpage documents that af-to does not work on pass out rules, butSebastian Benoit
the pf.conf parser allows it, which leads a non working configuration being loaded. this changes the parser to make pass out .. af-to an error. ok henning@ mikeb@
2016-06-16allow include in inline anchorsHenning Brauer
with this, anchor foo { include "/path/to/rules" } works and "load anchor" is obsolete, to be removed somewhen later after release. co-production with reky at bsdcan, ok reyk mikeb benno sasha
2016-01-14detect multiple root queues on a single interface and give a nice errorHenning Brauer
message - beats "pfctl: DIOCXCOMMIT: Invalid argument". from Nathanael Rensen <nathanael at list.polymorpheus.com>, 10x! ok sthen phessler, commit reminder mikeb
2016-01-05remove long deprecated "set debug "none|urgent|misc|loud" levels inSebastian Benoit
pf.conf. Change this before upgrade or pf.conf won't load. florian@ henning@ phessler@ jung@
2015-12-10Remove NULL-checks before free(). ok tb@mmcc
2015-10-02Make 'pfctl -s all' show queues. pfctl(8) says it does, and 5.4Kenneth R Westerback
pfctl(8) did for the old queues. ok sashan@ sthen@
2015-09-03interface should only be specified for root queues; found by jsgMike Belopuhov
2015-09-01- route-to, dup-to, reply-to should not override the block actionAlexandr Nedvedicky
Spotted by Dilli Paudel <dilli ! paudel at oracle ! com> ok jung@, ok mikeb@
2015-06-15document pfctl -ss -R <rule>, ok mikeb@Stuart Henderson
2015-06-12Allow rule ID filter to be specified for show states outputMike Belopuhov
Tweak pfctl to respect the rule ID parameter (-R) specified along with the show states (-s states) option to filter out states that are not associated with a given rule from the output. ok sthen, benno
2015-06-03Do not assume that asprintf() clears the pointer on failure, whichTodd C. Miller
is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
2015-04-21Improve divert-to specification parsing w.r.t. rule address family.Mike Belopuhov
ok henning
2015-02-26%% not % in error message; ok millert@ henning@Stuart Henderson
2015-02-14Rather than using 0xff as a placeholder for "don't check prio", use 0xff toStuart Henderson
mean "prio is 0". This avoids the need for code changes in programs which add pf rules (as was done in pfctl but not other programs) to handle the new "check prio" functionality. Specifically this unbreaks ftp-proxy. Use of #define rather than magic 0xff suggested by benno. ok benno "if henning doesnt like it he can change it when he recovers from jet-lag"
2015-02-10since we inherit prio (as in, the queuing priority) from outside sources,Henning Brauer
i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
2015-02-07parse debug levels with strtonum, so that debug 1banana doesn't parse.Ted Unangst
ok mikeb
2015-01-21Include <netinet/in.h> before <net/pfvar.h>. In a future change whenTheo de Raadt
ports is ready, <net/pfvar.h> will stop including a pile of balony.
2015-01-20Rewrite to void using union sockaddr_unionTheo de Raadt
ok mikeb
2015-01-19DEFAULT_PRIORITY and DEFAULT_QLIMIT no longer usedTheo de Raadt
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2014-12-19Support source-hash and random with tables and dynifs; not just pools.Reyk Floeter
This finally allows to use source-hash for dynamic loadbalancing, eg. "rdr-to <hosts> source-hash", instead of just round-robin and least-states. An older pre-siphash version of this diff was tested by many people. OK tedu@ benno@
2014-12-10If pfctl cannot set a limit in the kernel, print the name of theAlexander Bluhm
limit and the requested value. OK henning@
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-13keep queues around when anchors are being loadedMartin Pelikan
ok mikeb
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 21:54:30 +0000