summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2002-10-25- more sa_family_tCamiel Dobbelaar
- move unmask code to correct file - whitespace ok mcbride@ dhartmei@
2002-10-22%ul -> %luMike Pechkin
dhartmei@ ok
2002-10-22More conversion of "int af" and "u_int8_t af" declarations and functionRyan Thomas McBride
arguments to the more correct and descriptive "sa_family_t af" ok dhartmei@ henning@
2002-10-22Rename ipmask to set_ipmask and add some functionality: the netmaskCamiel Dobbelaar
is applied immediately to the address. This way, the parsed rules output shows exactly which bits of an address are significant for a match and errors due to wrong netmasks can be spotted more easily. Example: $ pfctl -nvf - pass in on lo0 from 172.17.0.0/12 to any @0 pass in on lo0 inet from 172.16.0.0/12 to any idea refined by dhartmei@ ok frantzen@ henning@
2002-10-17These checks are also made in nat_consistent() and rdr_consistent().Ryan Thomas McBride
ok dhartmei@ henning@
2002-10-17- accept all protocols that are specified by number if they are inCamiel Dobbelaar
the valid range (also when they're not listed in /etc/protocols) - explicitly disallow protocol number 0, because it has special meaning to pf ok dhartmei@ henning@
2002-10-16Fix and improve binat mask comparison.Mike Pechkin
dhartmei@, henning@ ok
2002-10-14Allow one to specify a netblock in a binat rule:Henning Brauer
binat on fxp0 from 192.168.0.32/27 to any -> 10.0.7.128/27 Both the network mask on the source and redirect addresses MUST be the same, and it works by essentially combining the network section of the redirect address with the host section of the source address. from ryan ok dhartmei@
2002-10-11When a macro cannot be expanded because it is not defined, say so. Also warnCamiel Dobbelaar
about unused macros. ok dhartmei@ henning@
2002-10-11In lgetc(), compress strings of whitespace to a single space. This makesCamiel Dobbelaar
macros come out right in verbose mode and is less functional overhead. Also err on whitespace after a backslash. That type of error is hard to find otherwise. ok dhartmei@ henning@
2002-10-08 remove <0 checks on unsigned numbers.Vincent Labrecque
ok henning@
2002-10-07-Wsign-compare cleanDaniel Hartmeier
2002-10-07Two cases of const-correctness and make one global local.Daniel Hartmeier
2002-10-07set block-policy [drop|return]Henning Brauer
drop is default, same behaviour as before support block drop to override a return policy
2002-10-07support a generic returnHenning Brauer
block return in|out ... acts like return-rst on tcp, like return-icmp on udp and like an ordinary block on anything else ok dhartmei@
2002-10-07make return-icmp work for rules covering both v4 and v6Henning Brauer
-new field "return_icmp6" in pf_rule -parser accepts block return-icmp(ipv4-icmpcode, ipv6-icmpcode) ok and some input dhartmei@
2002-10-07use a new rule_flag PFRULE_RETURNICMP to decide wether to return-icmp or notHenning Brauer
instead of just testing return_icmp > 0 ok dhartmei@
2002-10-07Add 'reply-to' to filter rules, similar to route-to, but applying toDaniel Hartmeier
replies (packets that flow in the opposite direction of the packet that created state), used for symmetric routing enforcement. Document how route-to and reply-to work in context of stateful filtering.
2002-10-06Move CHECK_ROOT into LOOP_THROUGH, gets rid of one macro and savesDaniel Hartmeier
several lines, no functional difference. From Camiel Dobbelaar.
2002-10-05Expand {} lists from left to right, so 'pass in from { a, b } to any'Daniel Hartmeier
becomes '@0 pass in from a to any @1 pass in from b to any' instead of the other way around. Patch from Camiel Dobbelaar.
2002-10-05Allow filtering based on IP header's tos field.Daniel Hartmeier
2002-09-22little KNF: return(something) -> return (something)Henning Brauer
2002-09-22fix linenumber counting in findeol, and simplify by ignoring the \ case,Henning Brauer
that's already handled earlier. fast-forward on errnous lines partitially from camield@, parts result of a discussion with Mike ok frantzen@ dhartmei@
2002-09-22antispoof, take 2.Henning Brauer
also block incoming packets with our own IP as src. discussion & help frantzen ok ho@ dhartmei@ frantzen@
2002-09-18fix Xr refs; frisco@blackant.netTheo de Raadt
2002-09-17easier "self" implementation.Henning Brauer
no functional changes ok pb@
2002-09-15set a netmask in the dynaddr caseHenning Brauer
noticed by <han@mijncomputer.nl> ok pb@
2002-09-14oooooooopsieHenning Brauer
2002-09-14bit more clue in rdr/nat rules wrt address family examinationHenning Brauer
don't take the af from host_node structs based on interface lookups, most interfaces will have both IPv4 and IPv6 addresses. Most rdr/nat rules will at least have one IP address specified from whoch we take the af for the whole rule. The rare exceptional cases require the user to specify the af. ok frantzen@
2002-09-12check for calloc() failure; ho@Henning Brauer
2002-09-12antispoof [log] [quick] for [interface|interface_list] [af]Henning Brauer
e. g. antispoof log quick for { dc0, dc1 } inet docs & regress coming ok pb@, frantzen@, deraadt@ also looked over kjell@, markus@, itojun@, dhartmei@ IPv6 help itojun@ finally, a long story finds its happy end here.
2002-09-12rework netmask handling:Henning Brauer
-don't set netmask in host token handler -clear netmask in ipmask() proper before setting it -in ifa_load(), also store interface's netmask and broadcast address -allow ifa_lookup() to return either the interface's IP address(es), network(s) or broadcast address(es) - not used anywhere yet. This implies that ifa_lookup() also returns the netmask now. -host() returns netmasks, too ok pb@, frantzen@, deraadt@ also looked over kjell@, markus@, itojun@, dhartmei@
2002-09-08be more clueful wrt address family in nat/rdr rules.Henning Brauer
behaviour noticed by Paul de Weerd, thanks! ok dhartmei@
2002-09-02Fix parsing of port ranges in translation rules (port a:b -> port c:d).Daniel Hartmeier
ok henning@
2002-09-02Make sure the interface specified with route-to/dup-to/fastroute existsDaniel Hartmeier
and null-terminate the interface name. Found by Michael Wallis. ok henning@
2002-08-20Increase lineno on newlines inside multi-line macro definitions, otherwiseDaniel Hartmeier
errors on subsequent lines are reported with wrong line numbers. From Paul B. Henson.
2002-08-16kill duplicated check for '(' and ')' in allowed_in_stringHenning Brauer
2002-08-12Catch null pointer deref (segfault), from wilfried@Daniel Hartmeier
2002-08-06missing free(), mpech@Henning Brauer
ok pb@
2002-08-06check fo strdup() allocation errorsHenning Brauer
pointed out by mpech@ ok pb@
2002-07-31KNF, esp. missing prototypesHenning Brauer
2002-07-30grmpf.Henning Brauer
in some cases, on non-tcp rules flags weren't resetted. cosmetical only problem. but, well, checking for r->flags and r->flagset if we could have assigned them zero just one round ago is just stupid, and it's not needed to check them at all. ok pb@, dhartmei@
2002-07-30allow to specify flags on all rules that include tcp.Henning Brauer
these are valid: pass in from any to any flags S pass in proto { tcp, udp, icmp } from any to any flags S pass in proto tcp from any to any flags S these are invalid: pass in proto { udp, icmp } from any to any flags S pass in proto udp from any to any flags S ok "I've lost my slacker status for at least a week" frantzen@ ok pb@, dhartmei@, deraadt@
2002-07-26make the order of log and quick irrelevant. now bothHenning Brauer
block in log quick all and block in quick log all work. ok dhartmei@, deraadt@
2002-07-23timeout_list/_spec and limit_list/_spec don't return anything -> no %type.Henning Brauer
ok theo
2002-07-21fix route-to alsoTheo de Raadt
2002-07-21make the , optional in many places. This makes string concat a lot moreTheo de Raadt
useful. Now you can in = ssh domain www out = $in ftp finger pass in proto tcp from any to any port { $in } pass out proto tcp from any to any port { $out } a poor example, but the idea is obvious
2002-07-21string concat, ie.Theo de Raadt
a=a b c=$a $a
2002-07-20minor indent tweaksTheo de Raadt
2002-07-20properly split yacc and lex useTheo de Raadt
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-26 21:26:33 +0000