summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2003-12-31spacing. note this, cedricTheo de Raadt
2003-12-31Many improvements to the handling of interfaces in PF.Cedric Berger
1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
2003-12-30fix TAILQ abuse.Henning Brauer
TAILQ_REMOVE is a no-no within a TAILQ_FOREACH loop. also free the symbol itself after removal. all found while hacking bgpd which incorporates pfctl's sym code (macros). ok cedric@
2003-12-27Remove extra \n from pf_print_state().Ryan Thomas McBride
ok deraadt@ cedric@
2003-12-19i wrote much of these, assert my copyrightHenning Brauer
2003-12-19assert copyright. i rewrite much of thisTheo de Raadt
2003-12-17cosmetics, ok mcbride@Daniel Hartmeier
2003-12-16quotes, spaces and bars do not need to be escaped within displays;Jason McIntyre
.Nm does not need an argument; dashes should be escaped;
2003-12-16Check that max-src-states and max-src-nodes are not being set to 0.Ryan Thomas McBride
2003-12-16hostid is stored in network byte order, print in host byte order.Ryan Thomas McBride
2003-12-15KNF here tooHenning Brauer
2003-12-15Whitespace.Ryan Thomas McBride
2003-12-15Add initial support for pf state synchronization over the network.Ryan Thomas McBride
Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@
2003-12-15Add support to track stateful connections by source ip. This allows usRyan Thomas McBride
to: - Ensure that clients get a consistent IP mapping with load-balanced translation/routing rules - Limit the number of simultaneous connections a client can make - Limit the number of clients which can connect through a rule ok dhartmei@ deraadt@
2003-11-29allow ':' (range including boundaries) to be used whereever '><' (rangeDaniel Hartmeier
excluding boundaries) is legal. already supported by kernel, requires only removal of three error messages. ok henning@
2003-11-22daniel stumbled over a broken regress test, and it turned out that I forgotHenning Brauer
to commit a diff from 11/6... do not insert the "block in on ! interface" rule for antispoof statements when the interface in question does not have any IP address, because that then expands to block in on ! interface all which is obviously bad. niklas@ found it, dhartmei@ ok, and I think some more ppl ok I don't remember
2003-11-14in print_status:Henning Brauer
-print debuglevel "Loud", this was omitted before (catched by mpech@) -use the fine PF_DEBUG_* defines instead of magic numbers ok markus
2003-11-14allow the debuglevel to be set from pf.conf (set debug)Henning Brauer
ok cedric@
2003-11-08Add 'no-sync' state option to prevent state transition messages for statesRyan Thomas McBride
created by this rule from appearing on the pfsync(4) interface. e.g. pass in proto tcp to self flags S/SA keep state (no-sync) ok cedric@ henning@ dhartmei@
2003-11-06two more KNF violations I missed earlier. who introduces those all the time?Henning Brauer
2003-11-06and fix two err() that should be errx() while beeing hereHenning Brauer
2003-11-06need calloc hereHenning Brauer
2003-11-06KNFHenning Brauer
2003-11-06allow the label macros to be used in tags as well.Henning Brauer
the idea is not mine and I'dlove to get credit, but I cannot find the mail any more :-(( ok canacar@ dhartmei@
2003-10-21don't use NULL as (int)0. henning okJun-ichiro itojun Hagino
2003-10-08fix cedric's breakage:Henning Brauer
int is not the same as u_long caused an integer overflow on our 64 bit archs and thus made pf not working there ok mcbride@ marc@ millert@ cedric@
2003-10-02clean up p = realloc(pRyan Thomas McBride
ok deraadt@ henning@
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-09-24Fix realloc usage and make sure we don't increase buffer size on failure.Cedric Berger
ok henning@ mcbride@
2003-09-18Not all address types have a mask.Cedric Berger
ok henning@
2003-09-18add some space before lists;Jason McIntyre
2003-09-01KNFHenning Brauer
2003-08-29Document interactions between tables and anchors.Cedric Berger
Add a warning on global/anchor name clashes to help prevent mistakes from our users during the 3.3 -> 3.4 switch. ok henning@
2003-08-28This change is busted. what's worse, REGRESSION TESTS WOULD HAVE CAUGHT IT!Kjell Wooding
You MUST test nework stack changes on BOTH BYTE-ORDERS. Someone can fix this later, but right now I need to get the damn firewall up. Grr.
2003-08-28tweak;Jason McIntyre
ok frantzen@
2003-08-27kill dangling 'else'. fixes modulus in W and M TCP optionsMike Frantzen
2003-08-26catch port/user/group a <>/>< b with a >= b, from mpech@Daniel Hartmeier
2003-08-25catch return-rst ttl values > 255, from aaron@Daniel Hartmeier
2003-08-24Tweaks:Cedric Berger
- Make sure we allow only tables in round-robin pools for routing options, same as what we do for translation rules. - Don't reject rules like: "nat on sis0 -> <foo>" because "no address family is given". This is perfectly valid. ok henning@
2003-08-22correct printf arg mismatch (in 64bit arch). dhartmei okJun-ichiro itojun Hagino
2003-08-22pf spelling policeDavid Krause
ok dhartmei@ jmc@
2003-08-22move pfctl_file_fingerprints() call, table commands can use -f themselvesDaniel Hartmeier
(like pfctl -t spammers -vvTt -f file, causing EPERM on DIOCOSFPFLUSH).
2003-08-22KNFHenning Brauer
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
2003-08-20braindeadness police: catch queues which specify itself as child... 'nuff saidHenning Brauer
2003-08-20catch invalid CBQ priorities earlier, including a better error messageHenning Brauer
prodded by mpech@
2003-08-20err out nicer on errors in queue defHenning Brauer
2003-08-18catch max-mss values > 65535, report by Gregory SteuckDaniel Hartmeier
2003-08-09This patch remove the restriction that tables cannot be used in routing orCedric Berger
redirection rules... The advantage of using tables in redirection/routing rules is not efficiency, in fact it will run slower than straight address pools. However, this brings a lot of flexibility to PF, allowing simple scripts/daemons to add/remove addresses from redirection/routing pools easily. This implementation support all table features, including cidr blocks and negated addresses. So specifying { 10.0.0.0/29 !10.0.0.0 !10.0.0.7 } will correctly round-robin between the six addresses: .1, .2, .3, .4, .5, .6. Tables can also be combined with simple addresses, so the following rule will work as expected: "nat on foo0 -> { 1.1.1.1 <bar> }" ok henning@ mcbride@
2003-08-04Not every suggested patch is perfect :)Daniel Hartmeier
ERRX() has two effects: the message printing and goto _error; which causes exit(1). While we don't want the message if pfctl was invoked with -n, we DO want to abort. Otherwise subsequent 'load anchor' statements will get executed, for instance, and the return value is handy for scripts.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-16 07:09:53 +0000