summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2012-01-15convert an snprintf to strlcpyDavid Hill
ok mikeb henning
2011-12-19unbreak rule optimizer; ok henning, looksMike Belopuhov
2011-12-12fixup af-to regression with match rulesMike Belopuhov
pfctl should not infer the af-to behavior from the af/naf difference. instead, we should be clear that this is an af-to rule. essentially this change converts FOM_AFTO marker into a rule flag PFRULE_AFTO so that we don't rely on ambiguous checks (like r->af != r->naf) when setting things up. positive review and comments from claudio, ok henning, sperreault
2011-12-03pfctl_set_hostid always returns 0; don't pretend otherwise and make it aRyan Thomas McBride
void function instead. ok dlg
2011-12-03Avoid loading garbage hostid and other values not always initialised,Ryan Thomas McBride
by bzero()ing the 'struct pfsync' properly. ok dlg mpf
2011-11-23print ports as numbers by default; -P prints names insteadHenning Brauer
2/2 from Lawrence Teo <lteo at devio dot us> ok sthen dlg and myself
2011-11-23print_rule: rename opts -> ropts, no binary changeHenning Brauer
1/2 from Lawrence Teo <lteo at devio dot us> ok sthen dlg myself and gcc
2011-11-08Fixup skip step printout: rdomains come after direction; ok mcbride, henningMike Belopuhov
2011-10-13pfctl change for af-to / NAT64 support.Claudio Jeker
The general syntax is: pass in inet from any to 192.168.1.1 af-to inet6 from 2001::1 to 2001::2 In the NAT64 case the "to" is not needed in af-to and the IP is extraced from the IPv6 dst (assuming a /64 prefix). Again most work by sperreault@, mikeb@ and reyk@ OK mcbride@, put it in deraadt@
2011-09-07Avoid possible SIGSEGV when wrong tos option.Christiano F. Haesbaert
2011-08-30One shot rules can be used in pf.conf by specifying a "once" filter option.Mike Belopuhov
ok henning, mcbride
2011-07-29Remove requirement to quote 'debug' loglevel for the 'debug' option.Ryan Thomas McBride
ok henning
2011-07-27Add support for weighted round-robin in load balancing pools and tables.Ryan Thomas McBride
Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
2011-07-13Force user to specify protocol when filtering on user, gid, and osRyan Thomas McBride
attributes (this is now required by pf_rule_test(). ok sthen henning
2011-07-08allow rules to specify "prio X" or "prio (X, Y)" to assign priority levelsHenning Brauer
for the new priority queueing implementation. valid range is 0 to 7. the old trick for priorizing empty ACKs etc remains thru the latter notation ok ryan mpf sthen plus pea testing and halex and claudio reading
2011-07-08Correctly print skip steps in -vv modeRyan Thomas McBride
- Did not include PF_SKIP_RDOM - Changed order of address and ports.
2011-07-07Don't print 'keep state' anymore unless it's needed for state options, it'sRyan Thomas McBride
been implicit for years now. ok henning@
2011-07-07Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesRyan Thomas McBride
a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
2011-07-04tsc tsc, no waikiki for me. copyright statement without year. 2003 it was.Henning Brauer
2011-07-04bye bye require-order.Henning Brauer
i added that button many many many years ago since the order (options, scrub, nat, filter) was enforced back then, which I hated. now we had that turned off for ages, and with the scrub and nat rulesets being gone, there is very little reason to enforce an order at all. so let's get rid of it. introducing this button was one of my very early commits to openbsd... feels a bit strange to remove it now :) ok ryan dlg theo
2011-07-04rip out more effectively dead code, ryan okHenning Brauer
2011-07-03g/c RIO traces (aka clean up after tedu :))Henning Brauer
2011-07-03*_CLEARDSCP could never possibly have been set, no point in being able toHenning Brauer
print that as flag then
2011-07-03bring in least-states load balancing algorithmJoerg Zinke
ok mcbride@ henning@
2011-04-23improve line breaking in SYNOPSIS now that semantics of the .Bk macroIgor Sobrado
has changed to conform with modern groff releases. diff for route6d(8) written mostly by schwarze@, with lots of useful advice from jmc@. ok jmc@, schwarze@
2011-04-06Userland bits to allow PF to filter on the rdomain a packet belongs to.Claudio Jeker
This allows to write rules like "pass in on rdomain 1". Tested by phessler@, OK henning@
2011-04-05ditch fastroute, an ipf feature that made its way into pf beforeMike Belopuhov
route-to and friends were introduced making it obsolete. one even has to look it up int the ipf manual to get and idea what it's supposed to do. reuse some kernel bits for the upcoming nat64 stuff. "kill it with fire" from mcbride, "what mcbride said" from mpf, "kill kill kill" and ok henning.
2011-01-23'pfctl -x none' did not turn debugging off. Skip the syslog internalAlexander Bluhm
"no priority" priority named "none". This makes 'pfctl -x none' equivalent to 'pfctl -x crit'. ok mcbride@ henning@
2010-12-31According to pf_scrub_ip6() pf does not support the scrub optionsAlexander Bluhm
no-df, random-id, set-tos for IPv6 rules. Check this in pfctl and document it in pf.conf(5). ok henning@ jmc@
2010-12-15make the "invalid probability:" yyerror suck lessHenning Brauer
From: Thomas Pfaff <tpfaff@tp76.info>
2010-12-01remove some unused tokensJonathan Gray
ok henning@ mcbride@
2010-11-12The ioctl to show states returns a pfsync_state which is in network byteClaudio Jeker
order and therefore a ntohs is needed to show the rdomain correctly. OK henning@ dlg@
2010-10-18Revert non-compatible and undocumented bullshit commited by 3 developersTheo de Raadt
who decided to just do it on their own. henning, mcbride, jsing -- shame on you -- if you had shown this diff to just 1 other network developer, the astounding mistake in it would have been noticed. Start practicing inclusionary development instead of going alone. ok claudio
2010-10-17Add quirks support to operating system fingerprinting. tcpdump partJoel Sing
by mcbride@. ok mcbride@ henning@
2010-10-12pfctl -sr did not show divert-reply rules without address familyAlexander Bluhm
correctly. A zero address field is used to identify divert-reply rules. If the rule's address family is unspecified, PF_AZERO() always returns false. So use AF_INET6 as address family, to check all bits of the address. ok markus@
2010-10-03tweak previous;Jason McIntyre
2010-10-01the grammar of my last commit worked with mandoc, but didn't work with nroff;Reyk Floeter
convert a long .Op line into a few lines of .Xo ... .Xc. no "binary" change with mandoc.
2010-10-01Add the -R id option to pfctl that allows to show only a specified ruleReyk Floeter
by numeric ID in combination with the "-s rules" or "-s labels" options. For example, this allows you to dump the statistics of a specified rule only (pfctl -sr -v -R 0). ok henning@
2010-09-24remove the check that enforced rdr-to only inbound and nat-to only outbound.Henning Brauer
both now can be used in both directions. the kernel allowed that ever since we did the great NAT rewrite. still enforce that a direction is given, a rule with rdr-to and/or nat-to and no direction is pretty certainly an error (which it would work, technically) ok ryan claudio dlg
2010-09-22new log opt "matches"Henning Brauer
awesome for debugging, a rule like match log(matches) from $testbox will show you exactly which subsequent rules match on that packet real ok theo assumed oks ryan & dlg bikeshedding many implementation time ~1 min bikeshedding about the keyword longish. i voted for "matches" since i like to play with matches idea was theo's, actually
2010-09-20tweak previous; ok schwarzeJason McIntyre
2010-09-19Do not break .Op scope by .Oc.Ingo Schwarze
While here, remove .Xo macros that were ugly workarounds to deal with groff-1.15 bugs, but are required neither by modern groff nor by mandoc nor by any documentation we are aware of. Problem originally noticed by jmc@ running mandoc -Tlint; patch ok by jmc@.
2010-09-17back out the -Fr hunk from previous: deraadt points out it is incorrectlyJason McIntyre
worded. i think what is there now is clear enough.
2010-09-16- note that -Fr puts the filer in a "pass all" stateJason McIntyre
- note that -f replaces the current ruleset based on a diff from Anders Langworthy, but altered by mcbride and henning; ok henning
2010-09-12spacing fix;Jason McIntyre
2010-09-02remove trailing spaces and tabs; no binary change.Igor Sobrado
written with help from henning@, who suggested ensuring that there are no changes in the digests for object files, thanks! ok henning@
2010-08-11Fix a logic problem which could in theory cause pfctlJonathan Gray
to recursively print anchors with wildcards when not requested via the command line but in practice only applied to automatically generated inline anchors (which don't have wildcards) or when recursion was requested. Found by the clang static analyser and behaviour explained by mcbride@ ok henning@ mcbride@
2010-08-03fix linecount bug with comments spanning multiple linesHenning Brauer
problem reported with the obvious fix for bgpd by Sebastian Benoit <benoit-lists at fb12.de>, also PR 6432 applied to all the others by yours truly. ok theo isn't it amazing how far this parser (and more) spread?
2010-07-13Fix (pflow) display in rule printing. Spotted by dhill@, ok henning@Stuart Henderson
2010-07-03Fix a couple of problems with printing of anchors, in particular recursiveRyan Thomas McBride
printing, both of inline anchors and when requested explicitly with a '*' in the anchor. - Correct recursive printing of wildcard anchors (recurse into child anchors rather than rules, which don't exist) - Print multi-part anchor paths correctly (pr6065) - Fix comments and prevent users from specifying multi-component names for inline anchors. tested by phessler ok henning
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 18:25:30 +0000