summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2001-10-07Add interface name to address translation to pfctl, document it and addDaniel Hartmeier
a regress test. Translation is done on rule set load-time only, so the rule sets must be reloaded when an interface address changes. parse.y patch from Cedric Berger. Similar patch from Jonathon Fletcher. Thanks to both.
2001-10-04Honour -v flag when printing states, print only one line per state whenDaniel Hartmeier
non-verbose. Suggested by gwyllion@ace.ulyssis.org.
2001-10-02Remove duplication from simultaneous commitsMike Frantzen
2001-10-02Typo fixes (thanks gwyllion@ace.ulyssis.org)Mike Frantzen
2001-10-02'pfctl -O foo' dumped core. A check was there, but didn't work.Daniel Hartmeier
2001-10-01print variable asignments only if -v is given. ok dhartmei/deraadtMarkus Friedl
2001-10-01Print error message when pfctl -N/-R can't open the specified fileDaniel Hartmeier
(instead of failing silently). Found by niklas@.
2001-09-30Selectable preset FSM optimizations for several network environments.Mike Frantzen
Thanks to everyone who sent me packet captures!
2001-09-28Support underscores in macro names and document it in the man page.Daniel Hartmeier
2001-09-22remove debug printfTheo de Raadt
2001-09-20Fix uninitialized structure fields. Problem reported by Cedric Berger.Daniel Hartmeier
2001-09-15Implement return-icmp(number), return-icmp6(number)Peter Stromberg
Differentiate between return-icmp and return-icmp6, icmp-type and ipv6-icmp-type. ok dhartmei@
2001-09-15ICMP6_DST_UNREACH_NOROUTE <-> _ADMIN, reported by Wouter Coene.Daniel Hartmeier
2001-09-15Fix 'binat ... to any ...' (binat.af wasn't set).Daniel Hartmeier
2001-09-15Parse bug, found by wilfried@Daniel Hartmeier
2001-09-15IPv6 support from Ryan McBride (mcbride@countersiege.com)Mike Frantzen
2001-09-12check calloc() return valueMarkus Friedl
2001-09-06- you can only binat between hostsjasoni
- add binat example and description
2001-09-061:1 bidrectional NAT (binat); ok dhartmei@ and frantzen@jasoni
2001-09-06Initial idea from aaron@: Last char of .Xr group in SEE ALSO section shouldMike Pechkin
be a single digit. Powered by mantoya@. millert@ ok.
2001-09-04Support parameter lists {} for interfaces in filter rules, likeDaniel Hartmeier
pass in on { gm0, kue0 } from any to any
2001-09-02Print rule numbers zero-based. Noted by primus@gblx.net.Daniel Hartmeier
2001-08-28move '!' from host_list to host: "xhost : '!' host | host;"; ok dhartmei@Markus Friedl
2001-08-28check for malloc/strdup == NULLMarkus Friedl
2001-08-28Support ! operator in host parameter lists. Fixes PR system/2030. ReportedDaniel Hartmeier
by Kamil Andrusz <wizz@mniam.net>.
2001-08-28Bump state timeouts and allow tweaking them from pfctl.Mike Frantzen
(The state timeouts need some _serious_ tuning)
2001-08-26sort keywordsTheo de Raadt
2001-08-25PF ISN randomization. Or in trekkie techno-babble, ISN phase modulation.Mike Frantzen
2001-08-23o for a port_item, initialize the "next" pointer to NULLTodd C. Miller
o for an address, use calloc() instead of malloc() so the struct is zeroed Fixes a SEGV in pfctl due to uninitialized "next" pointers.
2001-08-23Support var="string". Expansion (at lex time) done using $var, for instance:Theo de Raadt
okproto="{ssh, smtp, domain, auth}" pass in on key0 proto tcp from any to any port $okproto keep state Can I ask someone else to document this in pf.conf(5)?
2001-08-23KNFTheo de Raadt
2001-08-23for -s all, do not error out when the first ioctl failsTheo de Raadt
2001-08-22ftp-proxyBob Beck
2001-08-19do not spin if no states are foundTheo de Raadt
2001-08-19Document per-rule byte counter.Daniel Hartmeier
2001-08-19Add per-rule byte counter, so mickey can do accounting. We're counting theDaniel Hartmeier
data part (without IP and TCP/UDP/ICMP headers), like the state counter does.
2001-08-19Document per-rule statistics. If the evaluation counters look funny,Daniel Hartmeier
think skip steps.
2001-08-19Print per-rule statistics when -v is used with -sr (show rules).Daniel Hartmeier
2001-08-19Unfuck some TCP state stuff that would drop the SYN|ACK.Mike Frantzen
Enumerated the TCP states. Here's a mapping new->old tcp states if anyone gives a shit: TCPS_CLOSED 0 TCPS_SYN_SENT 1 TCPS_ESTABLISHED 2 TCPS_CLOSING 3 TCPS_FIN_WAIT_2 4 TCPS_TIME_WAIT 5
2001-08-19Add parameter list support to parser. Handles lists for protocol, hostsDaniel Hartmeier
and ports in filter rules, like block in from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } to any pass in proto tcp from any to any port { ssh, 1024 >< 2000, > 65000 } block in proto { udp, igmp } and does rule expansion (generate all needed rule combinations).
2001-08-18make pfctl -s state SCREAM; frantzen is now happyTheo de Raadt
2001-08-18prettier printing of statesTheo de Raadt
2001-08-16track the line number per-token, so that we can report errors correctlyTheo de Raadt
2001-08-14optimize the flags parsing; markus@ okMichael Shalayeff
2001-08-11Add support for ICMP errors referring to ICMP queries/replies. FixesDaniel Hartmeier
'ICMP error message for bad proto' messages. Reported by Mark Grimes and Steve Rumble. Add debugging level with ioctl interface and pfctl switch. Default is 'None'.
2001-08-11\+\n support, and spit out cc-style error messages. the parser's lineTheo de Raadt
counting is lex dependent, and will need to be tweaked
2001-08-03o) We always closes .Bl and .Bd tags;Mike Pechkin
millert@ ok
2001-07-31allow to test that flags are unset, ok dhartmei@, mickey@Peter Stromberg
2001-07-28start sentence on new line, from mpech@Daniel Hartmeier
2001-07-26sort SEE ALSO section correctly, from mpech@.Daniel Hartmeier
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-17 19:25:41 +0000