summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2001-08-23o for a port_item, initialize the "next" pointer to NULLTodd C. Miller
o for an address, use calloc() instead of malloc() so the struct is zeroed Fixes a SEGV in pfctl due to uninitialized "next" pointers.
2001-08-23Support var="string". Expansion (at lex time) done using $var, for instance:Theo de Raadt
okproto="{ssh, smtp, domain, auth}" pass in on key0 proto tcp from any to any port $okproto keep state Can I ask someone else to document this in pf.conf(5)?
2001-08-23KNFTheo de Raadt
2001-08-23for -s all, do not error out when the first ioctl failsTheo de Raadt
2001-08-22ftp-proxyBob Beck
2001-08-19do not spin if no states are foundTheo de Raadt
2001-08-19Document per-rule byte counter.Daniel Hartmeier
2001-08-19Add per-rule byte counter, so mickey can do accounting. We're counting theDaniel Hartmeier
data part (without IP and TCP/UDP/ICMP headers), like the state counter does.
2001-08-19Document per-rule statistics. If the evaluation counters look funny,Daniel Hartmeier
think skip steps.
2001-08-19Print per-rule statistics when -v is used with -sr (show rules).Daniel Hartmeier
2001-08-19Unfuck some TCP state stuff that would drop the SYN|ACK.Mike Frantzen
Enumerated the TCP states. Here's a mapping new->old tcp states if anyone gives a shit: TCPS_CLOSED 0 TCPS_SYN_SENT 1 TCPS_ESTABLISHED 2 TCPS_CLOSING 3 TCPS_FIN_WAIT_2 4 TCPS_TIME_WAIT 5
2001-08-19Add parameter list support to parser. Handles lists for protocol, hostsDaniel Hartmeier
and ports in filter rules, like block in from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } to any pass in proto tcp from any to any port { ssh, 1024 >< 2000, > 65000 } block in proto { udp, igmp } and does rule expansion (generate all needed rule combinations).
2001-08-18make pfctl -s state SCREAM; frantzen is now happyTheo de Raadt
2001-08-18prettier printing of statesTheo de Raadt
2001-08-16track the line number per-token, so that we can report errors correctlyTheo de Raadt
2001-08-14optimize the flags parsing; markus@ okMichael Shalayeff
2001-08-11Add support for ICMP errors referring to ICMP queries/replies. FixesDaniel Hartmeier
'ICMP error message for bad proto' messages. Reported by Mark Grimes and Steve Rumble. Add debugging level with ioctl interface and pfctl switch. Default is 'None'.
2001-08-11\+\n support, and spit out cc-style error messages. the parser's lineTheo de Raadt
counting is lex dependent, and will need to be tweaked
2001-08-03o) We always closes .Bl and .Bd tags;Mike Pechkin
millert@ ok
2001-07-31allow to test that flags are unset, ok dhartmei@, mickey@Peter Stromberg
2001-07-28start sentence on new line, from mpech@Daniel Hartmeier
2001-07-26sort SEE ALSO section correctly, from mpech@.Daniel Hartmeier
2001-07-26usage() with __progname according to style(9), typo in man page. both from ↵Daniel Hartmeier
mpech@.
2001-07-20we don't like:Mike Pechkin
o) .Pp before/after .Sh; o) .Pp before/after .Rs/.Re; o) .Nm without argument in SYNOPSIS;
2001-07-19Fix/complete the handling of the binary ops >< and <> to behaveKenneth R Westerback
like the ipf operators. The 'n >< m' construct (Include Range = PF_OP_IRG) should match ports greater than n and less than m, not greater than or equal to n and less than or equal to m. The 'n <> m' construct (Exclude Range = PF_OP_XRG) should match all ports less than n OR greater than m, not be treated as an alias for ><. Thus PF_OP_GL, which was used for both <> and >< is replaced with PF_OP_IRG and PF_OP_XRG with the 'correct' semantics. OK dhartmei@
2001-07-18new ERROR token, errx() -> warnx() + ERROR; ok deraadt@Markus Friedl
2001-07-18KNF for returnMarkus Friedl
2001-07-18check number range to fit in 32 bitsMichael Shalayeff
2001-07-18put range checks on NUMBER, pointed out by deraadtMichael Shalayeff
2001-07-17spaces, parens, err instead of errx+strerrorMichael Shalayeff
2001-07-17warnx()/YYERROR instead of errx(); suggested by mickey@Markus Friedl
2001-07-17markus doesnt like min-ttl =, begoneNiels Provos
2001-07-17support min-ttl, okay dhartmei@Niels Provos
2001-07-17normalize ip_off, make IP_DF stripping optional, return rst is a flag now.Niels Provos
okay markus@
2001-07-17bitch about ! in pf rule; ok dhartmei@ and markus@Marco S Hyman
2001-07-17bitch about extra command line args; ok dhartmei@ and markus@Marco S Hyman
2001-07-17Only set default proto in the rdr case; markus@ OKTodd C. Miller
2001-07-16errx() if getservbyname() failsMarkus Friedl
2001-07-16get rid of cleanfiles by getting rid of cleanfiles; markus@ okMichael Shalayeff
2001-07-16better flags parsing; dhartmeiMarkus Friedl
2001-07-16add a yacc parser for pf.conf and nat.conf, with help from mickey@,Markus Friedl
plus: -n now turns off all operations, and just parses the conf files ok deraadt@
2001-07-11Error on invalid portsConstantine Sapuntzakis
2001-07-10Oops, we can't use 0 as next_addr()'s error return since 0.0.0.0 isTodd C. Miller
a valid address. Instead I add a pointer to the result as a parameter and return 0 on failure and 1 on success. Also uses inet_pton() instead of inet_aton().
2001-07-10Resolve as a host name if not an IP address; dhartmei@ OKTodd C. Miller
2001-07-10move "proto" in the nat case as wellTodd C. Miller
2001-07-09Move the proto field to be after the "on" argument which is consistentTodd C. Miller
with pf.conf. If no proto is specified tcp is assumed. dhartmei@ OK
2001-07-09Extend nat/rdr syntax. Add source/destination selection. MakeDaniel Hartmeier
interface optional. Suggested by rdump@river.com. nat [on [!] <ifname>] from (any | [!] <addr>[/<mask>]) to (any | [!] <addr>[/<mask>]) -> <addr> [proto (tcp | udp | icmp)] rdr [on [!] <ifname>] from (any | [!] <addr>[/<mask>]) to (any | [!] <addr>[/<mask>]) port <a>[:<b>] -> <addr> port <c>[:*] [proto (tcp | udp | icmp)]
2001-07-06Allow negative match on interface name for nat and rdrChris Cappuccio
ok dhartmei@
2001-07-05&, not &&. Pointed out by dhartmei@.Hakan Olsson
2001-07-04cleanerTheo de Raadt
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 23:10:57 +0000