summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2009-09-03remove -N from usage();Jason McIntyre
2009-09-03this time i commit the right diff that wasReyk Floeter
ok henning@ (sorry)
2009-09-03fix two route-to vs. rdr-to conflicts.Reyk Floeter
found by sthen@ ok henning@
2009-09-03remove NAT specific command line optionsPeter Hessler
noticed by Wiktor Izdebski OK henning@
2009-09-02all the new *-to options are part of the "filteropts" section at theReyk Floeter
end of a pf rule (nat-to, divert-to, rdr-to, ...). take the historical chance to upgrade the grammar and move the route options to the filteropts section as well. for example, pass in on em0 route-to (em1 192.168.1.1) from 10.1.1.1 becomes pass in on em0 from 10.1.1.1 route-to (em1 192.168.1.1) many people like this including pyr@ mk@ kettenis@ todd@ and others ok henning@
2009-09-01the diff theo calls me insanae for:Henning Brauer
rewrite of the NAT code, basically. nat and rdr become actions on regular rules, seperate nat/rdr/binat rules do not exist any more. match in on $intf rdr-to 1.2.3.4 match out on $intf nat-to 5.6.7.8 the code is capable of doing nat and rdr in any direction, but we prevent this in pfctl for now, there are implications that need to be documented better. the address rewrite happens inline, subsequent rules will see the already changed addresses. nat / rdr can be applied multiple times as well. match in on $intf rdr-to 1.2.3.4 match in on $intf to 1.2.3.4 rdr-to 5.6.7.8 help and ok dlg sthen claudio, reyk tested too
2009-08-21remove the ``;'' at the end of INDENT() macro definition usingAlexandre Ratchov
the ``do { ... } while (0)'' construct. ok henning, from Frederic Culuot <frederic _at_ culot.org>
2009-07-28Bring back rev. 1.560:Claudio Jeker
Make it possible to use DiffServ Code Point in the TOS fields. Requested by deraadt@
2009-07-27When will people learn to commit their .h file changes?Theo de Raadt
2009-07-27Make it possible to use DiffServ Code Point in the TOS fields. Names likeClaudio Jeker
af11, cs6 and ef will now be mapped to the coresponding TOS value. OK henning@, sthen@, mcbride@
2009-07-09repair -xHenning Brauer
since all this stuff is transactional now we need to wrap that into DIOCXBEGIN/COMMIT. bad henning forgot to commit this chunk at c2k9
2009-05-14actually change the require-order default to No; I missed a part withStuart Henderson
my last commit. ok deraadt@
2009-04-26switch the require-order default to "no". regression tests still pass.Stuart Henderson
ok henning@ deraadt@
2009-04-25scrub_opts must not be empty, scrub on its own does nothing.Henning Brauer
noticed due to a question from otto@, ok regress/sbin/pfctl/ ;)
2009-04-16Really turn fragment reassembly on by default. pfctl must handle thisDavid Krause
since the DIOCSETREASS ioctl is called on every ruleset load and was overriding the initial setting in pfattach(). Fix setting of the global no-df bitmask as well. ok henning@
2009-04-15restore printing of the fragment option; ok henning@David Krause
2009-04-06print prettier, from sthen@Henning Brauer
2009-04-061) scrub rules are completely gone.Henning Brauer
2) packet reassembly: only one method remains, full reassembly. crop and drop-ovl are gone. . set reassemble yes|no [no-df] if no-df is given fragments (and only fragments!) with the df bit set have it cleared before entering the fragment cache, and thus the reassembled packet doesn't have df set either. it does NOT touch non-fragmented packets. 3) regular rules can have scrub options. . pass scrub(no-df, min-ttl 64, max-mss 1400, set-tos lowdelay) . match scrub(reassemble tcp, random-id) of course all options are optional. the individual options still do what they used to do on scrub rules, but everything is stateful now. 4) match rules "match" is a new action, just like pass and block are, and can be used like they do. opposed to pass or block, they do NOT change the pass/block state of a packet. i. e. . pass . match passes the packet, and . block . match blocks it. Every time (!) a match rule matches, i. e. not only when it is the last matching rule, the following actions are set: -queue assignment. can be overwritten later, the last rule that set a queue wins. note how this is different from the last matching rule wins, if the last matching rule has no queue assignments and the second last matching rule was a match rule with queue assignments, these assignments are taken. -rtable assignments. works the same as queue assignments. -set-tos, min-ttl, max-mss, no-df, random-id, reassemble tcp, all work like the above -logging. every matching rule causes the packet to be logged. this means a single packet can get logged more than once (think multiple log interfaces with different receivers, like pflogd and spamlogd) . almost entirely hacked at n2k9 in basel, could not be committed close to release. this really should have been multiple diffs, but splitting them now is not feasible any more. input from mcbride and dlg, and frantzen about the fragment handling. speedup around 7% for the common case, the more the more scrub rules were in use. manpage not up to date, being worked on.
2009-03-19pfctl -ss printed state levels for ICMPv6. Disable this the sameAlexander Bluhm
way it has already been done for ICMPv4. ok mcbride@
2009-02-23back out last commit since it breaks a few regress tests -- this will beTheo de Raadt
looked at post-release -- out of time for these kinds of problems david@ says: pfopt6 and f91.ok; pfopt6 change looks ok, but pf91 is of concern.
2009-02-19spacingTheo de Raadt
2009-02-16fix pfctl -v printing of anchors, from camield@. Closes user/6065Stuart Henderson
2008-10-17in findeol(), do not skip the pushback buffer. fixes PR 5952 by sthen@ andHenning Brauer
should make the pushback buffer really transparent. diagnosis by me, fix with mpf, some input deraadt, ok mpf
2008-10-02implement "set state-defaults X", where X is a list of state options asHenning Brauer
permitted keep state(X). applies to all rules which do not have keep state explicitely. e. g. "set state-defaults pflow, no-sync" ok phessler deraadt
2008-09-10do not try to print $$ when it has not been setTheo de Raadt
2008-09-09welcome pflow(4), a netflow v5 compatible flow export interface.Henning Brauer
flows export data gathered from pf states. initial implementation by Joerg Goltermann <jg@osn.de>, guidance and many changes by me. 'put it in' theo
2008-08-31avoid line wrap in usage() output;Jason McIntyre
2008-08-12use correct byte order when printing state expiration minutes; ok henning@David Krause
2008-08-07correctly copy the log interface spec when expanding an antispoof rule thatHenning Brauer
covers loopback addresses. ok ryan problem report from Harald Dunkel <harald.dunkel@aixigo.de>
2008-07-25don't redefine INFINITY -- math.h defines it nowMartynas Venckus
pointed out by, and ok david@, go ahead henning@
2008-07-24check sysctl return valueHenning Brauer
From: Gleydson Soares <gsoares@gmail.com>, ryan ok
2008-07-03do not forget to initialize other member of $$ in qname; noted by mark shroyerTheo de Raadt
ok henning
2008-06-29Simplify state creation code; merge state import/export code between pfsyncRyan Thomas McBride
and the state-related pf(4) ioctls, and make functions in state creation and destruction paths more robust in error conditions. All values in struct pfsync_state now in network byte order, as with pfsync. testing by david ok henning, systat parts ok canacar
2008-06-21Fix "-T expire"; clear pfra_fback on addresses before sending them back toRyan Thomas McBride
the kernel to be deleted.
2008-06-11remove an ugly article;Jason McIntyre
2008-06-10Make counters on table addresses optional and disabled by default.Ryan Thomas McBride
Use the 'counters' table option in pf.conf if you actually need them. If enabled, memory is not allocated until packets match an address. This saves about 40% memory if counters are not being used, and paves the way for some more significant cleanups coming soon. ok henning mpf deraadt
2008-06-10save somespace in the state by collapsing two 8 bit ints used as booleansHenning Brauer
into one 8 bit flags field. shrinks the state structure by 4 bytes on 32bit archs ryan ok
2008-06-10in verbose mode indicate which states are sloppy, ryan reyk theoHenning Brauer
2008-06-10new state option "sloppy" to use the sloppy tcp state tracker insteadHenning Brauer
of the good one. ok theo ryan reyk
2008-05-29Second half of PF state table rearrangement.Ryan Thomas McBride
- Mechanical change: Use arrays for state key pointers in pf_state, and addr/port in pf_state_key, to allow the use of indexes. - Fix NAT, pfsync, pfctl, and tcpdump to handle the new state structures. In struct pfsync_state, both state keys are included even when identical. - Also fix some bugs discovered in the existing code during testing. (in particular, "block return" for TCP packets was not returning an RST) ok henning beck deraadt tested by otto dlg beck laurent Special thanks to users Manuel Pata and Emilio Perea who did enough testing to actually find some bugs.
2008-05-27Fix count of states flushed, broken when the psnk_af hack was removed in ↵Ryan Thomas McBride
pf_ioctl.c r1.196.
2008-05-16no need to quote the argument to .Nd, now that it's nice and short;Jason McIntyre
2008-05-16There is not really a network address translation device.Marco Pfatschbacher
Remove it from the name section. OK mcbride, henning
2008-05-09Add support to kill states by rule label or state id.Marco Pfatschbacher
Fix printing of the state id in pfctl -ss -vv. Remove the psnk_af hack to return the number of killed states. OK markus, beck. "I like it" henning, deraadt. Manpage help from jmc.
2008-05-09Replace a crockpot of semi-cloned productions for handling portTheo de Raadt
numbers with one, and fix a few other bugs along the way ok mpf henning
2008-05-09convert port byte order in the production; add port keyword; ok deraadt@Markus Friedl
2008-05-09divert packets to local socket without modifying the ip header;Markus Friedl
makes transparent proxies much easier; ok beck@, feedback claudio@
2008-05-08make "to any" optional in binat, or well, the implied default.Theo de Raadt
requested by reyk, ok reyk mpf
2008-05-08Loosen grammer to permit any number of newlines within most kinds of { }Theo de Raadt
blocks, as requested by reyk; ok reyk mpf henning
2008-05-08Bring back (in a more yacc friendly way) support for setting variablesTheo de Raadt
to a sequence of strings and numbers, which get folded together into one string (and later, when used, is re-lexed) ok mpf