| Age | Commit message (Collapse) | Author |
|---|
|
|
|
i added that button many many many years ago since the order (options, scrub,
nat, filter) was enforced back then, which I hated. now we had that turned
off for ages, and with the scrub and nat rulesets being gone, there is very
little reason to enforce an order at all. so let's get rid of it.
introducing this button was one of my very early commits to openbsd... feels
a bit strange to remove it now :)
ok ryan dlg theo
|
|
|
|
|
|
print that as flag then
|
|
ok mcbride@ henning@
|
|
has changed to conform with modern groff releases.
diff for route6d(8) written mostly by schwarze@, with lots of useful
advice from jmc@.
ok jmc@, schwarze@
|
|
This allows to write rules like "pass in on rdomain 1".
Tested by phessler@, OK henning@
|
|
route-to and friends were introduced making it obsolete. one even
has to look it up int the ipf manual to get and idea what it's
supposed to do. reuse some kernel bits for the upcoming nat64
stuff. "kill it with fire" from mcbride, "what mcbride said"
from mpf, "kill kill kill" and ok henning.
|
|
"no priority" priority named "none". This makes 'pfctl -x none'
equivalent to 'pfctl -x crit'.
ok mcbride@ henning@
|
|
no-df, random-id, set-tos for IPv6 rules. Check this in pfctl and
document it in pf.conf(5).
ok henning@ jmc@
|
|
From: Thomas Pfaff <tpfaff@tp76.info>
|
|
ok henning@ mcbride@
|
|
order and therefore a ntohs is needed to show the rdomain correctly.
OK henning@ dlg@
|
|
who decided to just do it on their own. henning, mcbride, jsing -- shame
on you -- if you had shown this diff to just 1 other network developer,
the astounding mistake in it would have been noticed. Start practicing
inclusionary development instead of going alone.
ok claudio
|
|
by mcbride@.
ok mcbride@ henning@
|
|
correctly. A zero address field is used to identify divert-reply
rules. If the rule's address family is unspecified, PF_AZERO()
always returns false. So use AF_INET6 as address family, to check
all bits of the address.
ok markus@
|
|
|
|
convert a long .Op line into a few lines of .Xo ... .Xc. no "binary" change
with mandoc.
|
|
by numeric ID in combination with the "-s rules" or "-s labels" options.
For example, this allows you to dump the statistics of a specified rule
only (pfctl -sr -v -R 0).
ok henning@
|
|
both now can be used in both directions. the kernel allowed that ever since
we did the great NAT rewrite.
still enforce that a direction is given, a rule with rdr-to and/or nat-to
and no direction is pretty certainly an error (which it would work,
technically)
ok ryan claudio dlg
|
|
awesome for debugging, a rule like
match log(matches) from $testbox
will show you exactly which subsequent rules match on that packet
real ok theo assumed oks ryan & dlg bikeshedding many
implementation time ~1 min bikeshedding about the keyword longish.
i voted for "matches" since i like to play with matches
idea was theo's, actually
|
|
|
|
While here, remove .Xo macros that were ugly workarounds
to deal with groff-1.15 bugs, but are required neither by modern groff
nor by mandoc nor by any documentation we are aware of.
Problem originally noticed by jmc@ running mandoc -Tlint;
patch ok by jmc@.
|
|
worded. i think what is there now is clear enough.
|
|
- note that -f replaces the current ruleset
based on a diff from Anders Langworthy, but altered by mcbride and henning;
ok henning
|
|
|
|
written with help from henning@, who suggested ensuring that there
are no changes in the digests for object files, thanks!
ok henning@
|
|
to recursively print anchors with wildcards when not
requested via the command line but in practice only
applied to automatically generated inline anchors
(which don't have wildcards) or when recursion
was requested.
Found by the clang static analyser and behaviour explained
by mcbride@
ok henning@ mcbride@
|
|
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?
|
|
|
|
printing, both of inline anchors and when requested explicitly with a '*'
in the anchor.
- Correct recursive printing of wildcard anchors (recurse into child anchors
rather than rules, which don't exist)
- Print multi-part anchor paths correctly (pr6065)
- Fix comments and prevent users from specifying multi-component names for
inline anchors.
tested by phessler
ok henning
|
|
will be getting cleaned up soon.
ok henning
|
|
ok mcbride
|
|
ok henning@ krw@
|
|
- 'make -Fi' reset ALL the interface statistics
can be restricted with -i ifname
- 'make -Fa -i ifname' fail (it's meaningless)
- get rid of a silly little struct that's only used for one thing
ok henning
|
|
it is violating the transactional model we have and made stronger in
pf, it is broken in some cases and since some options are passed to the
kernel while some are userland only and affect how the rules are
parsed it is complete bullshit anyway - obviously, changing options
that affect ruleset parsing without reloading and thus reparsing the
ruleset cannot work. so stop pretending it could and cut the crap.
ok dlg krw deraadt
|
|
program does not free(3) it.
|
|
ALTQ transactions when anchors are loaded.
Fixes pfctl when using 'load anchor ... from' as seen by beck@
and Toni Mueller, which stopped working after r1.295 removed loadopt
(which was overloaded to do this job as well as indicate command-
line flags).
ok henning@
|
|
|
|
the partial loading of a ruleset (leaving ancors aside) is wrong and
conflicts with the general idea of how pf works. last not least it breaks
with the optimizer generating tables automagically.
ok deraadt sthen krw manpage jmc
|
|
need to free it with free(3).
from zinovik
|
|
Found by Marcus Muelbuesch. ok henning@
|
|
definition of DPFPRINTF(), and log priorities from syslog.h. Old debug
levels will still work for now, but will eventually be phased out.
discussed with henning, ok dlg
|
|
ok mcbride
|
|
|
|
ok mcbride@ henning@
|
|
address family is selected; don't print the v6 mask if it's a v4 address.
|
|
tests for illegal conditions in translation/routing.
|
|
collapsing into tables, so that we can handle all possible address family
expansions.
|
