summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2002-07-26make the order of log and quick irrelevant. now bothHenning Brauer
block in log quick all and block in quick log all work. ok dhartmei@, deraadt@
2002-07-25prettyTheo de Raadt
2002-07-25Rename the WSDISPLAY_TYPE_SUNFFB display type into a more generic name,Miod Vallat
..._SUN24, since this only means 24 bit framebuffers with BGR encoding. Also add a WSDISPLAY_TYPE_SUNBW for Sun monochrome framebuffers, to be used by Xwsfb shortly.
2002-07-23timeout_list/_spec and limit_list/_spec don't return anything -> no %type.Henning Brauer
ok theo
2002-07-21fix route-to alsoTheo de Raadt
2002-07-21make the , optional in many places. This makes string concat a lot moreTheo de Raadt
useful. Now you can in = ssh domain www out = $in ftp finger pass in proto tcp from any to any port { $in } pass out proto tcp from any to any port { $out } a poor example, but the idea is obvious
2002-07-21string concat, ie.Theo de Raadt
a=a b c=$a $a
2002-07-20minor indent tweaksTheo de Raadt
2002-07-20properly split yacc and lex useTheo de Raadt
2002-07-19minor tweaks, sighTheo de Raadt
2002-07-19And back out the last change again.Daniel Hartmeier
2002-07-19rework the interface lookup routines internals.Henning Brauer
less and easier code than before. no functional changes. ok frantzen@, dhartmei@
2002-07-19Support # comments at the end of lines and inside (multi-line) stringDaniel Hartmeier
literals, so you can do things like macro="{ foo, # first entry bar, # second entry baz }" # last entry or pass in on $ext_if \ # external interface proto tcp \ # TCP connections from any to $ext_if \ # to the gateway itself keep state And sneaking in two minor fixes for KNF.
2002-07-19Use getnameinfo() instead of gethostbyaddr() to support IPv6 reverseDaniel Hartmeier
lookups with pfctl -r. Makes things actually simpler.
2002-07-19deal with the fact that the struct node_host ifa_pick_ip gets is not alwaysHenning Brauer
the result of an interface expansion. in this case ifa_pick_ip does an address family check (that's actually a (wanted) side effect). Thus, we need to spit out a meaningfull error message in case of a mismatch. also adjust all the other error messages, they were also assuming that nh is the result of an interface expansion. after a looooong discussion on icb (dhartmei@, pb@, me) we agreed on the term "translation address" for that. okay dhartmei@
2002-07-18use inet_aton(), until this is made v6 awareTheo de Raadt
2002-07-18fix warningTheo de Raadt
2002-07-18de-lint a bit. use inet_aton(); millert okTheo de Raadt
2002-07-17support "self" as address. self expands to all IPv4 and IPv6 addresses ofHenning Brauer
the machine, on all interfaces. I wanted block in log on ! lo0 from any to self for years, and now it's possible. ok "I may lose my slacking status if I OK it" frantzen@ ok dhartmei@ documentation in pf.conf.5 to come with pb@'s rewrite
2002-07-16Add nat_consistent() and rdr_consistent() for checks that should occurDaniel Hartmeier
after rule expansion, similar to rule_consistent(). Fixes the non-effective test for rdr rules for non-TCP/UDP protocols with ports, found by mpech@, ok frantzen@
2002-07-16fix $OpenBSD TagMarkus Friedl
2002-07-15add support forHenning Brauer
pass|block on ! $interface ... ok dhartmei@ will be documented in pf.conf(5) by "I'm not slacking!" pb@ who's currently reworking this manpage
2002-07-15cosmetics/consolidations to manpage in yyerror()sPhilipp Buehler
ok henning@, dhartmei@
2002-07-15o complain about keep state on block rulesHenning Brauer
o complain about return-rst on rules which aren't limited to tcp pointed out by not-slacking-but-testing pb@ ok pb@, dhartmei@
2002-07-13add list expansion for interface and proto in nat rules and for proto in rdrHenning Brauer
rules (interface was already there). since the nat.conf/pf.conf merge the parser accepted these but didn't expand them. ugh. ok dhartmei@
2002-07-12Mention that an interface can be a part of at most one bridge.Jason Wright
2002-07-11malloc() failure tests; rimshot@pandora.beTheo de Raadt
2002-07-09HASH payload validation does not require an exchange.Hakan Olsson
2002-07-09check sin6_scope_id field, just in case we change the routing socket APIJun-ichiro itojun Hagino
for scoped address (unlikely due to the deployed codebase...).
2002-07-09getifaddrs(3) grabs link-local addrs in kernel internal form, convert themJun-ichiro itojun Hagino
into proper sockaddr_in6.
2002-07-09rework the interface-to-IP routines.Henning Brauer
you can use interface names instead of an IP in most places. However, until now, it was only expanded to the interface's first IPv4 address if existant (and address family unset or inet) and the first IPv6 address otherwise. this diff changes that. the interface is proper expanded to all IPs, IPv4 _and_ IPv6, now. it also cleans up the lookup procedures (well, in fact, they are replaced by a new one), there's no need for different procedures for IPv4 and IPv6. we now just have one list of interfaces (AF_LINK) and one list with IPs (AF_INET and AF_INET6) with corresponding lookup functions, ifa_exists and ifa_lookup. nat, rdr & friends now use the new function ifa_pick_ip to get the IP in rules like nat on $interface from $whatever to any -> $interface ifa_pick_ip tries to be smart. if the interface has only one IP address and the nat rule doesn't specify an address family (or it matches with this address), take this one. If the address family is specified in the nat rule and there is only one IP for the given address family, this one is used. if the address family is not specified and there is more than one IP pfctl throws an error. The same applies for multiple IPs per address family. This causes regression tests 18 and 20 to fail because the address family isn't specified there; diff for those coming. also fix some prototypes while I'm here. pb@ found another problem while testing that we must have introduced somewhat after 3.1. $cat t nat on ne3 from any to any -> 213.128.133.5 $pfctl -nvf t nat on ne3 all -> ? it's only a representation bug as far as I've checked, nontheless it should be fixed. as a nat/rdr rule always nats/redirects to one IP only we can just steal its target's IP af and set the rule's af accordingly. then inet_ntop does play nice. binat rules already enforce having an address family set always and thus are not affected. ok dhartmei@, pb@, kjell@ "It looks good" frantzen@
2002-07-08Don't allow 'flags' option in non-TCP rules, found by mpech@Daniel Hartmeier
2002-07-08make failed SIOCG80211NWKEY print alert more clearly; ↵Theo de Raadt
jolan@norm.encryptedemail.net
2002-07-06Remove kernel support for NTP. ok deraadt@ and tholo@Thomas Nordin
2002-07-06Security Mode feature set.Grigoriy Orlov
From Alexander Yurchenko <grange@rt.mipt.ru> Approved by csapuntz@ and me.
2002-07-05unbreak.Henning Brauer
2002-07-05another small bug I found while installing a -current pf firewall.Henning Brauer
we don't support pass/block in on ! <interface> (at least, not yet) let the parser complain instead of ignoring the '!' ok pb@, dhartmei@
2002-07-05allow unsetting the statusinterface viaHenning Brauer
set loginterface none ok dhartmei@
2002-07-05volatile sig_atomic_t, suggested by Theo.Hakan Olsson
2002-07-05gcc 3.1 nits. Pointed out by David Krause.Hakan Olsson
2002-07-04Do not assume we have an active exchange during payload validation.Hakan Olsson
2002-07-04styleHakan Olsson
2002-07-03ansiTheo de Raadt
2002-07-03convert to ansi. suddenly realise that means yet another function is aTheo de Raadt
signal handler in some cases, and make it cope with the termination race.
2002-07-01cut and pasto (fetch maxage correctly); Benny Holmgren <bigfoot@astrakan.hig.se>Jason Wright
2002-07-01do not Xr startkeyTheo de Raadt
2002-07-01streamline parse buffer handling (no need to copy value that is notMarc Espie
going to go away). add explicit pushback buffer, to be able to push IPv6 failed parses back. handle pushback + parse buffer interactions by using negative indices. okay dhartmei@, deraadt@
2002-07-01KNFTheo de Raadt
2002-06-29ansiTheo de Raadt
2002-06-29IPPROTO_ICMP will not change in our life; itojun okTheo de Raadt