summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2005-05-27filtering on ruleset name is already implemented, document it.Daniel Hartmeier
2005-05-27show flow type (require, use, etc.)Hans-Joerg Hoexer
2005-05-27Additional paranoia. OK hshoexerChad Loder
2005-05-27Use SADB_SATYPE_* instead of IPPROTO_*Hans-Joerg Hoexer
2005-05-27get rid of 'log-all'. now that we have 'log (options)', make 'all' anDaniel Hartmeier
option to log. so, 'log-all' becomes 'log (all)'.
2005-05-27get rid of shift/reduce conflicts, don't support empty logoptsDaniel Hartmeier
2005-05-27log two pairs of uid/pid through pflog: the uid/pid of the process thatDaniel Hartmeier
inserted the rule which causes the logging. secondly, the uid/pid of the process in case the logged packet is delivered to/from a local socket. a lookup of the local socket can be forced for logged packets with a new option, 'log (user)'. make tcpdump print the additional information when -e and -v is used. note: this changes the pflog header struct, rebuild all dependancies. ok bob@, henning@.
2005-05-27When looping over pfkey messages, make sure extension length is > 0.Hans-Joerg Hoexer
While around, do some minor tweaks in a not yet used code path.
2005-05-27use new sysctl to retrieve flow informations including IDsHans-Joerg Hoexer
2005-05-27o only pass signals from monitor to slave when pid is validMoritz Jodeit
o remove some unused monitor command with and ok hshoexer
2005-05-27move m_state.s directly into must_{read,write} instead of passingMoritz Jodeit
it every time as an argument. ok cloder@ hshoexer@
2005-05-27remove unused tableHans-Joerg Hoexer
2005-05-27Support for dumping the SADB.Hans-Joerg Hoexer
2005-05-27Experimental support for opportunitic use of jumbograms where only some hostsRyan Thomas McBride
on the local network support them. This adds a new socket option, SO_JUMBO, and a new route flag, RTF_JUMBO. If _both_ the socket option is set and the route for the host has RTF_JUMBO set, ip_output will fragment the packet to the largest possible size for the link, ignoring the card's MTU. The semantics of this feature will be evolving rapidly; talk to us if you intend to use it. ok deraadt@ marius@
2005-05-27guarantee nul-termination in the monitor, we must. ok cloder@ hshoexer@Moritz Jodeit
2005-05-27allow 'tagged' in 'anchor' rules (without complaining about missingDaniel Hartmeier
'keep state'), as a condition to branch into the anchor. suggested by Bill Marquette.
2005-05-26simplify read/write between child and monitorHans-Joerg Hoexer
help and ok cloder moritz
2005-05-26Add ARGSUSED for lint, one comment for meHans-Joerg Hoexer
2005-05-26The illegalness of "no nat log" is already enforced by the grammar.Camiel Dobbelaar
ok dhartmei
2005-05-26remove traces from union et al; pedro@ ok.Federico G. Schwindt
2005-05-26use PF_LOG, PF_LOGALL instead of numeric constantsDaniel Hartmeier
2005-05-26support 'log' and 'log-all' in 'nat/rdr/binat pass' rules. original patchDaniel Hartmeier
from camield@. use #defines PF_LOG, PF_LOGALL instead of magic constants. ok frantzen@, camield@
2005-05-26Use TAILQ_FOREACH where possible, remove payload_last()Hans-Joerg Hoexer
ok markus
2005-05-26add log_errorx() which doesn't print the errno value. ok hshoexer@Moritz Jodeit
2005-05-26introduce ISAKMP_PAYLOAD_MAXHans-Joerg Hoexer
2005-05-26get rid of payload mappingHans-Joerg Hoexer
ok markus ho cloder
2005-05-26remove hiding of interface family groupsHenning Brauer
2005-05-26Handle strdup returning NULL. OK hshoexerChad Loder
2005-05-26switch the max_src_{states,conn,conn_rate} from superblock breaks to superblockMike Frantzen
optimization barriers to prevent table merging or rule re-ordering ok dhartmei@
2005-05-26disallow interface group names that end in a digit to differentiate them fromMike Frantzen
true interfaces ok henning@
2005-05-26remove reference to MNT_UNIONPedro Martelletto
2005-05-26bye byePedro Martelletto
2005-05-26remove the stackable filesystemsPedro Martelletto
2005-05-26Clean up some cleanup code. Fixes at least one leak, possibly more.Chad Loder
OK hshoexer
2005-05-25make the remaining pf_rule fields named superblock BREAKs instead just lettingMike Frantzen
them default to BREAKs. no functional change
2005-05-25make the optimizer safe in the presence of interface groups. they must act asMike Frantzen
an optimization block break ok dhartmei@
2005-05-25Fix a commentHans-Joerg Hoexer
2005-05-25rearrange order of messages sent to the kernelHans-Joerg Hoexer
2005-05-25set incoming flows to "use", outgoing to "require"Hans-Joerg Hoexer
2005-05-25prepare for new sysctl interface, not used yetHans-Joerg Hoexer
2005-05-25do not swap srcid/dstid for INOUT rules.Hans-Joerg Hoexer
2005-05-25use bzeroHans-Joerg Hoexer
2005-05-25add ifconfig -M option to replace wicontrol -L and -l for ap scanningReyk Floeter
and node listing. wicontrol is not supported by net80211 drivers anymore. further improvements will be done. ok dlg@, jsg@
2005-05-25aesctr and null supportMarkus Friedl
2005-05-24Identify states that will not be synchronised in pfctl -vvss output.Christopher Pascoe
ok mcbride@ henning@
2005-05-24fix minor ouput glitch, by using strtonum instead of strtol.Moritz Jodeit
ok millert@
2005-05-24support trunk stacking (trunks as trunk ports) and some fixesReyk Floeter
ok brad@
2005-05-24add net.inet.ip.ifq for monitoring and changing ifqueue; similar to netbsdMarkus Friedl
ok henning
2005-05-24kill unneeded exit(). log_fatal() already does it. ok hshoexer@Moritz Jodeit
2005-05-24no more 'ifconfig $if 0.0.0.0 up' only 'ifconfig $if up' since dhclientTodd T. Fries
uses bpf exclusively ok deraadt@, henning@, claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-05 04:23:01 +0000