summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2011-10-25document some limits of "group-name"; from Steffen Daode NurpmesoJason McIntyre
ok henning
2011-10-20For NAT-T with transport mode, use the ISAKMP's SA addresses for theYASUOKA Masahiko
flow instead of the ID payload. This will fix a part of problems of L2TP/IPsec from NAT'd clients. ok markus@ tested by markus@ and myself.
2011-10-13pfctl change for af-to / NAT64 support.Claudio Jeker
The general syntax is: pass in inet from any to 192.168.1.1 af-to inet6 from 2001::1 to 2001::2 In the NAT64 case the "to" is not needed in af-to and the IP is extraced from the IPv6 dst (assuming a /64 prefix). Again most work by sperreault@, mikeb@ and reyk@ OK mcbride@, put it in deraadt@
2011-10-12default snaplen is 160 these daysHenning Brauer
From: giovanni <qgiovanni at gmail dot com>
2011-10-06no more ccd(4);Jason McIntyre
2011-10-06mark ccd(4) deprecated in a few more placesTheo de Raadt
2011-10-06ccd goes to the atticTheo de Raadt
discussed with jsing and millert
2011-09-29ssl.8: Certifying Authority -> Certificate AuthorityJason McIntyre
isakmpd.8: rsa:1024 -> rsa:2048 (ok markus) all: X509 -> X.509 from Lawrence Teo
2011-09-20Prepare to add support ALPS touchpadsAlexandr Shadchin
no objections mpi@ and matthieu@
2011-09-20rev 1.80 added calls from the signal handler to stdio. bad bad bad!Theo de Raadt
use system calls directly, instead.
2011-09-19kill prototypes for long removed functions, Rafael Sadowski <rafael atHenning Brauer
sizeofvoid.org>
2011-09-17Standarize the ToS option across nc/ping/traceroute so that they'llChristiano F. Haesbaert
accept the same values as pf.conf. It accepts decimal, hexadecimal and the dscp/tos keywords. The ping option was ripped of in SMALL. ok mcbride@ sthen@
2011-09-16reorder SENSOR_* in switch() and add missing cases.Yojiro Uo
ok deraadt@
2011-09-16fix typoYojiro Uo
2011-09-16apply following changes to sensor framework:Yojiro Uo
- change accuracy of SENSOR_FREQ from Hz to muHz - add SENSOR_VOLTS_AC entry to userland programs ok deraadt@
2011-09-15Fix recognition Synaptics touchpadAlexandr Shadchin
from Patrick Keshishian (sidster at boxsoft dot com)
2011-09-07Avoid possible SIGSEGV when wrong tos option.Christiano F. Haesbaert
2011-09-04knock out useless Pp;Jason McIntyre
2011-09-04grammar fix; from Martin PelikanJason McIntyre
2011-09-03make -column lists pretty again;Jason McIntyre
specifically, rewrite them to permit some markup in the column headers, and use "Ta" instead of literal tabs; mandoc does not currently match groff 100%, but a mandoc fix may be some time off, and we've gone enough releases with poorly formatting column lists. in some cases i have rewritten the lists as -tag, where -column made little sense.
2011-08-30One shot rules can be used in pf.conf by specifying a "once" filter option.Mike Belopuhov
ok henning, mcbride
2011-08-27Under certain circumstances iked can be tricked to bypass a signatureMike Belopuhov
verification caused by the incorrect check of the EVP_VerifyFinal return value. Issue was discovered and reported by Justin Ferguson, justin-dot-ferguson-at-ioactive.com. Thanks! While here, check for HMAC_* return values. ok jsg, markus
2011-08-21Remove old wpapsk entries. Cleanup casts and use timerclear.Christiano F. Haesbaert
ok mcbride
2011-08-19as with other list types, column lists generally do not need a Pp/-compactJason McIntyre
construct; this also sidesteps what seems to be a problem with mandoc, in that "-column -compact" seems to mess up the formatting. thus these pages should now have their lists formatted nicely (i.e. correctly aligned and with indent applied); as a side note, the fact that headers are not properly marked up is another issue which will be addressed separately (a mandoc fix is needed, i think). i have fudged a few of these to mark up properly, since the workaround does make sense for some pages. as another side note, i haven;t fixed man7, as i need to prepare a separate diff for kristaps and ingo.
2011-08-02add refcounting for "Configuration" section for acquire-mode SAsMarkus Friedl
ok mikeb@
2011-08-01Add missing closing braces in usage().Matthieu Herrb
Ok jmc@ (who also pointed me to the 2nd missing one) sobrado@.
2011-07-31missing .Nm macro; ok jmc@Ingo Schwarze
2011-07-29Remove requirement to quote 'debug' loglevel for the 'debug' option.Ryan Thomas McBride
ok henning
2011-07-27Add support for weighted round-robin in load balancing pools and tables.Ryan Thomas McBride
Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
2011-07-13Force user to specify protocol when filtering on user, gid, and osRyan Thomas McBride
attributes (this is now required by pf_rule_test(). ok sthen henning
2011-07-09Add a missing prototype, fix build with WARNINGS=yes.Nicholas Marriott
2011-07-09tweak previous;Jason McIntyre
2011-07-09rmove rotten netatalk bitsHenning Brauer
2011-07-08allow rules to specify "prio X" or "prio (X, Y)" to assign priority levelsHenning Brauer
for the new priority queueing implementation. valid range is 0 to 7. the old trick for priorizing empty ACKs etc remains thru the latter notation ok ryan mpf sthen plus pea testing and halex and claudio reading
2011-07-08Include PIPEX in kernel by default. And add new sysctl variableYASUOKA Masahiko
`net.pipex.enable' to enable PIPEX. By default, pipex is disabled and it will not process packets from wire. Update man pages and update HOWTO_PIPEX_NPPPD.txt for testers. discussed with dlg@, ok deraadt@ mcbride@ claudio@
2011-07-08Correctly print skip steps in -vv modeRyan Thomas McBride
- Did not include PF_SKIP_RDOM - Changed order of address and ports.
2011-07-08Rename 'rc_scripts' to 'pkg_scripts' to make it clear this variable is forAntoine Jacoutot
packages _only_. One is not supposed to add any base scripts in it. naddy@ doesn't care (I think he does care but he won't admit it) ok robert@ (I'll add something to current.html in a few)
2011-07-08add basic config support for creating aoe disks. ok marcoTed Unangst
2011-07-07remove mvmeppc; it is really rough shape. ok drahn miodTheo de Raadt
2011-07-07We can mention ipcomp, since it worksTheo de Raadt
2011-07-07Don't print 'keep state' anymore unless it's needed for state options, it'sRyan Thomas McBride
been implicit for years now. ok henning@
2011-07-07Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesRyan Thomas McBride
a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
2011-07-06Add sysctl net.inet.tcp.always_keepalive, when this is set the systemStuart Henderson
behaves as if SO_KEEPALIVE was set on all TCP sockets, forcing keepalives to be sent every net.inet.tcp.keepidle half-seconds. In conjunction with a keepidle value greatly reduced from the default, this can be useful for keeping sessions open if you are stuck on a network with short NAT or firewall timeouts. Feedback from various people, ok henning@ claudio@
2011-07-06For non-crypted flows (such as ipcomp and ipip), default theirTheo de Raadt
type (if not specified) to "use" instead of "require". (since they will not get a key...) ok mikeb claudio
2011-07-05Add DIOCGPDINFO to rxioctl(), as a synonym for DIOCGDINFO, the lastKenneth R Westerback
place it was missing. Delete now redundant calls to DIOCGDINFO when getting physical disk info in disklabel(8) and fdisk(8). Reminded by a fdisk discussion with Andres Perera on tech@. ok deraadt@
2011-07-05fix memcpy sizeof. found by jsg. ok deraadt krw mikebTed Unangst
2011-07-05More non-512-byte sector groundwork. Don't let disklabel hint thatKenneth R Westerback
a ffs frag size can be less than the d_secsize of the disk. Make sure amd64 writedisklabel() puts the disklabel where readdoslabel() will read it. Tweak i386/amd64 installboot/biosboot so sectors are indeed used where sectors are claimed. Lets me fdisk, newfs, mount and installboot onto 2048 and 4096 byte sector devices. Other filesystem utilites will still hold surprises. Note that actually booting from such devices will await BIOSen that acknowledge such devices as bootable. ok guenther@
2011-07-05kill a useless Pp;Jason McIntyre
2011-07-05Flip one .Fl interface to .Fl iface since iface is used everywhere elseClaudio Jeker
even though -interface is the same as -iface. OK jmc@
2011-07-05Fix IKEV2_N_NO_ADDITIONAL_SAS notification by including the SPIMike Belopuhov
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 18:03:02 +0000