summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Expand)Author
2006-01-31the TCP SACK option needs sequence number modulationMike Frantzen
2005-11-14fix spelloChristopher Pascoe
2005-11-04crank pf_state and pf_src_node byte and packet counters to u_in64_t, sinceRyan Thomas McBride
2005-10-26Instead of using arc4random() to modulate the TCP isn, call tcp_rndiss_next()Ryan Thomas McBride
2005-10-25mtag in pf_route is now only used for IPSEC, so #ifdef itHenning Brauer
2005-10-17make pf use one mbuf tag instead of 6 distinct ones. use a little structHenning Brauer
2005-09-28Improve the safety of pf IOCTLs, taking into account that some paths can sleep.Christopher Pascoe
2005-08-22when nat'ing icmp 'connections', replace icmp id with proxy valuesDaniel Hartmeier
2005-08-22fix rdr to bitmask replacement address pool. patch from Max Laier,Daniel Hartmeier
2005-08-18Rearrange pf_state and pfi_kif so that the parts of the structure neededChristopher Pascoe
2005-08-11Only decrement the max-src-conn counter for tcp connections that reachedJoel Knight
2005-07-31Perform pf state/rule/table expiry in a kernel thread instead of runningChristopher Pascoe
2005-07-31Change the API for icmp_do_error so that it takes the mtu directly, ratherChristopher Pascoe
2005-07-29Use one "struct pf_state key" declaration at top of pf_test_state_icmp,Christopher Pascoe
2005-07-21account ipv4 packets with wrong tcp/udp/icmp checksums and udpMarkus Friedl
2005-07-04restrict the tcp.finwait timeout (45s) to state combinations where we haveMarkus Friedl
2005-06-13make the packet and byte counters on rules and src nodes per direction,Henning Brauer
2005-05-27log two pairs of uid/pid through pflog: the uid/pid of the process thatDaniel Hartmeier
2005-05-26support 'log' and 'log-all' in 'nat/rdr/binat pass' rules. original patchDaniel Hartmeier
2005-05-23change pool allocation of table entries, no longer use the oldnointrDaniel Hartmeier
2005-05-21clean up and rework the interface absraction code big time, rip out multipleHenning Brauer
2005-04-25csum -> csum_flagsBrad Smith
2005-04-22When synproxy completes the replayed handshake and modifies the stateDaniel Hartmeier
2005-04-15Try this again.Joel Knight
2005-04-14back out last, some breakage crept inHenning Brauer
2005-04-14When synproxy sends packets to the destination host, make sure to copyJoel Knight
2005-03-15byte order of mss, only affects synproxy code path, from John L. ScarfoneDaniel Hartmeier
2005-03-04add state's tag for IPv6, too. spotted by markus@Daniel Hartmeier
2005-03-03when tagging, apply the same tag to all packets matching a state entryDaniel Hartmeier
2005-02-27support 'tagged' in translation rules, non-delayed tag lookupDaniel Hartmeier
2005-01-30Add some more reason counters and use them instead of overloading theDaniel Hartmeier
2005-01-20Use the packet's address family instead of the rule's when selecting aDaniel Hartmeier
2005-01-07Make carp(4) traffic always appear on the physical (carpdev) interfaceRyan Thomas McBride
2004-12-22Introduce 'set skip on <ifspec>' to support a list of interfaces where noDaniel Hartmeier
2004-12-17ICMP state entries use the ICMP ID as port for the unique state key. WhenDaniel Hartmeier
2004-12-14Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,Ryan Thomas McBride
2004-12-11Handle errors in pf_route{,6} more gracefully.Marco Pfatschbacher
2004-12-10allow pf to filter on route labelsHenning Brauer
2004-12-07KNFRyan Thomas McBride
2004-12-07re-commit mcbride@'s 'flush global', this time without the breakage inDaniel Hartmeier
2004-12-07tree does not compile, spotted by dlg (not obvious how to fix)Theo de Raadt
2004-12-07Change the default for 'overload <table> flush' to flush only states from theRyan Thomas McBride
2004-12-06support max-src-conn-rate with synproxy, ok mcbride@Daniel Hartmeier
2004-12-05IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6Daniel Hartmeier
2004-12-04Add kernel code to keep track of tcp connections which have completedRyan Thomas McBride
2004-11-24fix a bug that leads to a crash when binat rules of the formDaniel Hartmeier
2004-11-19remove superfluous m_tag_copy/m_tag_prepend, already covered by m_copym2()Daniel Hartmeier
2004-11-12The flag to re-filter pf-generated packets was set wrong by synproxyDaniel Hartmeier
2004-11-07For RST generated due to state mismatch during handshake, don't setDaniel Hartmeier
2004-09-29reset anchor pointer to NULL when stepping back into the main ruleset,Daniel Hartmeier