| Age | Commit message (Expand) | Author |
|---|
| 2007-05-08 | block ALL packets with rthdr0 in pf_test6(). We already do this | Ryan Thomas McBride |
| 2007-05-08 | Routing headers are dangerous. Deal with them the same way as IPv4 options: | Ryan Thomas McBride |
| 2007-02-22 | make urpf-failed work with multipath routes. | Pierre-Yves Ritschard |
| 2007-02-19 | add handling of skip steps for urpf-failed addresses. | Pierre-Yves Ritschard |
| 2007-02-14 | Consistently spell FALLTHROUGH to appease lint. | Jonathan Gray |
| 2007-02-08 | compute pseudo-header checksum based on flnal destination as | Jun-ichiro itojun Hagino |
| 2006-12-22 | add special handling for "urpf-failed" with carp interfaces. the | Reyk Floeter |
| 2006-12-21 | in pf_route(), initialize ro to NULL at the beginning. if left un- | Daniel Hartmeier |
| 2006-12-14 | in "BAD/loose state" messages, also print the packet's original sequence | Daniel Hartmeier |
| 2006-12-13 | use IN6_IS_SCOPE_EMBED to check kernel-internal form addresses | Jun-ichiro itojun Hagino |
| 2006-11-16 | conditional for appending the pf mbuf tag in pf_test/pf_test6 was wrong, | Henning Brauer |
| 2006-10-31 | make pfsync a clonable too, but prevent more than one instance from | Henning Brauer |
| 2006-10-27 | Split ruleset manipulation functions out into pf_ruleset.c to allow them to | Ryan Thomas McBride |
| 2006-10-11 | Allow the 'quick' keyword on an anchor. IFF there is a matching rule inside | Ryan Thomas McBride |
| 2006-09-18 | allow RST from TCP client, even if client does not send data after SYN; | Markus Friedl |
| 2006-09-18 | fix tos (type-of-service) comparisons. for rules which use 'tos x', compare | Daniel Hartmeier |
| 2006-07-06 | allow rules to point to an alternate routing table, and tag packets | Henning Brauer |
| 2006-05-17 | missing rtlabel support in pf_addr_wrap_neq() | Henning Brauer |
| 2006-03-14 | implement a Unicast Reverse Path Forwarding (uRPF) check for pf(4) | Damien Miller |
| 2006-02-07 | mention source of pf_modulate_sack() in comment, no code change, | Daniel Hartmeier |
| 2006-01-31 | the TCP SACK option needs sequence number modulation | Mike Frantzen |
| 2005-11-14 | fix spello | Christopher Pascoe |
| 2005-11-04 | crank pf_state and pf_src_node byte and packet counters to u_in64_t, since | Ryan Thomas McBride |
| 2005-10-26 | Instead of using arc4random() to modulate the TCP isn, call tcp_rndiss_next() | Ryan Thomas McBride |
| 2005-10-25 | mtag in pf_route is now only used for IPSEC, so #ifdef it | Henning Brauer |
| 2005-10-17 | make pf use one mbuf tag instead of 6 distinct ones. use a little struct | Henning Brauer |
| 2005-09-28 | Improve the safety of pf IOCTLs, taking into account that some paths can sleep. | Christopher Pascoe |
| 2005-08-22 | when nat'ing icmp 'connections', replace icmp id with proxy values | Daniel Hartmeier |
| 2005-08-22 | fix rdr to bitmask replacement address pool. patch from Max Laier, | Daniel Hartmeier |
| 2005-08-18 | Rearrange pf_state and pfi_kif so that the parts of the structure needed | Christopher Pascoe |
| 2005-08-11 | Only decrement the max-src-conn counter for tcp connections that reached | Joel Knight |
| 2005-07-31 | Perform pf state/rule/table expiry in a kernel thread instead of running | Christopher Pascoe |
| 2005-07-31 | Change the API for icmp_do_error so that it takes the mtu directly, rather | Christopher Pascoe |
| 2005-07-29 | Use one "struct pf_state key" declaration at top of pf_test_state_icmp, | Christopher Pascoe |
| 2005-07-21 | account ipv4 packets with wrong tcp/udp/icmp checksums and udp | Markus Friedl |
| 2005-07-04 | restrict the tcp.finwait timeout (45s) to state combinations where we have | Markus Friedl |
| 2005-06-13 | make the packet and byte counters on rules and src nodes per direction, | Henning Brauer |
| 2005-05-27 | log two pairs of uid/pid through pflog: the uid/pid of the process that | Daniel Hartmeier |
| 2005-05-26 | support 'log' and 'log-all' in 'nat/rdr/binat pass' rules. original patch | Daniel Hartmeier |
| 2005-05-23 | change pool allocation of table entries, no longer use the oldnointr | Daniel Hartmeier |
| 2005-05-21 | clean up and rework the interface absraction code big time, rip out multiple | Henning Brauer |
| 2005-04-25 | csum -> csum_flags | Brad Smith |
| 2005-04-22 | When synproxy completes the replayed handshake and modifies the state | Daniel Hartmeier |
| 2005-04-15 | Try this again. | Joel Knight |
| 2005-04-14 | back out last, some breakage crept in | Henning Brauer |
| 2005-04-14 | When synproxy sends packets to the destination host, make sure to copy | Joel Knight |
| 2005-03-15 | byte order of mss, only affects synproxy code path, from John L. Scarfone | Daniel Hartmeier |
| 2005-03-04 | add state's tag for IPv6, too. spotted by markus@ | Daniel Hartmeier |
| 2005-03-03 | when tagging, apply the same tag to all packets matching a state entry | Daniel Hartmeier |
| 2005-02-27 | support 'tagged' in translation rules, non-delayed tag lookup | Daniel Hartmeier |
