summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Expand)Author
2010-09-23Break out rule counter update code into a separate function, makes theRyan Thomas McBride
2010-09-22add a new log opt PF_LOG_MATCHESHenning Brauer
2010-09-22various whitespace fixes that my hands did while i was looking for sthHenning Brauer
2010-09-21assert copyrights / bump yearsHenning Brauer
2010-09-21after ruleset eval is done, we must apply actions from the last matchingHenning Brauer
2010-09-21do not increment states_tot on match rules. it is purely cosmetic, thisHenning Brauer
2010-09-21make "match log" rules log on the fly. thus you can log and see the packetHenning Brauer
2010-09-21remove now obsolete XXX commentHenning Brauer
2010-09-21make pf_translate (void so far) return 1 if it actually changed somethingHenning Brauer
2010-09-21factor our the code to set up pf_pdesc, a central structure in pf carryingHenning Brauer
2010-08-05In pf_icmp_mapping() the ICMP and ICMPv6 types shared the sameAlexander Bluhm
2010-07-02m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsBret Lambert
2010-07-01g/c unused param to pf_translateHenning Brauer
2010-06-27fix a comment and add a new one to make clear what the mbuf ptr save danceHenning Brauer
2010-06-27stuff nsaddr/ndaddr/nsport/ndport (addrs/ports after NAT, used a lot whileHenning Brauer
2010-05-07Start cleaning up the mess called rtalloc*. Kill rtalloc2, make rtalloc1Claudio Jeker
2010-02-04pf_get_sport() picks a random port from the port range specified in aStuart Henderson
2010-01-18Convert pf debug logging to using log()/addlog(), a single standardisedRyan Thomas McBride
2010-01-14henning and I are both dumbasses, testing &foo against NULL is pointless.Ryan Thomas McBride
2010-01-14When printing states in debug output, print the rule number that createdRyan Thomas McBride
2010-01-14i forgot to remove a now obsolete comment in pf_create_state aboutHenning Brauer
2010-01-14in pf_create_state, when we fixed the leaks, we were a bit too triggerHenning Brauer
2010-01-13in pf_state_key_detach, ensure that the state key pointer on the stateHenning Brauer
2010-01-12First pass at removing the 'pf_pool' mechanism for translation and routingRyan Thomas McBride
2010-01-11"final" leak in state creation: in pf_state_key_setup, if we actuallyHenning Brauer
2010-01-11fix a bug in pf_create_state that was a major source of amusement for meHenning Brauer
2009-12-24add support to pf for filtering a packet by the interface it was receivedDavid Gwynne
2009-12-14fix sticky-address - by pretty much re-implementing it. still followingHenning Brauer
2009-12-08move "pf: key search" and "pf: key setup" messages to PF_DEBUG_NOISYStuart Henderson
2009-11-26magical fix for a fault which reliably brings my firewalls down. i thinkDavid Gwynne
2009-11-23with the old code we initialized the state keys early in some casesHenning Brauer
2009-11-23one kinda-missing log |= PFLOG_FORCE in the v6 case, spotted by claudioHenning Brauer
2009-11-23sync the handling of the log flag from pf_test (where it is correct)Henning Brauer
2009-11-23pf_test_fragment: we need to bail out if action == PF_DROP, notHenning Brauer
2009-11-23sync some comments with realityHenning Brauer
2009-11-23remove the nat_rule pointer on pf_state and pf_pdesc, obsolete afterHenning Brauer
2009-11-22cleanup after the NAT changes. we used to have multiple rulesets (scrub,Henning Brauer
2009-11-21knfHenning Brauer
2009-11-05IPv6 support for divert sockets.Michele Marchetto
2009-11-03rtables are stacked on rdomains (it is possible to have multiple routingClaudio Jeker
2009-10-29I missed updating a line for the AF_INET6 route case whenJonathan Gray
2009-10-28Add a dedicated pf pool for route options as suggested by henning,Jonathan Gray
2009-10-06Redo the route lookup in the output (and IPv6 forwarding) path if theClaudio Jeker
2009-10-04Add (again) support for divert sockets. They allow you to:Michele Marchetto
2009-09-16style: in pf_test_state_other, fix indentation, kill excessive newlines,Henning Brauer
2009-09-16fix copy & paste error from almost a year ago (bad ryan)Henning Brauer
2009-09-08I had not enough oks to commit this diff.Michele Marchetto
2009-09-08Add support for divert sockets. They allow you to:Michele Marchetto
2009-09-01the diff theo calls me insanae for:Henning Brauer
2009-07-28do not leak pf_rule_item_pl items in pf_test_rule() whenHenning Brauer