summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Expand)Author
2001-09-21Fix natlook (broke ftp-proxy) and a memory leak.Daniel Hartmeier
2001-09-19Patch from Ryan McBride. Compile without INET6, remove unnecessaryDaniel Hartmeier
2001-09-17icmpv6 nat fix, from Ryan McBrideDaniel Hartmeier
2001-09-15The inner protocol of IPv4 ICMP error messages was ignored, leading toDaniel Hartmeier
2001-09-15Don't use m_pkthdr.rcvif in pflog_packet(), it doesn't work for outgoingDaniel Hartmeier
2001-09-15IPv6 support from Ryan McBride (mcbride@countersiege.com)Mike Frantzen
2001-09-14binat non icmp/udp/tcp protocols as well; ok dhartmei@jasoni
2001-09-11Undo BINAT translation when blocking with return-rst/-icmp.Daniel Hartmeier
2001-09-061:1 bidrectional NAT (binat); ok dhartmei@ and frantzen@jasoni
2001-09-05Handle uh_sum == 0x0000 correctly. Before, UDP packet checksums wereDaniel Hartmeier
2001-09-05s/pf_natlook/pfioc_natlook (ioctl parameter struct)Daniel Hartmeier
2001-09-04Add skip steps for interface (ifp).Daniel Hartmeier
2001-09-04#define empty PFLOG_PACKET correctly (no side effects). Closes PR2044.Daniel Hartmeier
2001-08-31Forgot to commit frag expire tuning beforeMike Frantzen
2001-08-28Add new ioctls to securelevel check, from Can Erkin AcarDaniel Hartmeier
2001-08-28Bump state timeouts and allow tweaking them from pfctl.Mike Frantzen
2001-08-262nd uninitialized variable that bit me todayNiklas Hallqvist
2001-08-25PF ISN randomization. Or in trekkie techno-babble, ISN phase modulation.Mike Frantzen
2001-08-22Correct the setup of the intial TCP state window and pre-validate th_ackMike Frantzen
2001-08-22Fix panic in pf (was my fault) caused by a bad key compare optimizationMike Frantzen
2001-08-21KNFTheo de Raadt
2001-08-21Pass closing TCP connections through looser state machine (handle Solaris'Mike Frantzen
2001-08-19Add new ioctls for adding/removing RDR and NAT rules to/from the activeDaniel Hartmeier
2001-08-19Quick optimization of pf_tree_key_compare (should half the instruction count)Mike Frantzen
2001-08-19Make more money for mickey (count entire IP packets for statistics, not justDaniel Hartmeier
2001-08-19Yet another batch of improvements and un-fuckups to the TCP state code.Mike Frantzen
2001-08-19Add per-rule byte counter, so mickey can do accounting. We're counting theDaniel Hartmeier
2001-08-19Add per-rule statistics (number of evaluations and number of packets).Daniel Hartmeier
2001-08-19Unfuck some TCP state stuff that would drop the SYN|ACK.Mike Frantzen
2001-08-19Loosened TCP state code which should allow stupid stacks to shotgun theirMike Frantzen
2001-08-18Add new ioctl for adding/removing individual rules to/from the active rule set.Daniel Hartmeier
2001-08-18make pfctl -s state SCREAM; frantzen is now happyTheo de Raadt
2001-08-11Add support for ICMP errors referring to ICMP queries/replies. FixesDaniel Hartmeier
2001-08-01stateless tcp normalization along the lines of the normalization paper byNiels Provos
2001-07-30never before has a file so often deviated from KNFTheo de Raadt
2001-07-29Implement rule skipping. This is a transparent evaluation optimization,Daniel Hartmeier
2001-07-25nat proxy port randomization by ben fleis.Daniel Hartmeier
2001-07-21print additional debugging information for 'insert invalid' messages. occurs ...Daniel Hartmeier
2001-07-19Fix/complete the handling of the binary ops >< and <> to behaveKenneth R Westerback
2001-07-18fix pf_get_rdr() for single port (dport2 == 0) rules. found by lebel@.Daniel Hartmeier
2001-07-17normalize ip_off, make IP_DF stripping optional, return rst is a flag now.Niels Provos
2001-07-17split ip normalization out into a separate file, okay dhartmei@Niels Provos
2001-07-15increase src->state to 1 when creating state from intermediate (non-SYN) pack...Daniel Hartmeier
2001-07-14use int instead of signed char. doesn't use more memory (padding occurs) and ...Daniel Hartmeier
2001-07-13indent.Federico G. Schwindt
2001-07-13everytime i clean in here, i get a 250 line diff...Theo de Raadt
2001-07-11Simplify pf_pull_hdr(), don't use inner IP header's ip_len or ip_offDaniel Hartmeier
2001-07-09do compare in host order. found by millert@.Daniel Hartmeier
2001-07-09Extend nat/rdr syntax. Add source/destination selection. MakeDaniel Hartmeier
2001-07-07get rid of compiler warningMarco S Hyman