summaryrefslogtreecommitdiff
path: root/sys/net/pf_ioctl.c
AgeCommit message (Collapse)Author
2004-07-22Add missing check for NULL in DIOCCHANGERULE. This prevents a crash inMathieu Sauve-Frankel
certain rare cases. ok mcbride@ dhartmei@
2004-07-05KNFHenning Brauer
2004-06-21First step towards more sane time handling in the kernel -- this changesThorsten Lockert
things such that code that only need a second-resolution uptime or wall time, and used to get that from time.tv_secs or mono_time.tv_secs now get this from separate time_t globals time_second and time_uptime. ok art@ niklas@ nordin@
2004-06-14Remove DIOCBEGINRULES, DIOCCOMMITRULES, DIOCBEGINALTQS, DIOCCOMMITALTQS,Cedric Berger
DIOCRINABEGIN, DIOCRINACOMMIT ioctls. Use DIOCXBEGIN/DIOCXCOMMIT/DIOCXROLLBACK instead. ok beck@ dhartmei@ henning@
2004-06-10rename struct pf_rule_addr member 'not' to 'neg', as 'not' is a reservedDaniel Hartmeier
keyword in C++. ok henning@, cedric@
2004-05-31thinko, reported by Fernando BragaDaniel Hartmeier
2004-05-21Use '/' instead of ':' as separator for anchor path components. Note thatDaniel Hartmeier
the parser now needs quotes around paths containing separators. ok mcbride@
2004-05-21copy out relative anchor paths correctlyDaniel Hartmeier
2004-05-19Allow recursive anchors (anchors within anchors, up to 64Daniel Hartmeier
levels deep). More work required, but this is already functional. authpf users will need to adjust their anchor calls, but this will change again soon. ok beck@, cedric@, henning@, mcbride@
2004-05-18In DIOCCHANGERULE, move ticket increment above code that might freeDaniel Hartmeier
the ruleset and invalidate the pointer. ok cedric@
2004-05-05Use RFC1323 PAWS timestamps as a logical extension to the conventional TCPMike Frantzen
sequence numbers by taking advantage of the maximum 1KHz clock as an upperbound on the timestamp. Typically gains 10 to 18 bits of additional security against blind data insertion attacks. More if the TS Echo wasn't optional :-( Enabled with: scrub on !lo0 all reassemble tcp ok dhartmei@. documentation help from jmc@
2004-05-03fix a stupid mistake in my previous commit.Kenjiro Cho
"if (error == 0)" should be "if (error != 0)".
2004-04-28Dont step into INET6 code, just because af != AF_INETPhilipp Buehler
Also comment #endif properly while being here ok mcbride@
2004-04-27make separate functions to enable/disable altq, and call them when weKenjiro Cho
reload rules. this fixes an altq problem that, if you reload pf rules not containing queues while running altq, the interface shaper is not properly removed. make pf_altq_running local to pf_ioctl.c since it is no longer used in altq_subr.c. ok henning@
2004-04-26The rule_number parameter for pf_get_pool() needs to be 32 bits, not 8 -Ryan Thomas McBride
this fixes corruption of the address pools with large rulesets. This is a candidate for -stable. Reported by Zbigniew Kossowski <zk@openbsd.com.pl>, hours of braintwisting debugging by pb@
2004-04-26anchor refcounting. ok dhartmei@ mcbride@Cedric Berger
2004-04-09move some of the non-interrupt pools from the small kmem_map to the muchMike Frantzen
larger kernel map
2004-03-22Support for best effort bulk transfers of states when pfsync syncif isRyan Thomas McBride
configured. This this allows pfsync+carp clusters to come up gracefully without killing active connections. pfsync now prevents carp from preempting to become master until the state table has sync'd. ABI change, any application which use struct pf_state must be recompiled. Reminded about this by Christian Gut. Thanks to beck@ cedric@ and dhartmei@ for testing and comments. ok deraadt@
2004-03-18state->rule.ptr shall not be NULL. from Jon Coller. ok dhartmei@ mcbride@Cedric Berger
2004-03-15plug memory leak in error pathHenning Brauer
missing break; in error case from patrick latifi, cedric ok
2004-03-09KNF, ok cedric@ deraadt@Ryan Thomas McBride
2004-02-20Make pfsync deal with clearing states bound to a group or interface (egRyan Thomas McBride
pfctl -i fxp0 -Fs). Also don't send out individual state deletions if we're sending a clear message, move pfsync_clear_states() inside splnet, and fix if_pfsync.h includes in pf.c and pf_ioctl.c. ok cedric@ dhartmei@
2004-02-19Makes pfctl -Fs and pfctl -w works with the optional -i specifier.Cedric Berger
Kernel/Userland Sync needed. ok dhartmei@ jmc@ markus@ mcbride@
2004-02-19the 2nd round of the qid assignment change.Kenjiro Cho
make the semantics in line with the tag assignment, which simplifies the id management in pf. ok, henning@
2004-02-13Do an explicit pf_update_anchor_rules() after an anchor gets removed.Marco Pfatschbacher
In some situations not all anchor rules got updated properly, so they still refered to already freed anchors. OK dhartmei@ mcbride@ cedric@ henning@
2004-02-10KNFDaniel Hartmeier
2004-02-10KNFHenning Brauer
2004-02-09Repair "set loginterface". Don't flush stats on pfctl -e. pf_status.sinceCedric Berger
is the time of last "pf -e" or "pf -d". ok dhartmei@ henning@
2004-02-04Fix a number of bugs with setting pool limits which I introduced withRyan Thomas McBride
source-tracking. Found by Pyun YongHyeon. Also add support to pfctl to set the src-nodes pool limit. "Luckily" some of the bugs cancel each other out; update kernel before pfctl. ok dhartmei@
2004-01-05Repair my merging error, simplify DIOCCLRSTATUS code. ok dhartmei@Cedric Berger
2004-01-05Repair merge errors. Thanks Pyun YongHyeon, Sorry Henning :)Cedric Berger
2003-12-31spacing. note this, cedricTheo de Raadt
2003-12-31Many improvements to the handling of interfaces in PF.Cedric Berger
1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
2003-12-22pasto in pf_status.src_nodes backup, from 'kirash'Daniel Hartmeier
2003-12-19i wrote much of these, assert my copyrightHenning Brauer
2003-12-18Save pf_status.hostid and pf_status.stateid in the DIOCCLRSTATUSRyan Thomas McBride
ioctl. Pointed out by dhartmei@ ok dhartmei@
2003-12-18Unbreak compile with no pfsync(4) device.Ryan Thomas McBride
patch from Max Laier
2003-12-15ryan left a few for me ;-)Henning Brauer
2003-12-15Fix whitespace screwups before henning wakes up.Ryan Thomas McBride
2003-12-15Add initial support for pf state synchronization over the network.Ryan Thomas McBride
Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@
2003-12-15Add support to track stateful connections by source ip. This allows usRyan Thomas McBride
to: - Ensure that clients get a consistent IP mapping with load-balanced translation/routing rules - Limit the number of simultaneous connections a client can make - Limit the number of clients which can connect through a rule ok dhartmei@ deraadt@
2003-12-12Move PF interface code to new net/pf_if.cCedric Berger
Expect improvements in this area soon. ok dhartmei@ mcbride@
2003-11-02Don't zero the debug level when we enable pf.Ryan Thomas McBride
ok henning@ dhartmei@
2003-10-25Build state search indexes directly on pf_state instead of pf_tree_node.Ryan Thomas McBride
This saves more than 30% memory on state entries, and simplifies the state insertion and removal code as well. NOTE: This changes the pf API; userland tools must be updated to match. ok henning@ dhartmei@
2003-10-19Add missing "#ifdef ALTQ"'s in the ioctl transacions code.Ryan Thomas McBride
Allows non-ALTQ kernel compile. Pointed out by tedu@ ok itojun@, "works here" tedu@
2003-10-08obviously i'm on drugs, revertHenning Brauer
2003-10-08missing DIOCX* in the securelevel > 1 caseHenning Brauer
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-08-22pf spelling policeDavid Krause
ok dhartmei@ jmc@
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 02:55:08 +0000