| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2003-12-15 | sc_sp is a #define on some architectures, use a different name | Theo de Raadt | |
| 2003-12-15 | ryan left a few for me ;-) | Henning Brauer | |
| 2003-12-15 | Fix whitespace screwups before henning wakes up. | Ryan Thomas McBride | |
| 2003-12-15 | Add initial support for pf state synchronization over the network. | Ryan Thomas McBride | |
| Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@ | |||
| 2003-12-15 | Add support to track stateful connections by source ip. This allows us | Ryan Thomas McBride | |
| to: - Ensure that clients get a consistent IP mapping with load-balanced translation/routing rules - Limit the number of simultaneous connections a client can make - Limit the number of clients which can connect through a rule ok dhartmei@ deraadt@ | |||
| 2003-12-13 | initial support ifconfig destroy; ok deraadt@ | Markus Friedl | |
| 2003-12-12 | Move PF interface code to new net/pf_if.c | Cedric Berger | |
| Expect improvements in this area soon. ok dhartmei@ mcbride@ | |||
| 2003-12-12 | small compiler warning cleanup (#error instead of bailing out) | Hans-Joerg Hoexer | |
| ok henning@ grange@ | |||
| 2003-12-11 | Fix PR3587 and other related problems with NAT and table stats. | Cedric Berger | |
| PPL that have that problem and cannot upgrade to -current could just comment out the assertion in pfr_update_stats(). ok dhartmei@ henning@ | |||
| 2003-12-10 | de-register. deraadt ok | Jun-ichiro itojun Hagino | |
| 2003-12-10 | use if_indexlim (instead of if_index) and ifindex2ifnet[x] != NULL | Jun-ichiro itojun Hagino | |
| to check if interface exists, as (1) if_index will have different meaning (2) ifindex2ifnet could become NULL when interface gets destroyed, when we introduce dynamically-created interfaces. markus ok | |||
| 2003-12-08 | ip_output expects network byte order; report Bob Kitella; ok deraadt | Markus Friedl | |
| 2003-12-08 | add IOCIFGCLONERS; ifconfig -C; from netbsd; ok henning, deraadt | Markus Friedl | |
| 2003-12-08 | Mbuf tag tcp and udp packets which are translated to localhost, and | Ryan Thomas McBride | |
| use the the presence of this tag to reverse the match order in in{6}_pcblookup_listen(). Some daemons (such as portmap) do a double bind, binding to both * and localhost in order to differentiate local from non-local connections, and potentially granting more privilege to local ones. This change ensures that redirected connections to localhost do not appear local to such a daemon. Bulk of changes from dhartmei@, some changes markus@ ok dhartmei@ deraadt@ | |||
| 2003-12-07 | support ifconfig create; ok deraadt | Markus Friedl | |
| 2003-12-06 | u_int8_t variable can't be > 255; pointed out by Mr. GCC3. | Alexander Yurchenko | |
| ok millert@ | |||
| 2003-12-06 | support destroy; ok henning | Markus Friedl | |
| 2003-12-03 | add support for ifconfig clone/destroy; ok henning deraadt | Markus Friedl | |
| 2003-12-03 | add support for ifconfig clone/destroy; ok henning deraadt | Markus Friedl | |
| 2003-12-03 | add support for ifconfig clone/destroy; ok henning deraadt | Markus Friedl | |
| 2003-12-03 | support for network interface "cloning", e.g. gif(4) via ifconfig(8) | Markus Friedl | |
| 2003-12-03 | protect against if_index wrap; similar to what netbsd does; ok henning deraadt | Markus Friedl | |
| 2003-12-02 | UDP encapsulation for ESP in transport mode (draft-ietf-ipsec-udp-encaps-XX.txt) | Markus Friedl | |
| ok deraadt@ | |||
| 2003-12-02 | add kq support from wayne@epipe.com.au and cmaxwell@themanor.net (now that ↵ | Michael Shalayeff | |
| regress test is there too) | |||
| 2003-11-28 | More pf stats fixups: | Ryan Thomas McBride | |
| - Don't double count double count icmp packets. - We only want to increment rule and state counters if we're passing the packet, unless it's a 'drop' rule. ok dhartmei@ henning@ | |||
| 2003-11-21 | Remove redundant arguments to pf_sockaddr_lookup(); proto and af are already | Ryan Thomas McBride | |
| included in pd. ok dhartmei@ henning@ | |||
| 2003-11-21 | Remove unused "ipoff" arguments. | Ryan Thomas McBride | |
| ok dhartmei@ henning@ | |||
| 2003-11-16 | pf_test() and pf_test6() consistency: | Ryan Thomas McBride | |
| - Fix anchor anchor accounting for IPv4 TCP and all IPv6 protocols. - Make stateful connections work for generic protocols on IPv6. ok henning@ dhartmei@ | |||
| 2003-11-16 | convert __attribute__((__packed__)) to __packed so that parsers unaware | Anil Madhavapeddy | |
| of gcc extensions have more of a chance. ok mcbride@, no objections from millert@, deraadt@ | |||
| 2003-11-09 | remove stale forward declaration | Daniel Hartmeier | |
| 2003-11-08 | Return proper anchor rule number in correct byte order. | Daniel Hartmeier | |
| From Pyun YongHyeon. ok henning@, canacar@ | |||
| 2003-11-08 | Add 'no-sync' state option to prevent state transition messages for states | Ryan Thomas McBride | |
| created by this rule from appearing on the pfsync(4) interface. e.g. pass in proto tcp to self flags S/SA keep state (no-sync) ok cedric@ henning@ dhartmei@ | |||
| 2003-11-07 | adress -> address, and a few more; all from Jonathon Gray; | Jason McIntyre | |
| (mvme68k/mvme88k) vs.c and (vax) if_le.c ok miod@ isakmpd ones ok ho@ | |||
| 2003-11-06 | move netisr definition into md code to allow arch provide suitable ↵ | Michael Shalayeff | |
| allocation; tested on most archs | |||
| 2003-11-04 | add in(6)_pcblookup_listen() and replace all calls to in_pcblookup() | Markus Friedl | |
| with either in(6)_pcbhashlookup() or in(6)_pcblookup_listen(); in_pcblookup is now only used by bind(2); speeds up pcb lookup for listening sockets; from Claudio Jeker | |||
| 2003-11-03 | pf_route() can change output NIC, so we need to check its capabilities. | Cedric Berger | |
| good candidate for 3.X errata. ok dhartmei@ henning@ mcbride@ | |||
| 2003-11-02 | Don't zero the debug level when we enable pf. | Ryan Thomas McBride | |
| ok henning@ dhartmei@ | |||
| 2003-10-31 | Remove remenants of pf_tree stuff that I missed. | Ryan Thomas McBride | |
| 2003-10-29 | fix binat for incoming connections when a netblock (not just a single | Daniel Hartmeier | |
| address) is used for source in the binat rule. closes PR 3535, reported by Karl O.Pinc. ok henning@, cedric@ | |||
| 2003-10-25 | Build state search indexes directly on pf_state instead of pf_tree_node. | Ryan Thomas McBride | |
| This saves more than 30% memory on state entries, and simplifies the state insertion and removal code as well. NOTE: This changes the pf API; userland tools must be updated to match. ok henning@ dhartmei@ | |||
| 2003-10-25 | "goto bad" on error with carp_input, instead of simply returning. | Ryan Thomas McBride | |
| Fixes leakage of mbufs on error. Pointed out by Max Laier. | |||
| 2003-10-24 | Fix write filter blocking when no filter was set. Fixes | Can Erkin Acar | |
| problems with dhcp. ok frantzen@ krw@ deraadt@ | |||
| 2003-10-22 | Add locking and write filtering to bpf descriptors. | Can Erkin Acar | |
| Locking prevents dangerous ioctls such as changing the interface and sending signals to be executed by an unprivileged process. A filter can also be applied to packets injected through a bpf descriptor. These features allow programs using bpf descriptors to safely drop/seperate privileges. ok frantzen@ henning@ mcbride@ | |||
| 2003-10-20 | tyop | Jason Wright | |
| 2003-10-19 | Add missing "#ifdef ALTQ"'s in the ioctl transacions code. | Ryan Thomas McBride | |
| Allows non-ALTQ kernel compile. Pointed out by tedu@ ok itojun@, "works here" tedu@ | |||
| 2003-10-19 | more typos | David Krause | |
| 2003-10-17 | Common Address Redundancy Protocol | Ryan Thomas McBride | |
| Allows multiple hosts to share an IP address, providing high availability and load balancing. Based on code by mickey@, with additional help from markus@ and Marco_Pfatschbacher@genua.de ok deraadt@ | |||
| 2003-10-10 | make sure pd is initialized before use (or byte counters may increase | Daniel Hartmeier | |
| by random values). ok mcbride@, cedric@, henning@ | |||
| 2003-10-08 | obviously i'm on drugs, revert | Henning Brauer | |
| 2003-10-08 | missing DIOCX* in the securelevel > 1 case | Henning Brauer | |
 |
index : src | |
| OpenBSD base system |
| summaryrefslogtreecommitdiff |