summaryrefslogtreecommitdiff
path: root/usr.sbin/authpf
AgeCommit message (Collapse)Author
2003-12-15Add initial support for pf state synchronization over the network.Ryan Thomas McBride
Implemented as an in-kernel multicast IP protocol. Turn it on like this: # ifconfig pfsync0 up syncif fxp0 There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls. NOTABLE CHANGES: - A new index based on a unique (creatorid, stateid) tuple has been added to the state tree. - Updates now appear on the pfsync(4) interface; multiple updates may be compressed into a single update. - Applications which use bpf on pfsync(4) will need modification; packets on pfsync no longer contains regular pf_state structs, but pfsync_state structs which contain no pointers. Much more to come. ok deraadt@
2003-12-10- fix a few exit cases that would exit with no logBob Beck
- add username to added ruleset names when possible - add much needed example to man page showing how to use NAT with tagging to track NATed authpfed connections. ok henning@ dhartmei@, man page cleanup by jmc@
2003-11-20remove -Werror from userland builds, to give us a chance toAnil Madhavapeddy
use more verbose warning options if desired. ok millert@, henning@, david@
2003-11-14catch up with pfctl changesHenning Brauer
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-09-26erm, committing to teh right repository helps sometimes.Henning Brauer
don't reject usernames > 15 chars; username is not used as ruleset name any more, thus, this restriction is gone. PR3491, fix from dhartmei
2003-08-21stuff needed for passive OS fingerprinting PF rulesMike Frantzen
2003-08-17damn liesHenning Brauer
2003-08-04ClientAliveInterval requires Protocol 2;Jason McIntyre
noted by Marc Revial on misc@; ok markus@
2003-08-01tickets are now u_int32_t, not int, fixes tree breakage; from Andrey SmaginTodd C. Miller
2003-07-11Better parsing and -v support for tables:Cedric Berger
- remove the tableaddrs and tableaddr yacc production and reuse host_list instead. - produce better error messages. - do not load addresses from external file when it is not required (like with -R option). - store initializers in a new node_tinit linked list before putting them into the address buffer (see next point). - add a new print_tabledef() function, which makes "pfctl -nvf" print something useful for table definitions, which in turn makes it possible to write better regress tests (see first chunk of the diff) and bring table definition consistant with other parsed rules. ok dhartmei@
2003-07-08Fix a bug that caused removal of previous users' rules when more then oneDaniel Hartmeier
user loggged in concurrently. And fix a smaller bug which prevented complete removal of a user's state entries on logout. Bug report and testing by Ed Powers.
2003-07-03Bye bye atexit(), bye bye globals...Cedric Berger
The pfctl.c part will probably need some further improvements. ok henning@
2003-07-03This patch finally cleanup pfctl_table.c. No more global buffer,Cedric Berger
and a couple of parsing functions moved to parse.y or pfctl_parser where they belong. I also took the opportunity to replace "void" functions with exit(1) or err() inside by "int" functions, with the caller checking the return value for errors (much cleaner and an old request from Theo) ok dhartmei@ henning@
2003-06-28() to (void)Theo de Raadt
2003-06-27/etc/authpf.allow -> /etc/authpf/authpf.allow in commentsHenning Brauer
spotted by Joel Knight again
2003-06-24cleanTheo de Raadt
2003-06-24(long)getpid(); andrushock@korovino.netTheo de Raadt
2003-06-23authpf can handle binat nowadays; from Joel KnightHenning Brauer
ok daniel
2003-06-12- section reorderJason McIntyre
- macro fixes - kill whitespace at EOL - new sentence, new line
2003-06-03remove term 3, with permission from Chris Kuethe for pathnames.hBob Beck
2003-05-10Be polite about leaving invalid data around in globals, just in caseChad Loder
someone comes along later, modifies the code, and runs into a problem. OK beck@
2003-05-10catch up with pfctl changesHenning Brauer
2003-04-30Allow tables to be loaded into anchors.Cedric Berger
Most pfctl table commands (excluding 'show' and 'flush') support the "-a" modifier. ok dhartmei@
2003-04-20authpf is supposed to die if the /etc/authpf/authpf.conf is not present.Bob Beck
pr # 3217, patch from frisco@blackant.net
2003-03-20replace some .Pp inside .Bd -literal block with empty lineDavid Krause
new sentence, new line fix login.conf indentation ok jmc@
2003-03-18ip address -> IP address;Jason McIntyre
rtadvd.conf(5): positve -> positive; ok miod@
2003-03-11removed .Ic's which were giving postscript trouble;Jason McIntyre
ok deraadt@
2003-03-10these pages all had bad section numbers in the .Xr's;Jason McIntyre
lots of help and ok millert@
2003-03-06date should be written formally: .Dd Month day, yearDavid Krause
ok henning@ jmc@
2003-02-19sync to pfctl; BAD HENNING BAD BAD BAD NO COOKIETheo de Raadt
2003-02-11adjust after pfctl changesHenning Brauer
2003-02-03typos and minor KNF; from andrushock, thanks!Henning Brauer
2003-02-02adjust after pfctl change; parse_rules doesn't take opts seperately any moreHenning Brauer
2003-01-29do setprocticle; ok camieldTheo de Raadt
2003-01-28typos; added white boldface to examplesJason McIntyre
ok deraadt@
2003-01-27remove some unused includes, from Andrey MatveevDaniel Hartmeier
2003-01-26mop up, from krwDaniel Hartmeier
2003-01-25Permit initialisation of a table content from a file in pf.conf.Cedric Berger
Cleaning up of the table options parsing, more flexible. idea+cleanup deraadt@, ok dhartmei@, pass all regress tests.
2003-01-09Add support for active/inactive tablesets in the kernel.Cedric Berger
Add table definition/initialisation construct in pfctl parser. Add and fix documentation for pf.4 and pf.conf.5. Tested on i386 and sparc64 by myself, macppc by Daniel. ok dhartmei@
2003-01-07Add function to search for and remove stale rulesets from other authpfDaniel Hartmeier
processes which have terminated unexpectedly. ok beck@
2003-01-06nicer syslogTheo de Raadt
2003-01-05Move ifname from pf_addr to pf_addr_wrap, prepare pf_addr_wrap for tableDaniel Hartmeier
name. ok henning@, mcbride@, cedric@
2003-01-03Bring in userland code for accessing PF radix tables.Cedric Berger
ok dhartmei@ mcbride@
2003-01-01Scrub and filter rules are separated now, adjust authpf accordingly.Daniel Hartmeier
2002-12-29Mention $user_id, like $user_ip.Daniel Hartmeier
2002-12-29Set a macro $user_id to the user name, just like $user_ip is already setDaniel Hartmeier
to the IP address. From discussion with Michael Lucas. ok henning@
2002-12-22KNFHenning Brauer
2002-12-22Instead of inserting and removing rules at the top/bottom of the mainDaniel Hartmeier
ruleset, make authpf manage its rules inside anchors.
2002-12-19redundant memsetHenning Brauer
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-29 10:09:58 +0000