summaryrefslogtreecommitdiffstats
path: root/contrib/pf
Commit message (Collapse)AuthorAgeFilesLines
* Replace an OpenBSDism with a FreeBSDism in the pfctl(8) man page: we putrwatson2012-01-051-1/+1
| | | | | | | configuration file man pages in section 5, and we prefer rc.conf to rc.conf.local. MFC after: 3 days
* Restore a feature that was present in 5.x and 6.x, and was cleared inglebius2011-12-201-0/+17
| | | | | | | | | | | | | | | | | | | | | | | 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
* - Fix examples to show new CARP style.glebius2011-12-201-12/+11
| | | | - Remove OpenBSDisms, add FreeBSDisms.
* Correct the description of struct pfioc_state_kill.bz2011-07-171-2/+5
| | | | | PR: kern/158997 Submitted by: ohauer
* Note the PF version.obrien2011-07-071-2/+7
| | | | Discussed with: bz
* Update packet filter (pf) code to OpenBSD 4.5.bz2011-06-2829-1298/+2189
| | | | | | | | You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
* Add a new option -P to suppress getservbyport(3) calls when printing rules.bz2011-06-135-19/+34
| | | | | | | | | | | | | This allows one to force consistent printing of numeric port numbers like we do with -n for other tools like netstat (just that -n was already taken) rather than the service names. -P is currently unused in OpenBSD so the change is eligible for upstreaming. PR: misc/151015 Submitted by: Matt Koivisto (mkoivisto sandvine.com) Sponsored by: Sandvine Incorporated MFC after: 1 week
* Enable closefrom(2) here, as we have supported it for some time now.csjp2010-08-051-4/+0
| | | | | Discussed with: mlaier MFC after: 2 weeks
* Adapt OpenBSD pf's "sloopy" TCP state machine which is useful for Directdelphij2009-12-244-4/+45
| | | | | | | | | | | | | | | Server Return mode, where not all packets would be visible to the load balancer or gateway. This commit should be reverted when we merge future pf versions. The benefit it would provide is that this version does not break any existing public interface and thus won't be a problem if we want to MFC it to earlier FreeBSD releases. Discussed with: mlaier Obtained from: OpenBSD Sponsored by: iXsystems, Inc. MFC after: 1 month
* Max's changes got left out of the MRT commit.julian2008-05-091-15/+6
|
* Make ALTQ cope with disappearing interfaces (particularly common with mpdmlaier2008-03-292-0/+38
| | | | | | | | | and netgraph in gernal). This also allows to add queues for an interface that is not yet existing (you have to provide the bandwidth for the interface, however). PR: kern/106400, kern/117827 MFC after: 2 weeks
* MFOpenBSD rev 1.393 pf.conf.5remko2008-02-111-3/+3
| | | | | | | | do not describe `/' as solidus; from Allen (freebsd pr120484); PR: 120484 Submitted by: Allen <alandsidel at 1001islington dot com> MFC After: 3 days
* Update for libpcap 0.9.8mlaier2007-10-161-0/+3
|
* Lost these during the import. Hand me the pointy hat.mlaier2007-07-032-0/+125
| | | | Approved by: re (implicit)
* Commit resolved import of OpenBSD 4.1 pf userland from perforce.mlaier2007-07-0328-3423/+3641
| | | | Approved by: re (kensmith)
* This commit was generated by cvs2svn to compensate for changes in r171169,mlaier2007-07-0321-7/+5188
|\ | | | | | | which included commits to RCS files with non-trunk default branches.
| * Import pf userland from OpenBSD 4.1 and (for ftp-proxy) libevent 1.3b asmlaier2007-07-0343-2655/+8750
| | | | | | | | a local lib.
* | Revert my previous change, add an MLINK from securelevel.7 to security.7remko2007-06-011-2/+2
| | | | | | | | Discussed with: brueffer
* | Change securelevel(7) to security(7). Yes i am awareremko2007-06-011-2/+2
| | | | | | | | | | | | | | | | | | that this is within the contrib directory. PR: docs/104402 Submitted by: Dr. Markus Waldeck <waldeck at gmx dot de> Discussed with: mlaier
* | From OpenBSD, rev. 1.379dhartmei2007-05-211-2/+3
| | | | | | | | | | | | | | Document how 'allow-opts' applies to routing headers in IPv6. MFC after: 1 week Discussed with: mlaier
* | From OpenBSD, rev. 1.91:mlaier2006-11-301-2/+3
| | | | | | | | | | | | | | | | | | fix servicecurve check; no point in checking the same sc three times, it was obviously intended to check all three. has been wrong since the beginning, 4 years... noticed by Earl Lapus <earl.lapus@gmail.com>, Vasil Dimov <vd@FreeBSD.org> mailed me then, ok mcbride MFC after: 3 days
* | Mention that we do not support route labels in the BUGS section.mlaier2006-10-301-1/+7
| | | | | | | | | | PR: docs/93590 Reported by: Niki Denev
* | - Note that the synchronisation interface needs to be up and haveglebius2006-06-061-2/+5
| | | | | | | | | | | | | | an IP address assigned. - Add "quick" keyword to pf.conf example. PR: docs/85209
* | Document authpf's requirement for a mounted fdescfs(5).mlaier2006-03-281-2/+8
| | | | | | | | | | PR: docs/89635 MFC after: 1 day
* | Constfy errstr as it is in OpenBSD to unbreak the build.mlaier2006-03-151-1/+1
| | | | | | | | Pointed out by: Suken Woo, Martin Wilke, Wesley Morgan
* | Use strtonum now that we have it in libc as well.mlaier2006-03-151-15/+0
| |
* | Fix build after timeval.tv_sec changed from long to time_t.mlaier2005-12-251-0/+8
| |
* | Add an rc.d script to start pfsync at the right moment of theyar2005-10-021-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | system boot, and hook it up in the system. The separate script is needed because in the presence of various interface lists in rc.conf ($network_interfaces, $cloned_interfaces, $sppp_interfaces, $gif_interfaces, more to come) it is hard to start them orderly, so that pfsync is brought up after its syncdev, which is required for the proper startup of pfsync. Discussed with: mlaier on -pf MFC after: 5 days
* | Redirect bridge(4) to if_bridge(4). These should have pointed to if_bridgemlaier2005-09-282-3/+3
| | | | | | | | | | | | from the begining. Reminded by: ru
* | FreeBSD now supports BIOCLOCK. So we can use it now.csjp2005-08-231-4/+0
| | | | | | | | Reviewed by: mlaier
* | More tcpdump 8->1 cleanup.brueffer2005-08-063-12/+17
| | | | | | | | | | Approved by: mlaier MFC after: 3 days
* | - Remove MLINKS to nonexistant manpagesbrueffer2005-07-143-6/+8
| | | | | | | | | | | | | | - Change some section numbers to match reality - For MLINKS to manpages from ports, mention which port installs them MFC after: 3 days
* | Resolve conflicts created during the import of pf 3.7 Some features aremlaier2005-05-0318-1390/+2370
| | | | | | | | | | | | | | missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD
* | This commit was generated by cvs2svn to compensate for changes in r145837,mlaier2005-05-0312-181/+1839
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
| * Import pf userland from OpenBSD 3.7 (OPENBSD_3_7 as of today)mlaier2005-05-0329-1565/+4187
| |
| * Import pfctl_table.c#1.61 from OpenBSD into vendor branch.mlaier2004-08-221-1/+8
| |
* | - remove OpenBSDisms, add FreeBSDismsglebius2005-02-231-54/+46
| | | | | | | | | | | | | | | | | | | | | | | | - comment out feature, we do not have yet: tcpdumping on pfsync, add a BUGS section - reference carp.4 - dereference bpf(4), tcpdump(7), hostname.if(5) - sort references - tell when pfsync appeared in FreeBSD Reviewed by: mlaier MFC after: 1 week
* | Fix sloppy use of "manpage", bump .Dd where applicable and rename RED tomlaier2005-02-072-4/+4
| | | | | | | | | | | | | | Random Early Detection (not ... Drop) in order to be consistent with other documentation on ALTQ Pointed out by: simon, ru, Brad Davis
* | Be more verbose about altq SYNOPSIS and add more linkage in the relating pfmlaier2005-02-072-0/+10
| | | | | | | | | | | | | | | | documents. Inspired by: scottl Reviewed by: Brad Davis <so14kNOso14kSPAMcom> MFC after: 3 days
* | Fix a reference from pool(9) -> zone(9), but keep on talking about "memorymlaier2004-11-141-1/+1
| | | | | | | | | | | | pools" as that is what UMA provides. Submitted by: Jay <jay NO meangrape SPAM com>
* | Rename the QUEUEING section to QUEUEING/ALTQ to make it easier to find themlaier2004-10-071-2/+2
| | | | | | | | | | | | appropiate section when redirected from ALTQ(4). MFC after: 2 days
* | Make pflogd cope with module unload (and the sudden disappearing of pflog0).mlaier2004-10-051-1/+9
| | | | | | | | | | | | | | Instead of eating all the available CPU we now shutdown gracefully. Submitted by: yongari MFC after: 3 days
* | Document a problem with user/group filtering. With debug.mpsafenet=1 thismlaier2004-10-031-1/+32
| | | | | | | | | | | | | | | | | | | | | | might result in a deadlock. The fix involves critical changes in the PF locking strategy (which will happen after 5.3R). For now advise users to set debug.mpsafenet=0 if they use this kind of filtering. The same problem exists for IPFW. mdoc help from: simon MFC after: 2 days
* | PFIL_HOOKS is no longer an optional item.mlaier2004-09-261-2/+1
| | | | | | | | | | Submitted by: Anders Hanssen MFC after: 1 day
* | Bring in some examples (and create space for future work here):mlaier2004-09-141-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | - Add OpenBSD example rulesets as advertised in etc/pf.conf and pf.conf(5) - Tweak the pointer to fit the FreeBSD default location share/examples/pf - Account for the new directory in BSD.usr.dist (no hier(7) change required as share/examples is an opaque item there). Obtained from: OpenBSD Reminded by: Thomas T. Veldhouse PR: docs/71691 MFC after: 2 days
* | Make pflogd(8) store pcap_sf_pkthdr instead of MD timeval contaminatedmlaier2004-08-311-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | pcap_pkthdr. This makes /var/log/pflog standart compliant on 64bit archs. OpenBSD has fixed this by changing the bpf timeval to 32bit in the kernel, so no need to report this over (again). PR: bin/71096 (w/ changes) Submitted by: Ville-Pertti Keinonen Tested by: amd64(submitter), sparc64(yongari), i386(myself) MFC after: 3 days
* | Loopback a fix from Cedric Berger:mlaier2004-08-221-1/+8
| | | | | | | | | | | | | | | | Fix table add/replace commands with securelevel=2. Reported by James J. Lippard. Discussed with: yongari MFC after: 5 days
* | Fix printing of u_int64_t with a cast to unsigned long long.mlaier2004-06-171-1/+1
| | | | | | | | Found-by: tinderbox(amd64)
* | Commit userland part of pf version 3.5 from OpenBSD (OPENBSD_3_5_BASE).mlaier2004-06-1617-839/+2444
| |
* | This commit was generated by cvs2svn to compensate for changes in r130614,mlaier2004-06-1612-170/+925
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
OpenPOWER on IntegriCloud