summaryrefslogtreecommitdiffstats
path: root/sbin/pfctl
Commit message (Collapse)AuthorAgeFilesLines
* Use nitems() from sys/param.h.araujo2016-04-191-16/+8
| | | | MFC after: 2 weeks.
* MFHgjb2016-04-161-3/+12
|\ | | | | | | Sponsored by: The FreeBSD Foundation
| * Make pfctl(8) more flexible when parsing bandwidth values.loos2016-04-141-3/+12
| | | | | | | | | | | | | | | | | | This is the current behaviour in OpenBSD and a similar patch exist in pfSense too. Obtained from: OpenBSD (partly - rev. 1.625) MFC after: 2 weeks Sponsored by: Rubicon Communications (Netgate)
* | MFHgjb2016-03-021-2/+0
|\ \ | |/ | | | | Sponsored by: The FreeBSD Foundation
| * DIRDEPS_BUILD: Regenerate without local dependencies.bdrewery2016-02-241-2/+0
| | | | | | | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division
* | Create packages for atm, ccdconfig, devd, ipf, ipfw,gjb2016-02-091-0/+1
|/ | | | | | | | iscsi, natd, nandfs, pf, quotacheck, and routed. Add ping6 and rtsol to the runtime package. Sponsored by: The FreeBSD Foundation
* Make pfctl(8) work on strict-alignment platforms, by copying a pair ofian2016-01-301-5/+13
| | | | | | | | | | | | | embedded structures out of a packed, unaligned struct into local copies on the stack which are aligned. The original patch to do this was submitted by Guy Yur <guyyur@gmail.com>, and this is conceptually the same change, but restructured with the #ifndef __NO_STRICT_ALIGNMENT wrapper, similar to how the same issue is handled in the kernel pf code. PR: 185617 PR: 206658
* pfctl: Fix uninitialised veriablekp2015-11-011-0/+1
| | | | | | | | | In pfctl_set_debug() we used 'level' without ever initialising it. We correctly parsed the option, but them failed to actually assign the parsed value to 'level' before performing to ioctl() to configure the debug level. PR: 202996 Submitted by: Andrej Kolontai
* pf: Remove support for 'scrub fragment crop|drop-ovl'kp2015-08-272-8/+3
| | | | | | | | | | | | | | The crop/drop-ovl fragment scrub modes are not very useful and likely to confuse users into making poor choices. It's also a fairly large amount of complex code, so just remove the support altogether. Users who have 'scrub fragment crop|drop-ovl' in their pf configuration will be implicitly converted to 'scrub fragment reassemble'. Reviewed by: gnn, eri Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3466
* Add ALTQ(9) support for the CoDel algorithm.loos2015-08-214-9/+149
| | | | | | | | | | | | | CoDel is a parameterless queue discipline that handles variable bandwidth and RTT. It can be used as the single queue discipline on an interface or as a sub discipline of existing queue disciplines such as PRIQ, CBQ, HFSC, FAIRQ. Differential Revision: https://reviews.freebsd.org/D3272 Reviewd by: rpaulo, gnn (previous version) Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)
* Only report the lack of ALTQ support if pfctl is using verbose (-v) mode.gnn2015-07-201-1/+1
| | | | | | PR: 194935 Submitted by: Jim Thompson MFC after: 2 weeks
* ALTQ FAIRQ discipline import from DragonFLYeri2015-06-244-4/+337
| | | | | | | | Differential Revision: https://reviews.freebsd.org/D2847 Reviewed by: glebius, wblock(manpage) Approved by: gnn(mentor) Obtained from: pfSense Sponsored by: Netgate
* Add META_MODE support.sjg2015-06-131-0/+24
|\ | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp
| * dirdeps.mk now sets DEP_RELDIRsjg2015-06-081-2/+0
| |
| * Merge sync of headsjg2015-05-276-15/+15
| |\ | |/ |/|
| * Merge head from 7/28sjg2014-08-191-1/+0
| |\
| * | Updated dependenciessjg2014-05-161-1/+0
| | |
| * | Updated dependenciessjg2014-05-101-0/+2
| | |
| * | Merge from headsjg2014-05-081-1/+1
| |\ \
| * \ \ Merge headsjg2014-04-286-23/+55
| |\ \ \
| * | | | Updated dependenciessjg2013-03-111-0/+1
| | | | |
| * | | | Updated dependenciessjg2013-02-161-2/+0
| | | | |
| | | | |
| | \ \ \
| *-. \ \ \ Sync from headsjg2012-11-0425-2261/+17353
| |\ \ \ \ \
| * | | | | | Sync FreeBSD's bmake branch with Juniper's internal bmake branch.marcel2012-08-221-0/+24
| | |/ / / / | |/| | | | | | | | | | | | | | | | Requested by: Simon Gerraty <sjg@juniper.net>
* | | | | | Move ALTQ from contrib to net/altq. The ALTQ code is for many yearsglebius2015-04-164-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | discontinued by its initial authors. In FreeBSD the code was already slightly edited during the pf(4) SMP project. It is about to be edited more in the projects/ifnet. Moving out of contrib also allows to remove several hacks to the make glue. Reviewed by: net@
* | | | | | Convert sbin/ to LIBADDbapt2014-11-251-2/+1
| |_|_|_|/ |/| | | | | | | | | | | | | | Reduce overlinking
* | | | | mdoc: remove superfluous paragraph macros.joel2014-06-231-1/+0
| |_|_|/ |/| | |
* | | | Use src.opts.mk in preference to bsd.own.mk except where we need stuffimp2014-05-061-1/+1
| |_|/ |/| | | | | | | | from the latter.
* | | Fix compilation for 32-bit machines.glebius2014-03-051-6/+7
| | |
* | | Instead of playing games with casts simply add 3 more members to theglebius2014-03-051-8/+6
| | | | | | | | | | | | | | | | | | | | | structure pf_rule, that are used when the structure is passed via ioctl(). PR: 187074
* | | Better build fix.glebius2014-02-151-6/+7
| | |
* | | Fix build on 32bit arches broken by me in r261882.glebius2014-02-141-4/+5
| | |
* | | Once pf became not covered by a single mutex, many counters in it becameglebius2014-02-141-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | race prone. Some just gather statistics, but some are later used in different calculations. A real problem was the race provoked underflow of the states_cur counter on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this value is used in pf_state_expires() and any state created by this rule is immediately expired. Thus, make fields states_cur, states_tot and src_nodes of struct pf_rule be counter(9)s. Thanks to Dennis for providing me shell access to problematic box and his help with reproducing, debugging and investigating the problem. Thanks to: Dennis Yusupoff <dyr smartspb.net> Also reported by: dumbbell, pgj, Rambler Sponsored by: Nginx, Inc.
* | | Use feature_present(3) to determine whether to open an INET or anbz2013-12-264-4/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | INET6 socket when needed to allow pfctl to work on noinet and noinet6 kernels (and try to provide a fallback using AF_LINK as best effort). Adjust the Makefile to also respect relevant src.conf(5) options for compile time decisions on INET and INET6 support. Reviewed by: glebius (no objections) MFC after: 1 week
* | | Remove __FreeBSD__ ifdefs.glebius2013-11-221-6/+1
| | |
* | | Rewrite usage() so that its source code resembles what is printed.glebius2013-11-221-7/+7
| | |
* | | Import pf_print_state.c 1.54 from OpenBSDbapt2013-10-271-0/+5
| |/ |/| | | | | | | | | | | | | | | | | | | Original log: pfctl -ss printed state levels for ICMPv6. Disable this the same way it has already been done for ICMPv4. Difference with OpenBSD: - WITHOUT_INET6 safe Obtained from: OpenBSD
* | - Get rid of #ifdef __FreeBSD__.glebius2012-09-291-21/+8
| | | | | | | | - Use correct format when printing uint64_t.
* | Minor mdoc fix.joel2012-09-141-2/+2
| |
* | o Create directory sys/netpfil, where all packet filters shouldglebius2012-09-1425-2261/+17366
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi
* Switch the default WARNS level for sbin/ to 6.ru2009-10-191-0/+1
| | | | Submitted by: Ulrich Spörlein
* Link pf 4.1 to the build:mlaier2007-07-031-0/+2
| | | | | | | | - move ftp-proxy from libexec to usr.sbin - add tftp-proxy - new altq mtag link Approved by: re (kensmith)
* Add missing library dependencies.ru2006-04-131-1/+1
|
* Adapt Makefiles for pfctl(8) and authpf(8) to 3.7 sources.mlaier2005-05-031-0/+1
|
* Remove -I from CFLAGS. This splipped in with the 3.5 import (as I wasmlaier2004-10-031-1/+0
| | | | | | building on a box with older pfvar.h installed). Didn't intend to commit it. Requested by: ru (on a C&P to ipfw's Makefile)
* Removed redundant and unsafe BINDIR redefinition.ru2004-07-071-1/+0
|
* Commit userland part of pf version 3.5 from OpenBSD (OPENBSD_3_5_BASE).mlaier2004-06-161-2/+3
|
* Remove advertising clause from University of California Regent's license,markm2004-04-092-8/+0
| | | | | | per letter dated July 22, 1999. Approved by: core, imp
* Add skeleton build dirs for pf userland:mlaier2004-02-2812-0/+2285
libexec/ftp-proxy - ftp proxy for pf sbin/pfctl - equivalent to sbin/ipf sbin/pflogd - deamon logging packets via if_pflog in pcap format usr.sbin/authpf - authentification shell to modify pf rulesets Bring along some altq headers used to satisfy pfctl/authpf compile. This helps to keep the diff down and will make it easy to have a altq-patchset use the full powers of pf. Also make sure that the pf headers are installed. This does not link anything to the build. There will be a NO_PF switch for make.conf once pf userland is linked. Approved by: bms(mentor)
OpenPOWER on IntegriCloud