wireguard-openbsd/sbin/pfctl/parse.y, branch jd/queueboosts

sbin/pfctl: replace TAILQ concatenation loop with TAILQ_CONCAT

2020-01-28T15:40:35Z

OK kn@, sashan@, florian@

Do the actual pfr_strerror() to pf_strerror() rename

2020-01-15T22:38:30Z

Missed in previous

Use -1 to indicate an invalid uid/gid, not UID_MAX and GID_MAX.

2019-10-17T21:54:28Z

This is the userland portion. OK deraadt@ sashan@

Fix file descriptor leak due to popfile() never closing the main config file.

2019-08-26T18:53:58Z

The fix is the same as for other parse.y files in the tree (see bgpd(8) or unwind(8)) ok bluhm@

Fix integer sizes in format strings and enable formatting warnings

2019-07-05T06:56:22Z

for yyerror. From Moritz Buhl ok bluhm@ claudio@

pfctl should check pfctl.astack is not overrun

2019-05-08T21:31:30Z

(bug found and fixed by Petr Hoffmann _at_ oracle.com) OK kn@

Fix table definition parsing as unprivileged user

2019-04-18T21:58:59Z

revision 1.689 introduced warn_duplicate_tables() unconditionally, breaking the parser on tables withs insufficient permissions to open pf(4): $ echo 'table ' | pfctl -nf- pfctl: pfr_get_tables: Bad file descriptor So simply check whether pfctl is able to get the table list first. If not, instead of silently avoiding namespace collision checks, print a brief notice iff `-v' is given to help finding duplicate definitions by hand: $ echo 'table ' | ./obj/pfctl -vnf- table stdin:1: skipping duplicate table checks for Reported by Rivo Nurges, thanks! OK benno sashan

Fix once rules

2019-03-06T19:49:05Z

parse.y revision 1.682 from 16.07.2018 errornously allowed `match once' and `anchor "a" once'. Fix both by checking for PF_DROP not PF_MATCH and creating anchors in the parser already such that they can be used to distinguish anchor rules in the same check as well. Found and fixed by Petr Hoffmann , thanks! While here, remove an unneeded cast and make pfctl_add_rule() void as it always returned 0. OK sashan

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other

2019-02-13T22:57:07Z

larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno

Anchor names must not be empty

2019-02-10T15:05:17Z

The parser would allow bogus input and sometimes even produce invalid rules on empty anchor names, so error out immediately. OK sashan