wireguard-openbsd/sbin/pfctl/pfctl_parser.c, branch jd/queueboosts

pf(4): use CLOCK_BOOTTIME to get time_uptime(9) in userspace

2020-05-15T00:56:03Z

In pf(4), the pf_status.since timestamp is set with time_uptime(9). This is a low-res snapshot of nanouptime(9). nanouptime(9) is used to implement CLOCK_BOOTTIME for clock_gettime(2). It is not used to implement CLOCK_UPTIME, though. The names are misleading. Switch to CLOCK_BOOTTIME in places in userspace where we use pf_status.since so we are working with the right clock. Technically CLOCK_MONOTONIC is equivalent, but we shouldn't use that here. CLOCK_MONOTONIC is not necessarily the "time since boot": the standard says its absolute value is meaningless. ok patrick@ bluhm@

Use -1 to indicate an invalid uid/gid, not UID_MAX and GID_MAX.

2019-10-17T21:54:28Z

This is the userland portion. OK deraadt@ sashan@

When system calls indicate an error they return -1, not some arbitrary

2019-06-28T13:32:41Z

value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.

Fail on invalid netmasks when filling tables

2019-03-30T02:45:14Z

Fix a regression of revision 1.326 "Zap v4mask and v6mask in host()" which allowed CIDR networks with more than one "/" to be loaded into tables. I took care of this code path with regard to rules coming the ruleset parser, which aborts earlier on such invalid specifications, but missed `-T add 1/2/3' and the like. Analyzed and fixed by Petr Hoffmann , thanks! OK deraadt

Reuse copy_satopfaddr() when killing entries

2019-01-29T10:58:31Z

Recently introduced in pfctl_parser.c r1.333, this helper nicely simplifies code when copying IPs based on their address family, so use it in five other places when killing state or source node entries. All addresses copied in these code paths result from either pfctl_parse_host() or pfctl_addrprefix() which guarantee the address family set to AF_INET or AF_INET6. Therefore, effectively relaxing the case of unhandled families from errx(3) in callers to warnx(3) in copy_satopfaddr() is safe since it's never reached. OK sashan

The kernel does not set the address family for the socket addresses

2018-09-16T19:36:33Z

that are used for netmask, broadcast, and destination address. In pfctl(8) take the family of the interface address and write it to the other addresses. This fixes some bugs when copy_satopfaddr() copied only part of IPv6 addresses. Print a warning if the address family is unknown. OK kn@

Avoid unneeded variable in gen_dynnode()

2018-09-13T06:03:27Z

OK bluhm

Fix netmask regression in get_dynnode()

2018-09-11T10:42:10Z

I introduced this error with r1.330 while removing the af parameter from unmask(). `pass inet from (lo0)/24' would result in `pass inet from (lo0)', sorry.

Remove unused buffer from host()

2018-09-11T09:02:27Z

Left-over from pre-host_ip() times. While here, use __func__. OK henning benno

Merge host_v{4,6}() into simpler host_ip()

2018-09-10T20:53:53Z

Except for networks such as "10/8" host_ip() now handles addresses in an AF-agnostic way with more duplicate code removed/merged. OK sashan (as for earlier copy_satopfaddr() diff) henning