wireguard-openbsd/sbin/pfctl/pfctl_parser.h, branch jd/queueboosts

Enable pfctl(8) to recursively flush rules and tables from PF driver. The

2020-01-15T11:52:50Z

recursive operation ("pfctl -a '*' ...") works for '-s' option already. This change enables the same thing for '-F' option, so "pfctl -a '*' -Fa" will flush everything from PF driver. The idea was discussed with many on tech@ in spring 2019. OK kn@

Remove pfctl_*_pool() remnants

2019-03-07T08:01:52Z

Left behind in pfctl_parser.h revision 1.91 "First pass at removing the 'pf_pool' mechanism [...]" These functions don't exist anymore, no object change. OK procter

Fix once rules

2019-03-06T19:49:05Z

parse.y revision 1.682 from 16.07.2018 errornously allowed `match once' and `anchor "a" once'. Fix both by checking for PF_DROP not PF_MATCH and creating anchors in the parser already such that they can be used to distinguish anchor rules in the same check as well. Found and fixed by Petr Hoffmann , thanks! While here, remove an unneeded cast and make pfctl_add_rule() void as it always returned 0. OK sashan

Reuse copy_satopfaddr() when killing entries

2019-01-29T10:58:31Z

Recently introduced in pfctl_parser.c r1.333, this helper nicely simplifies code when copying IPs based on their address family, so use it in five other places when killing state or source node entries. All addresses copied in these code paths result from either pfctl_parse_host() or pfctl_addrprefix() which guarantee the address family set to AF_INET or AF_INET6. Therefore, effectively relaxing the case of unhandled families from errx(3) in callers to warnx(3) in copy_satopfaddr() is safe since it's never reached. OK sashan

Remove unused af argument from unmask()

2018-09-06T15:07:33Z

This has been unused for years. While here, zap the duplicate function signature from pfctl.h (already present in pfctl_parser.h); spotted by sashan, thanks. OK sashan

Move AF-specific mask logic from callers into set_ipmask()

2018-09-05T21:16:26Z

Instead of doing the same dance with every caller, check for user provided mask or address familiy specific maximum inside the function itself. Feedback and OK claudio

make the watermarks/thresholds for entering and leaving syncookie mode when

2018-02-08T09:15:46Z

syncookies are set to adaptive tunable, ok claudio benno

show current synflood detection watermarks in pfctl -vsi, for the lack

2018-02-08T02:26:39Z

of a more appropriate place. ok claudio benno procter

allow control over syncookies: set syncookies never/always/adaptive

2018-02-06T23:47:47Z

- patching use-after-free and innocent memory leak in pfctl_optimzie.c

2017-11-25T22:20:06Z

OK bluhm@