WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/pfctl/pfctl_table.c?h=jd%2Fqueueboosts 2020-01-15T22:38:30Z 2020-01-15T22:38:30Z kn kn@openbsd.org 2020-01-15T22:38:30Z urn:sha1:c802a0d9d6a6510e658984688f179f6777ccfce2 Missed in previous 2020-01-15T15:45:49Z kn kn@openbsd.org 2020-01-15T15:45:49Z urn:sha1:e13f0105288f304d66f03ce19d6424ba30482f36 Less nesting for clearer code. OK sashan 2020-01-15T11:52:50Z sashan sashan@openbsd.org 2020-01-15T11:52:50Z urn:sha1:ae711728d410d2bb41f3a563f2e2ebdede715edc recursive operation ("pfctl -a '*' ...") works for '-s' option already. This change enables the same thing for '-F' option, so "pfctl -a '*' -Fa" will flush everything from PF driver. The idea was discussed with many on tech@ in spring 2019. OK kn@ 2019-04-18T22:29:41Z kn kn@openbsd.org 2019-04-18T22:29:41Z urn:sha1:898866c293b8a3d1c25a9654c74fcab7bb725e3b `-t table -T add|replace ...' would only check for duplicate tables in case addresses where actually to the table. Instead of using a positive number of added addresses as prove for successful table operations, rely on the fact that CREATE_TABLE() is guaranteed to be called only if pf(4) can be accessed, that is warn_duplicate_tables() will return. This improves duplicate detection rate as warnings are now also emitted even when table commands eventually leave tables unchanged. OK benno sashan 2019-01-11T01:56:54Z kn kn@openbsd.org 2019-01-11T01:56:54Z urn:sha1:0de3a0c9ad4670e7bc4f5914d748896de526d211 collisions with global tables, but only in certain cases and with limited information sometimes leaving users clueless. Deferring the check to process_tabledefs() where tables are eventually created, both anchor and table name are known which allows for checking all existing anchors. With this, warn on all duplicates even in dry-runs (`-n') and print quoted names so they can be copied to fix configurations right away. No functional change in parsing or ruleset production. Discussed with and OK sashan 2019-01-02T23:08:00Z kn kn@openbsd.org 2019-01-02T23:08:00Z urn:sha1:97699edbc955e02f58419b17305169051cb36972 Table name and table command require each other as reflected in the synopsis [-t table -T command [address ...]], so print usage and exit if only one of them is given. By moving the inter-dependence check right after option parsing is done, we can bail out even before opening pf(4) and drop the internal wrapper pfctl_command_tables() as unneeded indirection with now duplicate checks. OK sashan 2018-10-15T21:15:35Z kn kn@openbsd.org 2018-10-15T21:15:35Z urn:sha1:ab23e671fc7de2edc2d7fcf04f82b0a62e9e606d Replace hardcoded 0 and implicit checks with enum as done in all other use cases of `pfra_fback'. No object change. OK sashan 2017-08-11T22:30:38Z benno benno@openbsd.org 2017-08-11T22:30:38Z urn:sha1:7c8726d43b8637f1351af2d64ce1c4af0716dd0c manpage wording and reminder about usage() jmc@ ok florian@ henning@ 2017-07-15T16:01:14Z awolk awolk@openbsd.org 2017-07-15T16:01:14Z urn:sha1:c5e9690e425edfa3f1408a893da9137ab14c7dcc Changes: voided: - pfctl_clear_tables - pfctl_show_tables - pfctl_show_ifaces Those functions now exit(3) in case of error instead of passing it up to the callers (where it was ignored). OK mikeb@, sashan@ 2017-04-13T07:30:21Z jsg jsg@openbsd.org 2017-04-13T07:30:21Z urn:sha1:90abbc648c135d903117f4e2e976c2127e95cf0a