summaryrefslogtreecommitdiffstats
path: root/sbin/pfctl/pfctl_radix.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Unify error message for nonexisting anchorskn2020-01-151-14/+1
| | | | | | | | | | | | | pf(4) returns EINVAL for DIOCGETRULE, DIOCGETRULES and DIOCGETRULESET if the specified anchor does not exist. Extend and rename {pfr -> pf}_strerror() to make error message more consistent. There are other occasions as well but those need additional tweaks; that's stuff for another diff. OK and rename from sashan
* Refine error messagekn2020-01-151-2/+2
| | | | | | | | | | | While code in pf/pfctl confusingly uses either anchor or ruleset depending on the context, pfctl(8) (both manual and user interface) should be consistent. For users there are basically anchors only, so do not imply any difference between the two terminologies. OK sashan
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-16/+16
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* add option -N (no domain resolution)benno2017-08-111-3/+3
| | | | | manpage wording and reminder about usage() jmc@ ok florian@ henning@
* Remove NULL-checks before free(). ok tb@mmcc2015-12-101-3/+2
|
* Include <netinet/in.h> before <net/pfvar.h>. In a future change whenderaadt2015-01-211-1/+2
| | | | ports is ready, <net/pfvar.h> will stop including a pile of balony.
* consolidate some code by using reallocarray in all cases.tedu2014-05-071-19/+9
| | | | ok deraadt millert
* Whole bunch of (unsigned char) casts carefully added for ctype calls.deraadt2013-11-221-3/+3
| | | | Careful second audit by millert
* Add support for weighted round-robin in load balancing pools and tables.mcbride2011-07-271-4/+7
| | | | | Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
* remove unused functionschl2007-12-051-50/+1
| | | | | | from tobias@ ok mcbride@ tobias@
* clean up and rework the interface absraction code big time, rip out multiplehenning2005-05-211-4/+3
| | | | | | | | useless layers of indirection and make the code way cleaner overall. this is just the start, more to come... worked very hard on by Ryan and me in Montreal last week, on the airplane to vancouver and yesterday here in calgary. it hurt. ok ryan theo
* Remove unused functions. ok beck@ henning@cedric2004-06-141-39/+1
|
* Do not try to load directories. found+ok mpech@cedric2004-04-091-2/+2
|
* lotsoflotsoflotsof KNFhenning2004-02-101-5/+7
| | | | and an off by one
* Many improvements to the handling of interfaces in PF.cedric2003-12-311-2/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
* Rearchitecture of the userland/kernel IOCTL interface for transactions.cedric2003-09-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
* Fix realloc usage and make sure we don't increase buffer size on failure.cedric2003-09-241-15/+13
| | | | ok henning@ mcbride@
* pf spelling policedavid2003-08-221-2/+2
| | | | ok dhartmei@ jmc@
* Make table tickets per-ruleset instead of global.cedric2003-07-311-3/+8
| | | | | Make table tickets u_int32_t for consistency with other parts of PF. Ok dhartmei@ henning@
* KNF after cedric (grmpf)henning2003-07-041-4/+4
|
* This patch finally cleanup pfctl_table.c. No more global buffer,cedric2003-07-031-12/+21
| | | | | | | | | | | and a couple of parsing functions moved to parse.y or pfctl_parser where they belong. I also took the opportunity to replace "void" functions with exit(1) or err() inside by "int" functions, with the caller checking the return value for errors (much cleaner and an old request from Theo) ok dhartmei@ henning@
* Buffer management functions.cedric2003-06-301-1/+111
| | | | ok dhartmei@
* No need to include the same header twice.cedric2003-06-281-2/+1
| | | | Thanks to Max Laier.
* Reorg part I: move 3 functions out of pf_table.c to pf_radix.ccedric2003-06-271-1/+79
| | | | ok dhartmei@
* A table in an anchor creates a real anchor: pfctl -sA works.cedric2003-06-081-4/+12
| | | | | | | The following two pfctl functions work with an "-a" option: - pfctl [-a foo[:bar]] -sT - pfctl [-a foo[:bar]] -FT ok dhartmei@
* Update the pfioc_table IOCTL structure.cedric2003-04-271-1/+15
| | | | | | Prepare for anchors, improve robustness. WARNING: need to sync kernel/userland. ok dhartmei@
* More cleanup in tables thanks to Andrey Matveev:cedric2003-02-031-2/+1
| | | | | | | - get rid of unnecessary header netinet/in.h in pfctl_radix.c and pfctl_table.c - do fclose(3) only when we use config file, not STDIN - get rid of unneeded temporatory variables - minor KNF
* Another nice cleanup patch from Andrey Matveevcedric2003-01-251-24/+22
| | | | KNF + remove/reorg headers.
* Cut & paste madness. We were (un)lucky it worked before!cedric2003-01-201-4/+4
|
* Add support for active/inactive tablesets in the kernel.cedric2003-01-091-1/+83
| | | | | | | Add table definition/initialisation construct in pfctl parser. Add and fix documentation for pf.4 and pf.conf.5. Tested on i386 and sparc64 by myself, macppc by Daniel. ok dhartmei@
* Remove table name hashing (pass the name in each ioctl instead), anddhartmei2003-01-071-44/+1
| | | | | | introduce reference counting for tables, they are now automatically created and deleted through referencing rules. Diff partly from cedric@. ok mcbride@, henning@, cedric@
* I do not know where this policy of "one .h file for every .c file" comesderaadt2003-01-041-2/+2
| | | | from, but whoever thought of it is stupid.
* simplify ioctl accessderaadt2003-01-031-38/+18
|
* Remove _ before static functions & variables.cedric2003-01-031-24/+24
|
* kill stupid macroderaadt2003-01-031-37/+61
|
* knfderaadt2003-01-031-15/+15
|
* Bring in userland code for accessing PF radix tables.cedric2003-01-031-0/+378
ok dhartmei@ mcbride@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.