| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
from me
|
|
|
|
| |
"good idea" sthen
|
| |
|
|
|
|
|
| |
allocation. not the perfect text yet, but it is better.
discussed with florian and jmc
|
| |
|
|
|
|
|
| |
that isn't directly usable to a shorter table and example of what one might
need to add to EXTRACT_CASES when making a change; ok espie@
|
|
|
|
|
|
| |
disabled it in the past and then note that IPv6 autoconfiguration
doesn't work for you, you will quickly note that we will point and
laugh.
|
| |
|
|
|
|
| |
submitted the diff for the previous commit and who i forgot to credit...
|
|
|
|
|
|
| |
tweaked by deraadt
ok kettenis deraadt
|
| |
|
| |
|
|
|
|
| |
mention that shell wildcards may be used.
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
a monster.
okay sthen@
|
|
|
|
| |
GC www/drupal7 description
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ports dev work.
if you are able to run pkg_add as root without a password, your account
is root-equivalent.
typing the password multiple times is a pain but if somebody is going to
choose to weaken their local security in this way, it should be their
own decision and not something they have read in a manpage.
ok tb@ thfr@
|
|
|
|
| |
OK deraadt@, bluhm@
|
|
|
|
|
| |
ok bket@ sthen@ (who initially suggested the if-not-native value under
a similar name)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
this is a significant (and breaking) reworking of the policy based
routing that pf can do. the intention is to make it as easy as
nat/rdr to use, and more robust when it's operating.
the main reasons for this change are:
- route-to, reply-to, and dup-to do not work with pfsync
this is because the information about where to route-to is stored in
rules, and it is hard to have a ruleset synced between firewalls,
and impossible to have them synced 100% of the time.
- i can make my boxes panic in certain situations using route-to
yeah...
- the configuration and syntax for route-to rules are confusing.
the argument to route-to and co is an interace name with an optional
ip address. there are several problems with this. one is that people
tend to think about routing as sending packets to peers by their
address, not by the interface they're reachable on. another is that
we currently have no way to synchronise interface topology information
between firewalls, so using an interface to say where packets go
means we can't do failover of these states with pfsync. another
is that a change in routing topology means a host may become
reachable over a different interface. tying routing policy to
interfaces gets in the way of failover and load balancing.
this change does the following:
- stores the route info in the state instead of the pf rule
this allows route-to to keep working when the ruleset changes, and
allows route-to info to be sent over pfsync. there's enough spare bits
in pfsync messages that the protocol doesnt break.
the caveat is that route-to becomes tied to pass rules that create
state, like rdr-to and nat-to.
- the argument to route-to etc is a destination ip address
it's not limited to a next-hop address (thought a next-hop can be a
destination address). this allows for the failover and load balancing
referred to above.
- deprecates the address@interface host syntax in pfctl
because routing is done entirely by IPs, the interface is derived from
the route lookup, not pf. any attempt to use the @interface syntax
will fail now in all contexts.
there's enthusiasm from proctor@ jmatthew@ and others
ok sashan@ bluhm@
|
|
|
|
| |
OK deraadt@
|
|
|
|
| |
OK deraadt@
|
| |
|
|
|
|
|
|
| |
Less special cases in (rare) ports, pluse one can use EXTRACT_FILES as usual now.
OK espie robert
|
| |
|
|
|
|
|
|
| |
files.
Usual man page help & ok jmc@
|
|
|
|
|
|
| |
section a little more consistent;
ok krw
|
|
|
|
| |
ok jmc
|
| |
|
|
|
|
|
|
| |
mention of and Xr slaacd(8).
Usual help from jmc@
|
| |
|
|
|
|
|
|
| |
issue noticed by sthen@. fix discussed with bluhm@ and procter@
OK bluhm@, kn@, procter@
|
| |
|
|
|
|
|
|
|
|
| |
to perform network configuration (for example, "!route source -ifp em0")
Split mygate and myname manual pages (how did anyone ever believe these
are related), and perform hostname configuration much earlier in rc.
discussed with benno, claudio, jmc, etc etc, last version of !command
parser by tb
|
| |
|
| |
|
|
|
|
| |
Looks good, deraadt@
|
|
|
|
|
|
| |
It generates MODGO_MODULES and MODGO_MODFILES for Go port updates
ok abieber@
|
| |
|
|
|
|
|
|
|
| |
explicitly tells folks to read there for information about the
lang/ruby module.
ok kn
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.
ok jmc@, millert@, solene@, "fine with me" deraadt@
|
|
|
|
| |
OK espie@
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
Used for build systems which set paranoid permissions at build time.
See: https://marc.info/?l=openbsd-ports-cvs&m=159162220318205&w=2
original patch by jca@
|