#
cd2054d4 |
|
24-May-2024 |
Kristof Provost <kp@FreeBSD.org> |
libpfctl: add pfctl_get_rule_h() Add a handle variant of pfctl_get_rule(). This converts us from using the nvlist variant to the netlink variant, and also moves us closer to a world where all libpfctl functions take the handle. While here have pfctl use the new function. Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
f1612e70 |
|
09-May-2024 |
Kristof Provost <kp@FreeBSD.org> |
libpfctl: fix file descriptor leak pfctl_get_rules_info() opened a netlink socket, but failed to close it again. Fix this by factoring out the netlink-based function into a _h variant that takes struct pfctl_handle, and implement pfctl_get_rules_info() based on that, remembering to close the fd. While here migrate all in-tree consumers to the _h variant. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
47a0b593 |
|
24-Nov-2023 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: use libpfctl instead of DIOCGETRULES directly MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
32e86a82 |
|
24-Nov-2023 |
Warner Losh <imp@FreeBSD.org> |
sbin: Automated cleanup of cdefs and other formatting Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
|
#
1d386b48 |
|
16-Aug-2023 |
Warner Losh <imp@FreeBSD.org> |
Remove $FreeBSD$: one-line .c pattern Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
|
#
9f1beeae |
|
06-Mar-2023 |
Kajetan Staszkiewicz <vegeta@tuxpowered.net> |
pfctl: fix superblock printf format mismatch It is impossible to compile pfctl with OPT_DEBUG due to integer width mismatch: /usr/home/kajetan.staszkiewicz/freebsd.git/sbin/pfctl/pfctl_optimize.c:1479:9: error: format specifies type 'unsigned int' but the argument has type 'unsigned long' [-Werror,-Wformat] i - pf_rule_desc[closest].prf_off--- pfctl_optimize.o --- ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/home/kajetan.staszkiewicz/freebsd.git/sbin/pfctl/pfctl_optimize.c:52:44: note: expanded from macro 'DEBUG' printf("%s: " str "\n", __FUNCTION__ , ## v) ~~~ ^ 1 error generated. Reviewed by: kp Obtained from: OpenBSD (pfctl_optimize.c 1.15) Differential Revision: https://reviews.freebsd.org/D38918
|
#
c4e49c3a |
|
07-Mar-2022 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: remove unused variable MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
e9eb0941 |
|
08-Apr-2021 |
Kristof Provost <kp@FreeBSD.org> |
libpfctl: Switch to pfctl_rule Stop using the kernel's struct pf_rule, switch to libpfctl's pfctl_rule. Now that we use nvlists to communicate with the kernel these structures can be fully decoupled. Reviewed by: glebius MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29644
|
#
0d71f9f3 |
|
26-Mar-2021 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: Move ioctl abstraction functions into libpfctl Introduce a library to wrap the pf ioctl interface. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29562
|
#
0d6c8174 |
|
26-Mar-2021 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: Use the new DIOCGETRULENV ioctl Create wrapper functions to handle the parsing of the nvlist and move that code into pfctl_ioctl.c. At some point this should be moved into a libpfctl. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29560
|
#
7296d6c9 |
|
19-Apr-2019 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: Fix ifgroup check We cannot just assume that any name which ends with a letter is a group That's not been true since we allowed renaming of network interfaces. It's also not true for things like epair0a. Try to retrieve the group members for the name to check, since we'll get ENOENT if the group doesn't exist. MFC after: 1 week Event: Aberdeen hackathon 2019
|
#
e2d84d5a |
|
27-Jan-2018 |
Pedro F. Giffuni <pfg@FreeBSD.org> |
pfctl(8): Fix two wrong conditions. Caught by gcc80's -Wtautological-compare option. MFC after: 5 days Approved by: kp Obtained from: DragonFlyBSD (git e3cdbf6c) Differential Revision: https://reviews.freebsd.org/D14083
|
#
28323add |
|
08-Nov-2016 |
Bryan Drewery <bdrewery@FreeBSD.org> |
Fix improper use of "its". Sponsored by: Dell EMC Isilon
|
#
13cfafab |
|
04-Aug-2016 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: Make most global variables static. This will make it easier to link as a library. Submitted by: Christian Mauderer <christian.mauderer@embedded-brains.de>
|
#
3b3a8eb9 |
|
14-Sep-2012 |
Gleb Smirnoff <glebius@FreeBSD.org> |
o Create directory sys/netpfil, where all packet filters should reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi
|