aboutsummaryrefslogtreecommitdiff
path: root/contrib/ipfilter
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix -S handling within poolcommand(). Specifying a seed (-S) is onlyCy Schubert2017-06-211-1/+4
| | | | | | | | | valid when adding a pool (ippool -A), not when removing a pool (ippool -R). It is a command line syntax error if specifying a seed (-S) is specified when emoving a pool (-R). Notes: svn path=/head/; revision=320187
* Flag poolnodecommand() (ippool -a and ippool -r) command line syntaxCy Schubert2017-06-201-0/+6
| | | | | | | errors. Notes: svn path=/head/; revision=320143
* poolcommand() (ippool -A and ippool -R) seed takes an argument.Cy Schubert2017-06-191-1/+1
| | | | Notes: svn path=/head/; revision=320120
* Flag poolcommand() (ippool -A and ippool -R) command line syntax errors.Cy Schubert2017-06-191-0/+6
| | | | Notes: svn path=/head/; revision=320095
* Correct example directory location.Cy Schubert2017-06-151-1/+1
| | | | | | | | Submitted by: olivier@ MFC after: 3 days Notes: svn path=/head/; revision=319962
* Chase r319848: remove -v option from getopt() call.Cy Schubert2017-06-141-1/+1
| | | | Notes: svn path=/head/; revision=319930
* -n (do nothing) is not a commmand option.Cy Schubert2017-06-141-4/+1
| | | | Notes: svn path=/head/; revision=319929
* -v (verbose) is not a command option. (See ippool.1 for a definitionCy Schubert2017-06-121-3/+0
| | | | | | | of command options). Notes: svn path=/head/; revision=319848
* Flag loadpoolfile() (ippool -f) command line syntax errors.Cy Schubert2017-06-111-0/+6
| | | | Notes: svn path=/head/; revision=319822
* Identify poolstats() (ippool -s) command line syntax errors.Cy Schubert2017-06-111-0/+6
| | | | Notes: svn path=/head/; revision=319821
* Identify command line syntax errors in poolflush() (ippool -F).Cy Schubert2017-06-111-0/+6
| | | | Notes: svn path=/head/; revision=319820
* Remove redundant assignment of infile from optarg in loadpoolfile()Cy Schubert2017-06-101-2/+0
| | | | | | | | which was previously assigned from optarg in the argument list from main(). Notes: svn path=/head/; revision=319810
* Disable the -O (output fields) option in poollist() (ippool -l) forCy Schubert2017-06-101-1/+8
| | | | | | | | | | | now. The option does not presently work. However, similar functions in ipfstat (for state) and ipnat (for nat) do work and provide outputs that can be easily parsed by shell scripts or subsequently loaded into CSV files. The intention here is to return to this option to make it work. I suspect the problem is in printpoolfields.c. Notes: svn path=/head/; revision=319795
* Flag poollist() (ippool -l) command line syntax errors.Cy Schubert2017-06-101-0/+6
| | | | Notes: svn path=/head/; revision=319794
* Remove NORESOLVE (-R) option from poollist() (ippool -l). It is notCy Schubert2017-05-311-4/+1
| | | | | | | used in poollist(). Notes: svn path=/head/; revision=319273
* Implement ippool command line IPv6 address parse support (for the -iCy Schubert2017-05-161-16/+51
| | | | | | | | | option). PR: 218433 Notes: svn path=/head/; revision=318333
* Just like r318173, which was for outputting IPv6 addresses in treeCy Schubert2017-05-151-10/+39
| | | | | | | | | | | | | | | pools, implement outputting of IPv6 addresses in the ippool debug list of hash type pools (ippool -l -d -t hash). Currently IPv6 in ippool tree type pool handling is mostly implemented. This continues theseries of commits to remediate ippool. This will be MFCed with a yet to be committed series of fixes to ippool after it has been fully remediated. PR: 218433 Notes: svn path=/head/; revision=318284
* As of r318281, there is no need to put a colon (:) in the messageCy Schubert2017-05-141-1/+1
| | | | | | | | | | string. MFC after: 3 days X-MFC with: r318281 Notes: svn path=/head/; revision=318283
* Separate the ipfilter function/static string from the error with aCy Schubert2017-05-141-1/+1
| | | | | | | | | | colon (:) in error messages to assist the user in parsing out the error from where or which object the error message refers to. MFC after: 3 days Notes: svn path=/head/; revision=318281
* Add missing linefeed in debug output.Cy Schubert2017-05-121-1/+1
| | | | Notes: svn path=/head/; revision=318202
* Implement outputting of IPv6 addresses in the ippool debug list of treeCy Schubert2017-05-111-2/+24
| | | | | | | | | | | | | | type pools (ippool -l -d -t tree). Currently IPv6 in ippool tree type pool handling is partially implemented (meaning it doesn't work). This is the first of a series of commits to remediate ippool. This will be MFCed with a yet to be committed series of fixes to ippool after it has been fully remediated. PR: 218433 Notes: svn path=/head/; revision=318173
* Ifdef out a redundant if statement when INET6 is disabled.Cy Schubert2017-05-051-0/+2
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=317830
* Use warnx() to issue error message.Cy Schubert2017-04-162-2/+4
| | | | | | | | | Reported by: cem MFC after: 1 week X-MFC with: r316993, r316994 Notes: svn path=/head/; revision=316997
* Fix CID 1372600, possible NULL pointer dereference shouldCy Schubert2017-04-161-0/+4
| | | | | | | | | | reallocarray() fail. Reported by: Coverity CID 1372600 MFC after: 1 week Notes: svn path=/head/; revision=316994
* Fix CID 1372601, possible NULL pointer dereference shouldCy Schubert2017-04-161-0/+4
| | | | | | | | | | reallocarray() fail. Reported by: Coverity CID 1372601 MFC after: 1 week Notes: svn path=/head/; revision=316993
* Hide struct inpcb, struct tcpcb from the userland.Gleb Smirnoff2017-03-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | This is a painful change, but it is needed. On the one hand, we avoid modifying them, and this slows down some ideas, on the other hand we still eventually modify them and tools like netstat(1) never work on next version of FreeBSD. We maintain a ton of spares in them, and we already got some ifdef hell at the end of tcpcb. Details: - Hide struct inpcb, struct tcpcb under _KERNEL || _WANT_FOO. - Make struct xinpcb, struct xtcpcb pure API structures, not including kernel structures inpcb and tcpcb inside. Export into these structures the fields from inpcb and tcpcb that are known to be used, and put there a ton of spare space. - Make kernel and userland utilities compilable after these changes. - Bump __FreeBSD_version. Reviewed by: rrs, gnn Differential Revision: D10018 Notes: svn path=/head/; revision=315662
* calloc() and realloc() modernization.Cy Schubert2017-03-1612-16/+17
| | | | | | | | | | | | | | | | | | | | | | | | This commit replaces calloc calls, which called calloc() as if it were malloc() by allocating a multiple of objects as a sizeof multiplied by the number of objects. The patch rectifies this by calling calloc() as it was meant to be called. This commit also replaces realloc() with reallocarray() in a similar fashion as above. Instead of calculating the memory to reallocated (changed) by multiplying sizeof by the number of objects, the sizeof and number are passed as separate arguments to reallocarray(), letting reallocarray() do the multiplication instead. Like the calloc() adjustment above, this is approach is cleaner and more elegant than than the previous code. This has been tested on my production firewall and a laptop (also running ipfilter). Submitted by: pfg MFC after: 6 weeks Notes: svn path=/head/; revision=315368
* Fix leak (free str before returning when ctx's calloc fails).Cy Schubert2017-03-031-1/+3
| | | | | | | | | | | Submitted by: trix_juniper.net (Tom Rix) Discovered by: clang's static analyzer MFC after: 4 days Relnotes: ngie Differential Revision: D9877 Notes: svn path=/head/; revision=314627
* Use normal KNF cuddling of elses.Cy Schubert2017-01-261-2/+1
| | | | | | | | | Reported by: bde MFC after: 2 weeks X-MFC with: r312777 Notes: svn path=/head/; revision=312791
* Currently the fragment info is placed at the top of the linked listCy Schubert2017-01-261-0/+21
| | | | | | | | | | | | | | | | | | | | | under a shared read lock. This patch attempts to upgrade the lock to an exclusive write lock. If the exclusive write lock fails to be obtained, the current fragment is not placed at the head of the list. This portion of the patch was inspired by NetBSD ip_frag.c r1.4 (which effectively removed the section of code that performed the reordering). The patch to sys/contrib/ipfilter/netinet/ip_compat.h adds the MUTEX_TRY_UPGRADE macro to support the patch to ip_frag.c. The patch to contrib/ipfilter/lib/rwlock_emul.c supports this patch by emulating the mutex in userspace when exercised by ipftest(1). Inspired by: NetBSD ip_frag.c r1.4 MFC after: 1 month Notes: svn path=/head/; revision=312787
* Remove extraneous blank line.Cy Schubert2017-01-251-1/+0
| | | | | | | | MFC after: 2 weeks X-MFC with: r312777 Notes: svn path=/head/; revision=312780
* Issue an error message when an incorrect flush argument isCy Schubert2017-01-251-3/+7
| | | | | | | | | encountered.` MFC after: 2 weeks Notes: svn path=/head/; revision=312777
* Follow-up to r304953, in which I broke the build: apparently the SOLARISDimitry Andric2016-08-281-1/+5
| | | | | | | | | | | | macro is defined in lots of different places in ipfilter, so replace all of the nonportable definitions with portable ones. Pointy hat to: dim X-MFC-With: r304959, r304953 MFC after: 3 days Notes: svn path=/head/; revision=304964
* Remove dead code.Cy Schubert2016-06-301-17/+0
| | | | | | | | Approved by: re@ (hrs@) MFC after: 1 week Notes: svn path=/head/; revision=302296
* Clarify the wording to be more accurate.Cy Schubert2016-06-101-5/+4
| | | | | | | | | Approved by: re@ (gjb) MFC after: 1 week X-MFC with: r301773 Notes: svn path=/head/; revision=301775
* Update the man ipf.8 man page to accurately reflect that the -6Cy Schubert2016-06-101-1/+5
| | | | | | | | | option is a noop and only here for backward compatibility. MFC after: 1 week Notes: svn path=/head/; revision=301773
* Fix another typo.Cy Schubert2016-05-191-1/+1
| | | | | | | | Reported by: cem MFC after: 6 days Notes: svn path=/head/; revision=300179
* Fix typo.Cy Schubert2016-05-191-1/+1
| | | | | | | | Reported by: Ruben Kerkhof <ruben@rubenkerkhof.com> MFC after: 6 days Notes: svn path=/head/; revision=300177
* Static pointers need not be initialized.Cy Schubert2016-04-151-3/+3
| | | | | | | MFC after: 4 weeks Notes: svn path=/head/; revision=298031
* Use NULL instead of 0 for pointer comparison.Cy Schubert2016-04-151-3/+3
| | | | | | | MFC after: 4 weeks Notes: svn path=/head/; revision=298030
* ipf(1): Use strchr(3) instead of deprecated index(3)Ed Maste2015-05-221-1/+1
| | | | | | | | | | Reviewed by: cy MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D2607 Notes: svn path=/head/; revision=283295
* Stop including if_var.h from userland.Gleb Smirnoff2015-04-069-27/+0
| | | | | | | Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=281143
* o Use new function ip_fillid() in all places throughout the kernel,Gleb Smirnoff2015-04-011-0/+8
| | | | | | | | | | | | | | | | | | | | where we want to create a new IP datagram. o Add support for RFC6864, which allows to set IP ID for atomic IP datagrams to any value, to improve performance. The behaviour is controlled by net.inet.ip.rfc6864 sysctl knob, which is enabled by default. o In case if we generate IP ID, use counter(9) to improve performance. o Gather all code related to IP ID into ip_id.c. Differential Revision: https://reviews.freebsd.org/D2177 Reviewed by: adrian, cy, rpaulo Tested by: Emeric POUPON <emeric.poupon stormshield.eu> Sponsored by: Netflix Sponsored by: Nginx, Inc. Relnotes: yes Notes: svn path=/head/; revision=280971
* The ipftest(1) is a program that emulates ipf(4) operation and tests packetsGleb Smirnoff2015-02-192-3/+3
| | | | | | | | | | | | | | | | | against rules. It definitely doesn't need to know about kernel internals, such as 'struct ifaddr'. What it does with ifaddr, is that it only takes ifa_addr member of it, and treats it as sockaddr, while it is only a pointer to sockaddr. Fortunately, sizeof(struct ifaddr) > sizeof(struct sockaddr_in6), so no problems arise. Fix that declaring a private struct ifaddr in ipftest(1) and stop including if_var.h. Sponsored by: Netflix Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=279029
* #552 destination port not zero after parsing nat ruleCy Schubert2014-09-221-9/+13
| | | | | | | | Approved by: glebius (mentor) Obtained from: netbsd CVS repo (r1.4), ipfilter CVS repo (r1.38) Notes: svn path=/head/; revision=271978
* 3561691 gethost never returns an ipv6 addressCy Schubert2014-09-221-7/+9
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.34), netbsd CVS repo (r1.4) Notes: svn path=/head/; revision=271977
* #551 ipf.conf address structure not properly zero filledCy Schubert2014-09-221-11/+21
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.37), netbsd CVS repo (r1.3) Notes: svn path=/head/; revision=271974
* #536 ipnat can try to print rule as dstlist incorrectlyCy Schubert2014-09-221-2/+4
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.14), netbsd CVS repo (r1.3) Notes: svn path=/head/; revision=271972
* #553 gethost needs to zero entire IP address structureCy Schubert2014-09-221-0/+1
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.11) Notes: svn path=/head/; revision=271971
* ipv6 address for test.hosts.dots in wrong byte order.Cy Schubert2014-09-221-4/+4
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.11), netbsd CVS repo (r1.5) Notes: svn path=/head/; revision=271970
generated by cgit v1.3 (git 2.53.0) at 2026-08-01 09:40:17 +0000