aboutsummaryrefslogtreecommitdiff
path: root/contrib/ipfilter
Commit message (Collapse)AuthorAgeFilesLines
* Sync ippool.8 man page synopsis with reality and the rest of theCy Schubert2020-12-241-3/+3
| | | | | | man page.. MFC after: 3 days
* Remove a random equal sign from the example. It should not be there.Cy Schubert2020-10-271-1/+1
| | | | | | | | | | | It's a syntax error. PR: 210303 Reported by: leventelist at gmail.com MFC after: 3 days Notes: svn path=/head/; revision=367070
* Continued ipfilter #ifdef cleanup. The r343701 log entry contains aCy Schubert2020-10-271-1/+1
| | | | | | | | | complete description. MFC after: 3 days Notes: svn path=/head/; revision=367069
* ipfilter getifname ifdef cleanup.Cy Schubert2020-09-301-28/+1
| | | | | | | MFC after: 2 months Notes: svn path=/head/; revision=366286
* Resurrect ipfilter's getifname, replacing the stub with the realCy Schubert2020-09-301-11/+0
| | | | | | | | | function. MFC after: 2 months Notes: svn path=/head/; revision=366285
* Remove Linux and IRIX specific files.Cy Schubert2020-09-275-556/+0
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=366203
* Continuing the effort started in r343701, #ifdef cleanup, removeCy Schubert2020-09-271-1/+1
| | | | | | | | | never to be used again checks. MFC after: 1 week Notes: svn path=/head/; revision=366202
* Continued ipfilter #ifdef cleanup. The r343701 log entry contains aCy Schubert2020-08-051-30/+0
| | | | | | | | | complete description. MFC after: 1 week Notes: svn path=/head/; revision=363916
* Continued ipfilter #ifdef cleanup. The r343701 log entry contains aCy Schubert2020-07-297-181/+4
| | | | | | | | | complete description. MFC after: 1 week Notes: svn path=/head/; revision=363670
* Document the IPFILTER_PREDEFINED environment variable.Cy Schubert2020-07-231-0/+9
| | | | | | | | | PR: 248088 Reported by: joeb1@a1poweruser.com MFC after: 1 week Notes: svn path=/head/; revision=363453
* -4 and -6 only make sense with -i, -o, and -t.Cy Schubert2020-07-171-0/+9
| | | | | | | | PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363283
* The output from usage() need not contain usage for -t when STATETOPCy Schubert2020-07-171-0/+2
| | | | | | | | | | is not compiled in. PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363282
* Make ipfstat -t header generic when IPv4 and IPv6 output areCy Schubert2020-07-171-0/+3
| | | | | | | | | | displayed in the same display. PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363281
* ipfstat -t defaults to IPv4 output. Make consistent with ipfstat -iCy Schubert2020-07-172-4/+5
| | | | | | | | | | | and ipfstat -o where without an argument IPv4 and IPv6 states are shown. Use -4 and -6 to limit the display to IPv4 or IPv6 respectively. PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363280
* Historically ipfstat listings and stats only listed IPv4 or IPv6 output.Cy Schubert2020-07-172-18/+42
| | | | | | | | | | | | | | | ipfstat would list IPv4 outputs by default while -6 would produce IPv6 outputs. This commit combines the ipfstat -i and -o outputs into one listing of IPv4 and IPv6 rules. The -4 option lists only IPv4 rules (as the default before) while -6 continues to list only rules that affect IPv6. PR: 247952 Reported by: joeb1@a1poweruser.com MFC after: 1 week Notes: svn path=/head/; revision=363279
* fr_family (the protocol family) must be AF_INET or AF_INET6, as inCy Schubert2020-07-171-2/+2
| | | | | | | | | | | | | the kernel, not an arbitrary 4 or 6. This only affected printing ipfilter stats and rules from a kernel dump. (This is currently undocumented.) PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363278
* Only use the use_inet6 variable when INET6 is a build option.Cy Schubert2020-07-171-2/+12
| | | | | | | | | | | This is a prerequisite to upcoming argument processing cleanups which will resolve consistency as was done with ippool previously. PR: 247952 MFC after: 1 week Notes: svn path=/head/; revision=363277
* Per-rule hit counts (-h) can be used with either -i (input) or -o (output)Cy Schubert2020-06-021-2/+1
| | | | | | | | | filter rule lists. MFC after: 3 days Notes: svn path=/head/; revision=361721
* ipfilter: remove duplicate definition of 'thishost'Kyle Evans2020-03-292-2/+1
| | | | | | | | | | | | thishost is already defined in lib/initparse.c; no need for this one. This fixes the ipfilter build with -fno-common. -fno-common will become the default in GCC10/LLVM11. MFC after: 3 days Notes: svn path=/head/; revision=359413
* As with ipf(8), give ippool(8) the ability to load IP pools from multipleCy Schubert2020-02-182-2/+6
| | | | | | | | | | | files. This allows for loading, during the same invocation of ippool, of multiple sources of input using multiple tools to concurrently maintain the files such as fail2ban, macro preprocessors, and manually. MFC after: 1 week Notes: svn path=/head/; revision=358064
* Fix a typo (upto --> up to) and reword to improve word flow.Cy Schubert2019-12-021-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=355300
* Implement the dynamic add (-A) and removal (-R) of ippool poolsCy Schubert2019-09-272-8/+27
| | | | | | | | | | | | | | | | | | from the command line. Prior to this the functionality was mostly there however since the pool type (-t) was not recognized by the -A and -R command options -- not recognized by getopt(). Additionally the code to implement the dynamic add and removal of pools didn't work. When dynamically adding (-A) a pool a type (-t) to specify if the pool is a tree or hash pool must be specified. When dynamically removing (-R) a pool, omitting -t will cause a search-and-destroy which will remove both types of pools matching the name given (-m). PR: 218433 MFC after: 1 week Notes: svn path=/head/; revision=352786
* The no resolve (OPT_NORESOLVE) does nothing. Additionally, it (-R)Cy Schubert2019-09-271-12/+3
| | | | | | | | | | | conflicts with the command option of the same name (also -R). Remove the superfluous and confusing non-global non-command -R option. PR: 218433 MFC after: 1 week Notes: svn path=/head/; revision=352785
* Sync with source:Cy Schubert2019-09-271-5/+2
| | | | | | | | | | | | | | Only a role of "ipf" is currentlysupported as the other documented (and undocumented) roles are #ifdef'd out. The plan is to complete ippool(8) as it is even in its current state a powerful feature/tool. PR: 218433 MFC after: 1 month Notes: svn path=/head/; revision=352784
* Fix a typo.Cy Schubert2019-09-271-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=352783
* Teach the ippool parser about address families. This is a precursorCy Schubert2019-09-261-0/+16
| | | | | | | | | | to implementing IPv6 support within ippool which requires reworking radix_ipf.c. MFC after: 1 month Notes: svn path=/head/; revision=352738
* Fix a typo.Cy Schubert2019-06-281-1/+1
| | | | | | | | | PR: 238816 MFC after: 1 week X-MFC with: r349503 Notes: svn path=/head/; revision=349504
* Document the -B, binary logfile, and the -C config file options.Cy Schubert2019-06-281-1/+11
| | | | | | | | | | Reference the ipmon.5 man page and ipmon.conf. PR: 238816 MFC after: 1 week Notes: svn path=/head/; revision=349503
* Return a return code scripts might expect. I missed this whileCy Schubert2019-06-271-1/+1
| | | | | | | | | | | | | reviewing and rewriting a patch in PR/238816. PR: 238816 Reported by: rgrimes@ Pointy hat to: cy@ MFC after: 1 week X-MFC with: r349450 Notes: svn path=/head/; revision=349451
* Update usage() to refect the current state of ipmon.Cy Schubert2019-06-271-2/+5
| | | | | | | | PR: 238816 MFC after: 1 week Notes: svn path=/head/; revision=349450
* Fix a typo.Cy Schubert2019-06-271-1/+1
| | | | | | | | | | | PR/238816 initially addressed updates to usage() however it has now become a shopping list of fixes to ipmon man pages and usage(). PR: 238816 MFC after: 3 days Notes: svn path=/head/; revision=349448
* Kernel module shim sources have no business being in the userlandCy Schubert2019-02-0312-3050/+0
| | | | | | | | | | | | | | | | | | | build directory, especially those for other operating systems. The kernel module shims for other operating systems are hereby removed. The kernel module shim for FreeBSD, mlfk_ipl.c, is already in sys/contrib/ipfilter/netinet. The one here is never used and should not be in the userland build directory either. mlfk_rule.c isn't used either however we will keep it in case someone wishes to use this shim to load rules via a kernel module, handy for embedded. In that case it should be copied to sys/contrib/ipfilter/netinet and a Makefile created to employ it. (Probably a useful documentation project when time permits.) MFC after: 1 month Notes: svn path=/head/; revision=343704
* Remove a redundant ip_compat.h, originally merged from upstream.Cy Schubert2019-02-031-126/+0
| | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=343702
* ipfilter #ifdef cleanup.Cy Schubert2019-02-0334-770/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove #ifdefs for ancient and irrelevant operating systems from ipfilter. When ipfilter was written the UNIX and UNIX-like systems in use were diverse and plentiful. IRIX, Tru64 (OSF/1) don't exist any more. OpenBSD removed ipfilter shortly after the first time the ipfilter license terms changed in the early 2000's. ipfilter on AIX, HP/UX, and Linux never really caught on. Removal of code for operating systems that ipfilter will never run on again will simplify the code making it easier to fix bugs, complete partially implemented features, and extend ipfilter. Unsupported previous version FreeBSD code and some older NetBSD code has also been removed. What remains is supported FreeBSD, NetBSD, and illumos. FreeBSD and NetBSD have collaborated exchanging patches, while illumos has expressed willingness to have their ipfilter updated to 5.1.2, provided their zone-specific updates to their ipfilter are merged (which are of interest to FreeBSD to allow control of ipfilters in jails from the global zone). Reviewed by: glebius@ MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D19006 Notes: svn path=/head/; revision=343701
* Fix a typo.Cy Schubert2019-01-271-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=343486
* Remove redundant ipfilter version of pcap-bpf.h. As of r214535 it wasCy Schubert2019-01-161-687/+0
| | | | | | | | | no longer needed. MFC after: 1 week Notes: svn path=/head/; revision=343103
* Remove an IRIX-only source file.Cy Schubert2019-01-161-683/+0
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=343073
* Remove ipsd (IP Scan Detetor). It is unused and to my knowledge hasCy Schubert2019-01-0611-1768/+0
| | | | | | | | | | | never been used on any platform that ipfilter has been on. However it looks like it could be a useful utility, therefore there are plans to make it a port one day. It lacks a man page as well. MFC after: 1 month Notes: svn path=/head/; revision=342815
* TCP_PAWS_IDLE is does not exist in NetBSD and illumos. In FreeBSDCy Schubert2018-12-301-2/+0
| | | | | | | | | | | | TCP_PAWS_IDLE is defined in netinet/tcp_seq.h, however this header isn't included explicitly or implicitly at this point therefore as far ipfilter is concerned TCP_PAWS_IDLE is not defined. Remove the #ifdef and include netinet/tcp.h unconditionally. MFC after: 1 week Notes: svn path=/head/; revision=342605
* Remove an ugly Ultrix hack. Ultrix has been AWOL since the last iceCy Schubert2018-12-062-12/+12
| | | | | | | | | age, more to come. MFC after: 1 week Notes: svn path=/head/; revision=341650
* As part of the general cleanup of the ipfilter code, special casesCy Schubert2018-12-041-7/+0
| | | | | | | | | | | | | | | | | | | are committed separately to document fixing them separately from the general cleanup. In this case we don't want to hide the utter brokenness of what is being fixed. Clean up a discombobulated block of #if's, with one block unreachable. ip_fil.c is used in ipftest which is used to dry-run test ipfilter rules in userspace without loading them in the kernel. The call to (*ifp->if_output) matches that in the FreeBSD kernel. Further testing and work will be required to make ipftest fully functional. MFC after: 1 week Notes: svn path=/head/; revision=341456
* loadpoolfile() implements a -R (NORESOLVE) option which is not listedCy Schubert2017-08-051-1/+1
| | | | | | | in usage(). This commit trues up usage() with loadpoolfile(). Notes: svn path=/head/; revision=322075
* As in r315225, discard 3072 bytes of RC4 bytestream instead of 1024.Cy Schubert2017-07-271-2/+2
| | | | | | | | | | | | | PR: 217920 Submitted by: codarren@hackers.mu Reviewed by: emaste, cem Approved by: so (implicit, in r315225) MFC after: 1 week Differential Revision: D11747 Patterned after: r315225 Notes: svn path=/head/; revision=321605
* Document supported poollist() (ippool -l) options in usage() and inCy Schubert2017-07-052-2/+2
| | | | | | | ippool.8 man page. Notes: svn path=/head/; revision=320664
* Ansify entry and exit points.Cy Schubert2017-06-283-20/+16
| | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=320455
* In poolnodecommand() (ippool -a and ippool -r) -m (pool name) is notCy Schubert2017-06-281-1/+1
| | | | | | | optional. Notes: svn path=/head/; revision=320428
* Replace AF_INET6 ifdefs with USE_INET6 to be consistent with the restCy Schubert2017-06-271-2/+2
| | | | | | | of the ipfilter souce tree. Notes: svn path=/head/; revision=320395
* Replace AF_INET6 ifdefs with USE_INET6 ifdefs. This is more consistentCy Schubert2017-06-235-8/+6
| | | | | | | | | | and guaranteed to build everywhere in ipfilter. Not all of this commit can be MFCed. Some is original code while others are not. Notes: svn path=/head/; revision=320257
* In poolnodcommand(): TTL (-T) is only valid when adding a node to aCy Schubert2017-06-221-4/+8
| | | | | | | | pool (ippool -a) not when removing a node from a pool (ippool -r). Flag -T as an error in ippool -r. Notes: svn path=/head/; revision=320232
* poolflush() has no positional arguments.Cy Schubert2017-06-221-1/+1
| | | | Notes: svn path=/head/; revision=320221
generated by cgit v1.3 (git 2.53.0) at 2026-07-31 19:02:04 +0000