src/contrib/ipfilter, branch releng/8.3

MFC: r207945

2010-07-03T09:42:15Z

Comment in the BUGS section header. Matches what's in ipfilter 5.10.

Fix a typo that causes the for loop to exit immediately. There's

2009-06-16T13:31:01Z

identical loop a few lines above. Reviewed by: sam Approved by: ed (mentor) Silence from: darrenr (maintainer)

- Prevent buffer overflow in IPFilter's load_http function used to load

2009-05-29T16:24:23Z

ipfilter tables via http by the user-level ippool utility. Previously the 1024-byte buffer used to store a http request coudld easily overflow if the length of the hostname part of the url passes exceeded 496 bytes. [1] - Use snprintf to prevent possieble buffer overflows in future. [2] - Do not try to close the descriptor twice on failure. [2] Reported by: Maksymilian Arciemowicz [1] Obtained from: NetBSD CVS [2] MFC after: 2 weeks

Remove udp and tcp includes not needed here.

2009-04-25T19:14:22Z

Tripped over by: a compile of an upcoming change MFC after: 1 month

This main goals of this project are:

2008-12-15T06:10:57Z

1. separating L2 tables (ARP, NDP) from the L3 routing tables 2. removing as much locking dependencies among these layers as possible to allow for some parallelism in the search operations 3. simplify the logic in the routing code, The most notable end result is the obsolescent of the route cloning (RTF_CLONING) concept, which translated into code reduction in both IPv4 ARP and IPv6 NDP related modules, and size reduction in struct rtentry{}. The change in design obsoletes the semantics of RTF_CLONING, RTF_WASCLONE and RTF_LLINFO routing flags. The userland applications such as "arp" and "ndp" have been modified to reflect those changes. The output from "netstat -r" shows only the routing entries. Quite a few developers have contributed to this project in the past: Glebius Smirnoff, Luigi Rizzo, Alessandro Cerri, and Andre Oppermann. And most recently: - Kip Macy revised the locking code completely, thus completing the last piece of the puzzle, Kip has also been conducting active functional testing - Sam Leffler has helped me improving/refactoring the code, and provided valuable reviews - Julian Elischer setup the perforce tree for me and has helped me maintaining that branch before the svn conversion

Fix build when WITHOUT_DYNAMICROOT is specified in src.conf(5).

2008-08-04T22:45:27Z

2020447 IPFilter's NAT can undo name server random port selection

2008-07-24T12:35:05Z

Approved by: darrenr MFC after: 1 week Security: CERT VU#521769

For unfathomable reasons, ipfilter abuses kernel data structures for its

2008-07-23T16:34:53Z

own purposes. To pull this off, it defines _KERNEL before including the headers where these structures are defined. This leads to no end of trouble when some of these headers, or other headers that they include, change, as demonstrated by r180755. The quick fix in this particular case is to define _WANT_FILE instead of _KERNEL, conditional on __FreeBSD__. A better long-term fix is left as an exercise to the reader.

Pullup IPFilter 4.1.28 from the vendor branch into HEAD.

2007-10-18T21:52:14Z

MFC after: 7 days

This commit was generated by cvs2svn to compensate for changes in r172771,

2007-10-18T21:42:51Z

which included commits to RCS files with non-trunk default branches.