summaryrefslogtreecommitdiff
path: root/dist/ipf/tools
AgeCommit message (Collapse)Author
2012-09-15IPF 5.1.2 is in external/bsd/ipf and sys/external/bsd/ipf now;plunky
these files are obsolete
2012-02-15Back out the recent import of IPFilter 5.1.1 for the upcoming branch,riz
which will now have IPFilter 4.1.34. IPFilter 5.1.1 will be restored post-branch. ok: core, releng.
2012-02-02Compiler warning on a for loop that does not terminate correctlydarrenr
2012-01-31More printf format fixesmartin
2012-01-30Merge error - stale code from HEAD not removed.darrenr
2012-01-30Merge IPFilter 5.1.1 into HEADdarrenr
2012-01-30Import IPFilter 5.1.1darrenr
2011-02-24format string needs end of statement ; for previous commitplunky
2011-02-24define the format as a constant so that we don't break if sprintf is a macro.christos
XXX: make it so that sprintf is not a macro.
2010-04-17Commit IPFilter 4.1.34 to HEADdarrenr
2010-04-17Import IPFilter 4.1.34 into NetBSDdarrenr
4.1.34 - Release 11 March 2010 2964907 uninitialised use compile error 2959506 ipfstat does not display rules with compat 2949139 FR_T_BUILTIN masked out incorrectly 2937422 packets filtered with pools should not be cached 2935529 use of rules with tags leads to deadlock 2917501 whitespace cleanup required 2881514 in/out object functions not wired for compatibility 2841771 ipf/ippool rule maintenace bugs: memory leak, ref-counter bug 2839698 H.323 proxy does not clear fin_state/fin_nat
2009-08-20The type of iplf_count is u_int, not size_t, so print with %u, not %zu.he
2009-08-19Update head to version 4.1.33 from vendor branchdarrenr
2009-08-19Import IPFilter 4.1.33darrenr
4.1.33 - Release 16 August 2009 2837931 wrong mode selected in ipf program for hash-entries 2826168 load_http can make ippool core dump 2825150 IPL_LOGMAX used to index some arrays 2825084 ipv6 fragments should not be allowed past 64k 2824713 ipfstat top output alternates between entries and nothing 2824712 ipfstat top output is shows negative ttl 2820965 a single bad ipv6 extension header should not impact others 2818197 ignored fragment bits defined as being reserved 2817667 IPv6 fragment header verification needs attention 2817098 fr_getrulen() finds the wrong rule 2817096 fr_rulen is unused 2741019 Lingering states (Established/Listen - 5/0) in state table 2702887 use of PBR/fastroute causes panic with ipv6 2671913 regression test in7 fails to execute 2598625 parsing empty config file results in an error 2698656 test parsing empty config files 2597956 not all pointers in a clone are reset 2543934 nat_t gets assigned ifp too early 2535795 No need to always bump fr_ref 2535778 Bad IPv6 packets droped by default 2031730 4.1.31 Nat drops fragmented packets after the first 2214661 ipf does not handle IPv6 fragments 2473273 NAT removed before RST/ICMP sent 2216500 fin_state serves no purpose 2424604 adding random MD5 data causes panic 2304435 Ineffecient lock usage in logging 2216491 fin_nat serves little purpose 2055619 duplicating a free-d packet will fail 2042949 Excessive locking when creating nat_t 2035610 nat_update does not need to get locks 2214658 ipf mostly ignores locking in NetBSD 1979427 Memory leak in user utilities - token never freed (rel br) * SunOS4 does not have a curproc, but it does have u. * The fix for 2020447 generated random port numbers but not within the range specified in the map rule. Add in a regression test to verify that the "random" part works. 2020447 NAT can undo name server random port selection 1988795 NetBSD does not build with kernel malloc stats 1988782 fr_movequeue can take a short cut 1988669 first nat creation failure prevents further success 1988668 hostmap searching does not work properly * on some 64bit architectures (such as alpha), the addrfamily_t is packed differently, throwing off the calculations for adf_len * one too many READ_ENTERs in ip_sync code. * clean up fr_fastroute a little by removing some #ifdefs and pushing the code around a bit to use the same variables (NetBSD) * more recent NetBSDs use VOP related macros differently
2009-03-06eliminate hacky memory allocation that loses on 64 bit archs with alignmentchristos
issues.
2008-12-29fix suseconds_t formatchristos
2008-07-242020447 IPFilter's NAT can undo name server random port selectiondarrenr
2008-05-20Pullup IPFilter 4.1.29 from the vendor branch to HEAD.darrenr
See src/dist/ipf/HISTORY for a list of bug fixes since 4.1.23 (although a few are already in NetBSD)
2008-05-20Import IPFilter 4.1.29 to the vendor branchdarrenr
2007-09-17Fixed IPF bug #1767831martti
ipflog() & ipmon ignore IPv6 extension headers
2007-09-10Revert to previous, it was not working for me correctly...martti
2007-09-10Fixed IPF bug #1767831martti
ipflog() & ipmon ignore IPv6 extension headers Patch fetched from the SourceForge bug report.
2007-06-16Upgraded IPFilter to v4.1.23martin
2007-05-15Merge IP-Filter 4.1.22martin
2007-05-15Import IPFilter 4.1.22martin
2007-05-01Upgraded IPFilter to 4.1.20martti
2007-04-14Update IPFilter to version 4.1.19martin
2007-04-14Import IPFilter 4.1.19martin
2006-10-03Coverity CID 3013: Don't check for NULL after deref! (from Arnaud Lacombe)christos
2006-08-26PR/34286: Gene ENonymous: Increase YYSTACKSIZE so that we can handle hugechristos
pools.
2006-05-10quell GCC 4.1 uninitialised variable warnings.mrg
XXX: we should audit the tree for which old ones are no longer needed after getting the older compilers out of the tree..
2006-04-28Coverity CID 785: Prevent NULL pointer dereference if an appropriate groupchristos
is not found.
2006-04-18ipf -Z returns junk and/or can cause a panic (seen on solaris.)darrenr
2006-04-04Upgraded IPFilter to 4.1.13martti
2006-04-04Import IPFilter 4.1.13martti
2005-06-02appease gcc -Wuninitializedlukem
2005-04-03Upgraded IPFilter to 4.1.8martti
2005-02-20Reinstate the ntohs() on port numbers returned bu getport()dsl
2005-02-20Do not use bogus (long) casts and ntohl() on port numbers.martin
Only test for -1 error return from getport().
2005-02-19Upgraded IPFilter to 4.1.6martti
2005-02-19Import IPFilter 4.1.6martti
2005-02-08Upgraded IPFilter to 4.1.5martti
2005-02-08Import IPFilter 4.1.5martti
2005-01-10Fix compilation with -UUSE_INET6lukem
2004-12-16Expand out an unused byte to give each NAT rule a protocol version field,darrenr
allowing rules to be set to match only ipv4/ipv6. And so ipnat must be updated to actually set this field correctly but to keep things working for old versions of ipnat (that will set this to 0), make the ioctl handler "update" the 0 to a 4 to keep things working when people just upgrade kernels. This forces NAT rule matching to be limited to ipv4 only, here forward, fixing kern/28662
2004-11-21Fix a regression from 3.4 behaviour where the destination of a redirect ruledarrenr
could be either a hostname or an IP address (now it can only be an IP#)
2004-11-13Apply patch from Darren for the ctype() functions/macros.he
Encapsulates the ctype() functions so that the casts are centralized.
2004-10-30In going from 3.4.x to 4.1.x, "state-age" became "age" but the input grammardarrenr
did not allow for backwards compatibility. PR: kern/27590
2004-10-03Fix bin/25972 and actually add a token to generate the value IPNY_TCPUDPdarrenr
as expected by the grammar.
2004-10-03kern/27086 (should be bin/27086) - the "keep options" only allow one order,darrenr
not both as they should for proper backwards compatibility.