summaryrefslogtreecommitdiff
path: root/dist/ipf
AgeCommit message (Collapse)Author
2012-09-15IPF 5.1.2 is in external/bsd/ipf and sys/external/bsd/ipf now;plunky
these files are obsolete
2012-02-15Back out the recent import of IPFilter 5.1.1 for the upcoming branch,riz
which will now have IPFilter 4.1.34. IPFilter 5.1.1 will be restored post-branch. ok: core, releng.
2012-02-03Really skip the current line only if the comment is at the start.joerg
2012-02-02Compiler warning on a for loop that does not terminate correctlydarrenr
2012-01-31More printf format fixesmartin
2012-01-31Fix printf formats (those who can't decide wether to use casts or PRI*martin
macros do both in bogus combination)
2012-01-30Correct merge error from import.darrenr
2012-01-30Merge error - stale code from HEAD not removed.darrenr
2012-01-30Lost on importdarrenr
2012-01-30Lost on importdarrenr
2012-01-30Merge IPFilter 5.1.1 into HEADdarrenr
2012-01-30Import IPFilter 5.1.1darrenr
2012-01-02Fix typo, from Abhinav Upadhyay.wiz
2011-02-24format string needs end of statement ; for previous commitplunky
2011-02-24define the format as a constant so that we don't break if sprintf is a macro.christos
XXX: make it so that sprintf is not a macro.
2011-01-21Fix typo reported in PR 44429 by Ryo HAYASAKA.wiz
2010-06-01handle STDC and GNUC inline semantic differences by providing andplunky
using an EXTERN_INLINE definition for functions that are defined as inline but provide an externally callable reference. (these are externally called in ipftest)
2010-05-11Language fix: upto date -> up to date.mbalmer
2010-04-17ip_fil_compat.c is another file that needs to be both in src/dist/ipf anddarrenr
also in src/sys/dist/ipf/netinet
2010-04-17Commit IPFilter 4.1.34 to HEADdarrenr
2010-04-17Import IPFilter 4.1.34 into NetBSDdarrenr
4.1.34 - Release 11 March 2010 2964907 uninitialised use compile error 2959506 ipfstat does not display rules with compat 2949139 FR_T_BUILTIN masked out incorrectly 2937422 packets filtered with pools should not be cached 2935529 use of rules with tags leads to deadlock 2917501 whitespace cleanup required 2881514 in/out object functions not wired for compatibility 2841771 ipf/ippool rule maintenace bugs: memory leak, ref-counter bug 2839698 H.323 proxy does not clear fin_state/fin_nat
2009-10-15Fix markup.joerg
2009-08-22Duplicate .TP.joerg
2009-08-20The type of iplf_count is u_int, not size_t, so print with %u, not %zu.he
2009-08-19When preparing ipfilter to import, remove files that are not related todarrenr
NetBSD in any way (such as those for Linux, Solaris, etc.)
2009-08-19IPF 4.1.33martti
2009-08-19Update head to version 4.1.33 from vendor branchdarrenr
2009-08-19Import IPFilter 4.1.33darrenr
4.1.33 - Release 16 August 2009 2837931 wrong mode selected in ipf program for hash-entries 2826168 load_http can make ippool core dump 2825150 IPL_LOGMAX used to index some arrays 2825084 ipv6 fragments should not be allowed past 64k 2824713 ipfstat top output alternates between entries and nothing 2824712 ipfstat top output is shows negative ttl 2820965 a single bad ipv6 extension header should not impact others 2818197 ignored fragment bits defined as being reserved 2817667 IPv6 fragment header verification needs attention 2817098 fr_getrulen() finds the wrong rule 2817096 fr_rulen is unused 2741019 Lingering states (Established/Listen - 5/0) in state table 2702887 use of PBR/fastroute causes panic with ipv6 2671913 regression test in7 fails to execute 2598625 parsing empty config file results in an error 2698656 test parsing empty config files 2597956 not all pointers in a clone are reset 2543934 nat_t gets assigned ifp too early 2535795 No need to always bump fr_ref 2535778 Bad IPv6 packets droped by default 2031730 4.1.31 Nat drops fragmented packets after the first 2214661 ipf does not handle IPv6 fragments 2473273 NAT removed before RST/ICMP sent 2216500 fin_state serves no purpose 2424604 adding random MD5 data causes panic 2304435 Ineffecient lock usage in logging 2216491 fin_nat serves little purpose 2055619 duplicating a free-d packet will fail 2042949 Excessive locking when creating nat_t 2035610 nat_update does not need to get locks 2214658 ipf mostly ignores locking in NetBSD 1979427 Memory leak in user utilities - token never freed (rel br) * SunOS4 does not have a curproc, but it does have u. * The fix for 2020447 generated random port numbers but not within the range specified in the map rule. Add in a regression test to verify that the "random" part works. 2020447 NAT can undo name server random port selection 1988795 NetBSD does not build with kernel malloc stats 1988782 fr_movequeue can take a short cut 1988669 first nat creation failure prevents further success 1988668 hostmap searching does not work properly * on some 64bit architectures (such as alpha), the addrfamily_t is packed differently, throwing off the calculations for adf_len * one too many READ_ENTERs in ip_sync code. * clean up fr_fastroute a little by removing some #ifdefs and pushing the code around a bit to use the same variables (NetBSD) * more recent NetBSDs use VOP related macros differently
2009-07-02Fix two problems in a conditional:snj
- __NetBSD__Version__ -> __NetBSD_Version__ - ">= 599001200" -> "< 599001200" This worked on current because of the __ typo. Spotted by Geoff Wing.
2009-05-24More changes to improve kern_descrip.c.ad
- Avoid atomics in more places. - Remove the per-descriptor mutex, and just use filedesc_t::fd_lock. It was only being used to synchronize close, and in any case we needed to take fd_lock to free the descriptor slot. - Optimize certain paths for the <NDFDFILE case. - Sprinkle more comments and assertions. - Cache more stuff in filedesc_t. - Fix numerous minor bugs spotted along the way. - Restructure how the open files array is maintained, for clarity and so that we can eliminate the membar_consumer() call in fd_getfile(). This is mostly syntactic sugar; the main functional change is that fd_nfiles now lives alongside the open file array. Some measurements with libmicro: - simple file syscalls are like close() are between 1 to 10% faster. - some nice improvements, e.g. poll(1000) which is ~50% faster.
2009-05-08reorder code to avoid uninitalized variable.christos
2009-05-07- prevent buffer overflow from Maksymilian Arciemowicz (worst case was 1041christos
characters and we allocated only 1024. While here: - use snprintf to prevent this from happening in the future. - don't close fd twice on error. - pass unsigned char to ctype.h functions.
2009-03-17Fix bad TCP checksum in packets with IP option header.tsutsui
2009-03-06eliminate hacky memory allocation that loses on 64 bit archs with alignmentchristos
issues.
2008-12-29fix suseconds_t formatchristos
2008-10-20IPF 4.1.31 is outmartti
2008-08-12Not needed in NetBSDmartti
2008-07-242020447 IPFilter's NAT can undo name server random port selectiondarrenr
2008-05-20Pullup IPFilter 4.1.29 from the vendor branch to HEAD.darrenr
See src/dist/ipf/HISTORY for a list of bug fixes since 4.1.23 (although a few are already in NetBSD)
2008-05-20Import IPFilter 4.1.29 to the vendor branchdarrenr
2008-05-18Added instructions how I've updated IPF. This should make it easier for anyonemartti
to upgrade our in-tree IPF to the latest version...
2008-04-30Convert TNF licenses to new 2 clause variantmartin
2007-12-11Also escape $Header tags.lukem
2007-10-09two new hacks:mrg
- include <stdbool.h> so bool is available _KERNEL for sys/condvar.h - include <sys/mutex.h> before defining _KERNEL so it won't try to include <machine/intr.h> which isn't available to userland. fixes builds on sparc64.
2007-09-17Fixed IPF bug #1767831martti
ipflog() & ipmon ignore IPv6 extension headers
2007-09-10Revert to previous, it was not working for me correctly...martti
2007-09-10Fixed IPF bug #1767831martti
ipflog() & ipmon ignore IPv6 extension headers Patch fetched from the SourceForge bug report.
2007-06-16Upgraded IPFilter to v4.1.23martin
2007-06-16Import IPFilter 4.1.23martin
2007-06-04s/iplattach/ipfattach/ and s/ipldetach/ipfdetach/martti