summaryrefslogtreecommitdiff
path: root/usr.sbin/pf
AgeCommit message (Collapse)Author
2023-06-03adapt to ${CC_WNO_ADDRESS_OF_PACKED_MEMBER}lukem
Simplify CWARNFLAGS to use ${CC_WNO_ADDRESS_OF_PACKED_MEMBER} which works for both clang and gcc, and remove compiler-specific equivalents.
2023-06-03bsd.own.mk: rename GCC_NO_* to CC_WNO_*lukem
Rename compiler-warning-disable variables from GCC_NO_warning to CC_WNO_warning where warning is the full warning name as used by the compiler. GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH Using the convention CC_compilerflag, where compilerflag is based on the full compiler flag name.
2023-06-03bsd.own.mk: rename to CC_WNO_ADDRESS_OF_PACKED_MEMBERlukem
Provide a single variable CC_WNO_ADDRESS_OF_PACKED_MEMBER with options for both clang and gcc, to replace CLANG_NO_ADDR_OF_PACKED_MEMBER CC_NO_ADDR_OF_PACKED_MEMBER GCC_NO_ADDR_OF_PACKED_MEMBER Using the convention CC_compilerflag, where compilerflag is based on the full compiler flag name.
2023-03-17s/enougth/enough/andvar
2021-04-12add some new uses of existing GCC_NO_* variables for warning issues.mrg
remove an no longer relevant for gcc7 workaround (works fine in both gcc9 and gcc 10.)
2020-09-06add support for new GCC 9 warnings that may be too much to fixmrg
right now. new address-of-packed-member and format-overflow warnings have new GCC_NO_ADDR_OF_PACKED_MEMBER amd GCC_NO_FORMAT_OVERFLOW variables to remove these warnings. apply to a bunch of the tree. mostly, these are real bugs that should be fixed, but in many cases, only by removing the 'packed' attribute from some structure that doesn't really need it. (i looked at many different ones, and while perhaps 60-80% were already properly aligned, it wasn't clear to me that the uses were always coming from sane data vs network alignment, so it doesn't seem safe to remove packed without careful research for each affect struct.) clang already warned (and was not erroring) for many of these cases, but gcc picked up dozens more.
2020-04-23lineno, states and allocated should be owned by the parserjoerg
2019-08-13sync with realitymaxv
2019-02-17pf.boot.conf: remove lingering references to dhclient(8), and whilegutteridge
here, capitalize acronyms. Addresses part of PR misc/53669.
2017-05-26Enable carp packets early during boot, to avoid gratuitous failovers.hauke
Okayed by christos@
2017-01-11Disable a couple of warnings until further investigation.joerg
2015-06-16improve error messages (remove \n, use __func__, etc)christos
2015-01-29use strtonum from libcchristos
2013-10-19fix unused variable warnings.christos
2013-04-10no need for the end macros anymorechristos
2013-02-09Disable -DWITH_NPF for now; will be converted to BPF mechanism.rmind
2012-09-15does not need -I${NETBSDSRCDIR}/sys/dist/ipf here, the include filesplunky
are installed in /usr/include/netinet
2011-12-21don't include pcap/bpf.hchristos
2011-08-31Use __deadjoerg
2011-05-26Default to -Wno-sign-compare -Wno-pointer-sign for clang.joerg
Push -Wno-array-bounds down to the cases that depend on it. Selectively disable warnings for 3rd party software or non-trivial issues to be reviewed later to get clang -Werror to build most of the tree.
2011-05-24No input neededjoerg
2011-02-04Fix sun2 builds. Noted by joerg@.rmind
2011-02-02NPF checkpoint:rmind
- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
2010-12-13fix build.christos
2010-05-09Remove trailing whitespace and dot in Nd.wiz
2010-05-09Add missing licensedegroote
2010-05-08Sort options, standardize SYNOPSIS, slight rewordings. Use more markup.wiz
2010-05-07Add support for pfs(8)degroote
pfs(8) is a tool similar to ipfs(8) but for pf(4). It allows the admin to dump internal configuration of pf, and restore at a latter point, after a maintenance reboot for example, in a transparent way for user. This work has been done mostly during my GSoC 2009 No objections on tech-net@
2009-09-14Import pfsync support from OpenBSD 4.2degroote
Pfsync interface exposes change in the pf(4) over a pseudo-interface, and can be used to synchronise different pf. This work was part of my 2009 GSoC No objection on tech-net@
2009-04-23WARNS=1 for pflukem
2009-04-22Enable WARNS=4 by default, except for:lukem
cpuctl dumplfs hprop ipf iprop-log kadmin kcm kdc kdigest kimpersonate kstash ktutil makefs ndbootd ntp pppd quot racoon racoonctl rtadvd sntp sup tcpdchk tcpdmatch tcpdump traceroute traceroute6 user veriexecgen wsmoused zic (Mostly third-party applications)
2008-06-20Install /etc/pf.os with 444 permissions.peter
Modify postinstall(8) to always upgrade /etc/pf.os. Suggested by Luke Mewburn in PR/35188.
2008-06-18merge yamt-pf42 branch.yamt
(import newer pf from OpenBSD 4.2) ok'ed by peter@. requested by core@
2007-09-02Use "ipv6-icmp" instead of "icmp6" to allow loading these rules again.tron
Patch supplied by Daniel Horecki in PR bin/36874.
2007-05-28Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on thetls
FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to various string and memory copy and set functions (as well as a few system calls and other miscellany) where known at function entry. RedHat has evidently built all "core system packages" with this option for some time. This option should be used at the top of Makefiles (or Makefile.inc where this is used for subdirectories) but after any setting of LIB. This is only useful for userland code, and cannot be used in libc or in any code which includes the libc internals, because it overrides certain libc functions with macros. Some effort has been made to make USE_FORT=yes work correctly for a full-system build by having the bsd.sys.mk logic disable the feature where it should not be used (libc, libssp iteself, the kernel) but no attempt has been made to build the entire system with USE_FORT and doing so will doubtless expose numerous bugs and misfeatures. Adjust the system build so that all programs and libraries that are setuid, directly handle network data (including serial comm data), perform authentication, or appear likely to have (or have a history of having) data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default, with the exception of libc, which cannot use USE_FORT and thus uses only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no per-directory or in a system build will disable if desired.
2006-11-09compile a file with -Wno-stack-protector since it is using __cmsg_alignbytes()christos
for a variable on the stack.
2006-10-26remove openlog_r/syslog_r; we now have it.christos
2006-04-25Build libpcap-0.9.4 from src/dist.drochner
While there are some open issues, particulary wrt support of old NetBSD-specific interfaces, it is better to get the code some public testing before NetBSD-4 is branched.
2006-01-10Fix mispelling in a comment.reed
2005-08-23pf needs to be started after the network is up, because some pf rulespeter
derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security
2005-06-27Remove (pf)spamd. Its right to exist in NetBSD has been questioned since itpeter
appeared and whether it's really part of pf or not is still unclear. Looking at the other *BSDs it seems that they have left out spamd when importing pf, and now we do that too. Also, the name conflicted with another more popular used tool, after the rename to pfspamd it was left with completely unusable documentation which apparently no-one wanted to fix. A port of the latest spamd will be imported into pkgsrc soon. Suggested by several people, no objections on last proposal on tech-userlevel.
2005-04-19Remove copy of manual page created during build.tron
2005-04-13Remove copy of manual page created during build.tron
2005-04-12Finally, spamlogd -> pfspamlogd, for consistency.jwise
2005-04-12spamd.conf is now pfspamd.conf.jwise
2005-04-12Now that we can override the name of /etc/spamd.conf, make it /etc/pfspamd.conf.jwise
2005-04-12Pass in path to /etc/spamd.conf in CPPFLAGS.jwise
2005-04-12Now that we can specify the chroot location, make it /var/chroot/pfspamd.jwise
2005-04-12Pass in a value for SPAMD_CHROOT in CPPFLAGS, to specify the path to thejwise
chroot dir spamd will use.
2005-04-11Per discussion on tech-userlevel and tech-security, install `spamd',jwise
`spamd-setup', and `spamdb' as `pfspamd', `pfspamd-setup', and `pfspamdb'. To quote Steven M. Bellovin: This [having a program in basesrc with the same name as a widely used and completely different program in pkgsrc] is a seriously bad idea; it violates the rule of least surprise. That's bad enough in normal situations; here, we're talking about security. You do *not* want to confuse people about security features; they're hard enough to get right as is.