aboutsummaryrefslogtreecommitdiff
path: root/contrib/ipfilter/lib
Commit message (Collapse)AuthorAgeFilesLines
* ipfilter: Remove remaining unused bitsCy Schubert2021-12-201-443/+0
| | | | | | | | | | | Remove the remaining unused source files. These were never used. This is the last of a three commit series to move ipfilter. Discussed with: glebius Reviewed by: glebius, kp (for #network) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D33510
* ipfilter: Move userland bits to sbinCy Schubert2021-12-20142-12021/+0
| | | | | | | | | | | | | | | | Through fixes and improvements our ipfilter sources have diverged enough to warrant move from contrib into sbin/ipf. Now that I'm planning on implementing MSS clamping as in iptables it makes more sense to move ipfilter to sbin. This is the second of three commits of the ipfilter move. Suggested by glebius on two occaions. Suggested by and discussed with: glebius Reviewed by: glebius, kp (for #network) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D33510
* ipfilter userland: Replace sprintf with range checking version (snprintf)Cy Schubert2021-12-148-11/+11
| | | | MFC after: 1 week
* ipfilter printfieldhdr: remove set-but-not-unused varsCy Schubert2021-12-111-2/+1
| | | | MFC after: 3 days
* ipft_tx: remove set-but-not-unused varsCy Schubert2021-12-111-2/+0
| | | | MFC after: 3 days
* ipft_pc: remove set-but-not-unused varsCy Schubert2021-12-111-3/+0
| | | | MFC after: 3 days
* ipft_hx: remove set-but-not-unused varsCy Schubert2021-12-111-2/+0
| | | | MFC after: 3 days
* ipfilter(4): Fix a typo in an error messageGordon Bergling2021-12-041-1/+1
| | | | | | | | | - s/addresss/address/ This is a direct commit to contrib since the upstream is no longer active. MFC after: 3 days
* Simply FreeBSD check using __FreeBSD__ and remove OpenBSDCy Schubert2021-02-091-1/+1
| | | | MFC after: 1 week
* Retire the K&R/STD C __P prototype declarations.Cy Schubert2021-02-0216-68/+68
| | | | | | | | | In the old days when K&R C and STD C were each in use a workaround (read hack) was required to allow the same code to work on each without modification. All C compilers support STD C. We can finally put the __P prototype to rest. MFC after: 1 week
* ipfilter: Retire pre-standard C support.Cy Schubert2021-01-256-51/+4
| | | | | | | | All C compilers in 2021 support standard C and architectures that did not were retired long ago. Simplify by removing now redundant pre-standard C code. MFC after: 1 week
* Continued ipfilter #ifdef cleanup. The r343701 log entry contains aCy Schubert2020-10-271-1/+1
| | | | | | | | | complete description. MFC after: 3 days Notes: svn path=/head/; revision=367069
* ipfilter getifname ifdef cleanup.Cy Schubert2020-09-301-28/+1
| | | | | | | MFC after: 2 months Notes: svn path=/head/; revision=366286
* Resurrect ipfilter's getifname, replacing the stub with the realCy Schubert2020-09-301-11/+0
| | | | | | | | | function. MFC after: 2 months Notes: svn path=/head/; revision=366285
* ipfilter #ifdef cleanup.Cy Schubert2019-02-035-105/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove #ifdefs for ancient and irrelevant operating systems from ipfilter. When ipfilter was written the UNIX and UNIX-like systems in use were diverse and plentiful. IRIX, Tru64 (OSF/1) don't exist any more. OpenBSD removed ipfilter shortly after the first time the ipfilter license terms changed in the early 2000's. ipfilter on AIX, HP/UX, and Linux never really caught on. Removal of code for operating systems that ipfilter will never run on again will simplify the code making it easier to fix bugs, complete partially implemented features, and extend ipfilter. Unsupported previous version FreeBSD code and some older NetBSD code has also been removed. What remains is supported FreeBSD, NetBSD, and illumos. FreeBSD and NetBSD have collaborated exchanging patches, while illumos has expressed willingness to have their ipfilter updated to 5.1.2, provided their zone-specific updates to their ipfilter are merged (which are of interest to FreeBSD to allow control of ipfilters in jails from the global zone). Reviewed by: glebius@ MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D19006 Notes: svn path=/head/; revision=343701
* Ansify entry and exit points.Cy Schubert2017-06-283-20/+16
| | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=320455
* Replace AF_INET6 ifdefs with USE_INET6 ifdefs. This is more consistentCy Schubert2017-06-234-7/+5
| | | | | | | | | | and guaranteed to build everywhere in ipfilter. Not all of this commit can be MFCed. Some is original code while others are not. Notes: svn path=/head/; revision=320257
* Just like r318173, which was for outputting IPv6 addresses in treeCy Schubert2017-05-151-10/+39
| | | | | | | | | | | | | | | pools, implement outputting of IPv6 addresses in the ippool debug list of hash type pools (ippool -l -d -t hash). Currently IPv6 in ippool tree type pool handling is mostly implemented. This continues theseries of commits to remediate ippool. This will be MFCed with a yet to be committed series of fixes to ippool after it has been fully remediated. PR: 218433 Notes: svn path=/head/; revision=318284
* As of r318281, there is no need to put a colon (:) in the messageCy Schubert2017-05-141-1/+1
| | | | | | | | | | string. MFC after: 3 days X-MFC with: r318281 Notes: svn path=/head/; revision=318283
* Separate the ipfilter function/static string from the error with aCy Schubert2017-05-141-1/+1
| | | | | | | | | | colon (:) in error messages to assist the user in parsing out the error from where or which object the error message refers to. MFC after: 3 days Notes: svn path=/head/; revision=318281
* Add missing linefeed in debug output.Cy Schubert2017-05-121-1/+1
| | | | Notes: svn path=/head/; revision=318202
* Implement outputting of IPv6 addresses in the ippool debug list of treeCy Schubert2017-05-111-2/+24
| | | | | | | | | | | | | | type pools (ippool -l -d -t tree). Currently IPv6 in ippool tree type pool handling is partially implemented (meaning it doesn't work). This is the first of a series of commits to remediate ippool. This will be MFCed with a yet to be committed series of fixes to ippool after it has been fully remediated. PR: 218433 Notes: svn path=/head/; revision=318173
* Use warnx() to issue error message.Cy Schubert2017-04-161-1/+2
| | | | | | | | | Reported by: cem MFC after: 1 week X-MFC with: r316993, r316994 Notes: svn path=/head/; revision=316997
* Fix CID 1372601, possible NULL pointer dereference shouldCy Schubert2017-04-161-0/+4
| | | | | | | | | | reallocarray() fail. Reported by: Coverity CID 1372601 MFC after: 1 week Notes: svn path=/head/; revision=316993
* calloc() and realloc() modernization.Cy Schubert2017-03-162-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | This commit replaces calloc calls, which called calloc() as if it were malloc() by allocating a multiple of objects as a sizeof multiplied by the number of objects. The patch rectifies this by calling calloc() as it was meant to be called. This commit also replaces realloc() with reallocarray() in a similar fashion as above. Instead of calculating the memory to reallocated (changed) by multiplying sizeof by the number of objects, the sizeof and number are passed as separate arguments to reallocarray(), letting reallocarray() do the multiplication instead. Like the calloc() adjustment above, this is approach is cleaner and more elegant than than the previous code. This has been tested on my production firewall and a laptop (also running ipfilter). Submitted by: pfg MFC after: 6 weeks Notes: svn path=/head/; revision=315368
* Fix leak (free str before returning when ctx's calloc fails).Cy Schubert2017-03-031-1/+3
| | | | | | | | | | | Submitted by: trix_juniper.net (Tom Rix) Discovered by: clang's static analyzer MFC after: 4 days Relnotes: ngie Differential Revision: D9877 Notes: svn path=/head/; revision=314627
* Currently the fragment info is placed at the top of the linked listCy Schubert2017-01-261-0/+21
| | | | | | | | | | | | | | | | | | | | | under a shared read lock. This patch attempts to upgrade the lock to an exclusive write lock. If the exclusive write lock fails to be obtained, the current fragment is not placed at the head of the list. This portion of the patch was inspired by NetBSD ip_frag.c r1.4 (which effectively removed the section of code that performed the reordering). The patch to sys/contrib/ipfilter/netinet/ip_compat.h adds the MUTEX_TRY_UPGRADE macro to support the patch to ip_frag.c. The patch to contrib/ipfilter/lib/rwlock_emul.c supports this patch by emulating the mutex in userspace when exercised by ipftest(1). Inspired by: NetBSD ip_frag.c r1.4 MFC after: 1 month Notes: svn path=/head/; revision=312787
* Stop including if_var.h from userland.Gleb Smirnoff2015-04-061-3/+0
| | | | | | | Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=281143
* #536 ipnat can try to print rule as dstlist incorrectlyCy Schubert2014-09-221-2/+4
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.14), netbsd CVS repo (r1.3) Notes: svn path=/head/; revision=271972
* #553 gethost needs to zero entire IP address structureCy Schubert2014-09-221-0/+1
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.11) Notes: svn path=/head/; revision=271971
* ipv6 address for test.hosts.dots in wrong byte order.Cy Schubert2014-09-221-4/+4
| | | | | | | | Approved by: glebius (mentor) Obtained from: ipfilter CVS repo (r1.11), netbsd CVS repo (r1.5) Notes: svn path=/head/; revision=271970
* Unbreak with gcc.Sergey Kandaurov2014-07-131-0/+2
| | | | | | | I'm tired to see tinderbox spamming. Feel free to fix it your way. Notes: svn path=/head/; revision=268585
* Fix compile-time errors when NO_WERROR and WITHOUT_INET6_SUPPORTCy Schubert2014-07-054-4/+4
| | | | | | | | | | (NO_INET6) are specified. Approved by: glebius MFC after: 1 week Notes: svn path=/head/; revision=268286
* Update ipfilter 4.1.28 --> 5.1.2.Cy Schubert2013-09-06144-2167/+7220
|\ | | | | | | | | | | | | | | Approved by: glebius (mentor) BSD Licensed by: Darren Reed <darrenr@reed.wattle.id.au> (author) Notes: svn path=/head/; revision=255332
| * As per the developers handbook (5.3.1 step 1), prepare the vendor trees forCy Schubert2013-07-19114-9600/+0
| | | | | | | | | | | | | | | | | | | | | | import of new ipfilter vendor sources by flattening them. To keep the tags consistent with dist, the tags are also flattened. Approved by: glebius (Mentor) Notes: svn path=/vendor/ipfilter/dist/; revision=253467
* | - Prevent buffer overflow in IPFilter's load_http function used to loadStanislav Sedov2009-05-291-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipfilter tables via http by the user-level ippool utility. Previously the 1024-byte buffer used to store a http request coudld easily overflow if the length of the hostname part of the url passes exceeded 496 bytes. [1] - Use snprintf to prevent possieble buffer overflows in future. [2] - Do not try to close the descriptor twice on failure. [2] Reported by: Maksymilian Arciemowicz <cxib@securityreason.com> [1] Obtained from: NetBSD CVS [2] MFC after: 2 weeks Notes: svn path=/head/; revision=193043
* | 2020447 IPFilter's NAT can undo name server random port selectionDarren Reed2008-07-241-0/+2
| | | | | | | | | | | | | | | | | | Approved by: darrenr MFC after: 1 week Security: CERT VU#521769 Notes: svn path=/head/; revision=180778
* | Pullup IPFilter 4.1.28 from the vendor branch into HEAD.Darren Reed2007-10-184-20/+36
| | | | | | | | | | | | | | MFC after: 7 days Notes: svn path=/head/; revision=172776
* | This commit was generated by cvs2svn to compensate for changes in r172771,Darren Reed2007-10-183-14/+15
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=172772
| * Import IPFilter 4.1.28Darren Reed2007-10-187-34/+51
| | | | | | | | Notes: svn path=/vendor/ipfilter/dist/; revision=172771
* | Remove files no longer required to build IPFilterDarren Reed2007-06-0414-2169/+0
| | | | | | | | Notes: svn path=/head/; revision=170269
* | Merge IPFilter 4.1.23 back to HEADDarren Reed2007-06-0485-389/+465
| | | | | | | | | | | | | | See src/contrib/ipfilter/HISTORY for details of changes since 4.1.13 Notes: svn path=/head/; revision=170268
* | This commit was generated by cvs2svn to compensate for changes in r170263,Darren Reed2007-06-0412-32/+795
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=170264
| * Import IPFilter 4.1.23 to vendor branch.Darren Reed2007-06-0497-421/+1260
| | | | | | | | | | | | | | See src/contrib/ipfilter/HISTORY for details of changes since 4.1.13 Notes: svn path=/vendor/ipfilter/dist/; revision=170263
* | Resolve conflictsGuido van Rooij2006-08-1610-287/+68
| | | | | | | | | | | | | | MFC after: 1 weeks Notes: svn path=/head/; revision=161357
* | This commit was generated by cvs2svn to compensate for changes in r161351,Guido van Rooij2006-08-161-4/+0
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=161352
| * Import IP Filter 4.1.13Guido van Rooij2006-08-169-179/+68
| | | | | | | | Notes: svn path=/vendor/ipfilter/dist/; revision=161351
* | Resolve conflicts (and believe me...you don't want to know).Guido van Rooij2005-12-3078-155/+210
| | | | | | | | Notes: svn path=/head/; revision=153881
* | This commit was generated by cvs2svn to compensate for changes in r153877,Guido van Rooij2005-12-302-0/+54
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=153878
| * Import IP Filter 4.1.10Guido van Rooij2005-12-30104-367/+274
| | | | | | | | Notes: svn path=/vendor/ipfilter/dist/; revision=153877
generated by cgit v1.3 (git 2.53.0) at 2026-08-24 09:05:50 +0000