ipf: Fix some typos

Signed-off-by: Elyes Haouas <ehaouas@noos.fr>

sbin: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl

sbin: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.

Sponsored by: Netflix

show more ...

Remove $FreeBSD$: one-line .c comment pattern

Remove /^/[*/]\s*\$FreeBSD\$.*\n/

ipf/ipfstat: Fix typos

Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/653

ipf: Use C89 function definitions.

Reviewed by: zlei
Differential Revision: https://reviews.freebsd.org/D39523

ipfilter userland: Style(9) requires a space after return

Reported by: jrtc27
Fixes: 2582ae5740181e0d2bab10003d66ae91c9b56329
MFC after: 1 month

ipfilter userland: Fix whitespace errors

Replace leading spaces with a tabs on affected lines.

MFC after: 1 month

ipfilter userland: Remove trailing whitespace

MFC after: 1 month

ipfilter: Adjust userland returns to conform to style(9)

Adjust ipfilter's userland return statements to conform to style(9).

MFC after: 1 month

ipflter: ANSIfy userland function declarations

Convert ipfilter userland function declarations from K&R to ANSI. This
syncs our function declarations with NetBSD hg commit 75edcd7552a0
(apply our ch

ipflter: ANSIfy userland function declarations

Convert ipfilter userland function declarations from K&R to ANSI. This
syncs our function declarations with NetBSD hg commit 75edcd7552a0
(apply our changes). Though not copied from NetBSD, this change was
partially inspired by NetBSD's work and inspired by style(9).

Reviewed by: glebius (for #network)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D33595

show more ...

ipfilter: Move userland bits to sbin

Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sbin/ipf. Now that I'm
planning on implementing MSS cl

ipfilter: Move userland bits to sbin

Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sbin/ipf. Now that I'm
planning on implementing MSS clamping as in iptables it makes more
sense to move ipfilter to sbin.

This is the second of three commits of the ipfilter move.

Suggested by glebius on two occaions.

Suggested by and discussed with: glebius
Reviewed by: glebius, kp (for #network)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D33510

show more ...

ipfilter userland: Replace sprintf with range checking version (snprintf)

MFC after: 1 week

Retire the K&R/STD C __P prototype declarations.

In the old days when K&R C and STD C were each in use a workaround
(read hack) was required to allow the same code to work on each
without modificati

Retire the K&R/STD C __P prototype declarations.

In the old days when K&R C and STD C were each in use a workaround
(read hack) was required to allow the same code to work on each
without modification. All C compilers support STD C. We can finally
put the __P prototype to rest.

MFC after: 1 week

show more ...

-4 and -6 only make sense with -i, -o, and -t.

PR: 247952
MFC after: 1 week

The output from usage() need not contain usage for -t when STATETOP
is not compiled in.

PR: 247952
MFC after: 1 week

Make ipfstat -t header generic when IPv4 and IPv6 output are
displayed in the same display.

PR: 247952
MFC after: 1 week

ipfstat -t defaults to IPv4 output. Make consistent with ipfstat -i
and ipfstat -o where without an argument IPv4 and IPv6 states are
shown. Use -4 and -6 to limit the display to IPv4 or IPv6 respect

ipfstat -t defaults to IPv4 output. Make consistent with ipfstat -i
and ipfstat -o where without an argument IPv4 and IPv6 states are
shown. Use -4 and -6 to limit the display to IPv4 or IPv6 respectively.

PR: 247952
MFC after: 1 week

show more ...

Historically ipfstat listings and stats only listed IPv4 or IPv6 output.
ipfstat would list IPv4 outputs by default while -6 would produce IPv6
outputs. This commit combines the ipfstat -i and -o out

Historically ipfstat listings and stats only listed IPv4 or IPv6 output.
ipfstat would list IPv4 outputs by default while -6 would produce IPv6
outputs. This commit combines the ipfstat -i and -o outputs into one
listing of IPv4 and IPv6 rules. The -4 option lists only IPv4 rules
(as the default before) while -6 continues to list only rules that affect
IPv6.

PR: 247952
Reported by: joeb1@a1poweruser.com
MFC after: 1 week

show more ...

fr_family (the protocol family) must be AF_INET or AF_INET6, as in
the kernel, not an arbitrary 4 or 6.

This only affected printing ipfilter stats and rules from a kernel
dump. (This is currently un

fr_family (the protocol family) must be AF_INET or AF_INET6, as in
the kernel, not an arbitrary 4 or 6.

This only affected printing ipfilter stats and rules from a kernel
dump. (This is currently undocumented.)

PR: 247952
MFC after: 1 week

show more ...

Only use the use_inet6 variable when INET6 is a build option.

This is a prerequisite to upcoming argument processing cleanups which
will resolve consistency as was done with ippool previously.

PR:

Only use the use_inet6 variable when INET6 is a build option.

This is a prerequisite to upcoming argument processing cleanups which
will resolve consistency as was done with ippool previously.

PR: 247952
MFC after: 1 week

show more ...

ipfilter #ifdef cleanup.

Remove #ifdefs for ancient and irrelevant operating systems from
ipfilter.

When ipfilter was written the UNIX and UNIX-like systems in use
were diverse and plentiful. IRIX,

ipfilter #ifdef cleanup.

Remove #ifdefs for ancient and irrelevant operating systems from
ipfilter.

When ipfilter was written the UNIX and UNIX-like systems in use
were diverse and plentiful. IRIX, Tru64 (OSF/1) don't exist any
more. OpenBSD removed ipfilter shortly after the first time the
ipfilter license terms changed in the early 2000's. ipfilter on AIX,
HP/UX, and Linux never really caught on. Removal of code for operating
systems that ipfilter will never run on again will simplify the code
making it easier to fix bugs, complete partially implemented features,
and extend ipfilter.

Unsupported previous version FreeBSD code and some older NetBSD code
has also been removed.

What remains is supported FreeBSD, NetBSD, and illumos. FreeBSD and
NetBSD have collaborated exchanging patches, while illumos has expressed
willingness to have their ipfilter updated to 5.1.2, provided their
zone-specific updates to their ipfilter are merged (which are of interest
to FreeBSD to allow control of ipfilters in jails from the global zone).

Reviewed by: glebius@
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D19006

show more ...

calloc() and realloc() modernization.

This commit replaces calloc calls, which called calloc() as if it were
malloc() by allocating a multiple of objects as a sizeof multiplied by
the number of obje

calloc() and realloc() modernization.

This commit replaces calloc calls, which called calloc() as if it were
malloc() by allocating a multiple of objects as a sizeof multiplied by
the number of objects. The patch rectifies this by calling calloc() as
it was meant to be called.

This commit also replaces realloc() with reallocarray() in a similar
fashion as above. Instead of calculating the memory to reallocated
(changed) by multiplying sizeof by the number of objects, the sizeof
and number are passed as separate arguments to reallocarray(), letting
reallocarray() do the multiplication instead. Like the calloc()
adjustment above, this is approach is cleaner and more elegant than
than the previous code.

This has been tested on my production firewall and a laptop (also
running ipfilter).

Submitted by: pfg
MFC after: 6 weeks

show more ...

Update ipfilter 4.1.28 --> 5.1.2.

Approved by: glebius (mentor)
BSD Licensed by: Darren Reed <darrenr@reed.wattle.id.au> (author)

Pullup IPFilter 4.1.28 from the vendor branch into HEAD.

MFC after: 7 days

ipfstat should parse "any" when used with -D/-S command line options

PR: bin/113879
Submitted by: kabe@sra-tohoku.co.jp
Reviewed by: darrenr
Approved by: re