pfctl.8: explicitly mention that at least one option is required

zap one redundant line, replacing it with a note that although
SYNOPSIS suggests no options are neccessary, in fact a minimum of one

pfctl.8: explicitly mention that at least one option is required

zap one redundant line, replacing it with a note that although
SYNOPSIS suggests no options are neccessary, in fact a minimum of one
is required;

ok henning

Obtained from: OpenBSD, jmc <jmc@openbsd.org>, 123a76b4bf
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pfctl.8: describe the counters that "pfctl -s info" displays

Tweaks jmc@, ok deraadt@

Obtained from: OpenBSD, sthen <sthen@openbsd.org>, 83e508aa68
Sponsored by: Rubicon Communications, LLC ("Netga

pfctl.8: describe the counters that "pfctl -s info" displays

Tweaks jmc@, ok deraadt@

Obtained from: OpenBSD, sthen <sthen@openbsd.org>, 83e508aa68
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pfctl: add -T `reset` to touch pfras_tzero only for non-zero entries

This will make it easier for scripts to detect idle hosts in tables.

PR: 282984
Reviewed by: kp
MFC after: 2 weeks

pfctl: clear statistic for specified addresses

The ioctl DIOCRCLRASTATS provides the functionality of clearing stats
not only for the whole table for for addresses stored in that table. The
function

pfctl: clear statistic for specified addresses

The ioctl DIOCRCLRASTATS provides the functionality of clearing stats
not only for the whole table for for addresses stored in that table. The
functionality was missing from pfctl, though. Add it now.

PR: 282877
Obtained from: OpenBSD, kirill <kirill@openbsd.org>, e496dff3a7
MFC after: 3 weeks

show more ...

pfctl: Allow a semicolon (;) as a comment

To make parsing of, for example, Spamhaus' drop.txt and similar
files that contains semicolons as comments, allow them also
in file-based tables.

Reviewed

pfctl: Allow a semicolon (;) as a comment

To make parsing of, for example, Spamhaus' drop.txt and similar
files that contains semicolons as comments, allow them also
in file-based tables.

Reviewed by: kp
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D46088

show more ...

pf: allow states to be killed by their pre-NAT address

If a connection is NAT-ed we could previously only terminate it by its
ID or the post-NAT IP address. Allow users to specify they want look for

pf: allow states to be killed by their pre-NAT address

If a connection is NAT-ed we could previously only terminate it by its
ID or the post-NAT IP address. Allow users to specify they want look for
the state by its pre-NAT address. Usage: `pfctl -k nat -k <address>`.

See also: https://redmine.pfsense.org/issues/11556
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D42312

show more ...

Remove $FreeBSD$: two-line nroff pattern

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

pfctl.8: Use the serial comma

Pointed out by: Pau Amma.
Sponsored by: Rubicon Communications, LLC ("Netgate")

pfctl: support flushing ethernet rules

Sponsored by: Rubicon Communications, LLC ("Netgate")

pfctl: Document displaying Ethernet rules

Document the new 'pfctl -s ether' functionality.

Reviewed by: bcr
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://revi

pfctl: Document displaying Ethernet rules

Document the new 'pfctl -s ether' functionality.

Reviewed by: bcr
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D31750

show more ...

pf: Support killing 'matching' states

Optionally also kill states that match (i.e. are the NATed state or
opposite direction state entry for) the state we're killing.

See also https://redmine.pfsen

pf: Support killing 'matching' states

Optionally also kill states that match (i.e. are the NATed state or
opposite direction state entry for) the state we're killing.

See also https://redmine.pfsense.org/issues/8555

Submitted by: Steven Brown
Reviewed by: bcr (man page)
Obtained from: https://github.com/pfsense/FreeBSD-src/pull/11/
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D30092

show more ...

pf: Allow states to by killed per 'gateway'

This allows us to kill states created from a rule with route-to/reply-to
set. This is particularly useful in multi-wan setups, where one of the
WAN links

pf: Allow states to by killed per 'gateway'

This allows us to kill states created from a rule with route-to/reply-to
set. This is particularly useful in multi-wan setups, where one of the
WAN links goes down.

Submitted by: Steven Brown
Obtained from: https://github.com/pfsense/FreeBSD-src/pull/11/
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D30058

show more ...

pf: Return non-zero from 'status' if pf is not enabled

In the pf rc.d script the output of `/etc/rc.d/pf status` or `/etc/rc.d/pf
onestatus` always provided an exit status of zero. This made it fidd

pf: Return non-zero from 'status' if pf is not enabled

In the pf rc.d script the output of `/etc/rc.d/pf status` or `/etc/rc.d/pf
onestatus` always provided an exit status of zero. This made it fiddly to
programmatically determine if pf was running or not.

Return a non-zero status if the pf module is not loaded, extend pfctl to have
an option to return an error status if pf is not enabled.

PR: 228632
Submitted by: James Park-Watt <jimmypw AT gmail.com>
MFC after: 1 week

show more ...

Merge ^/head r306412 through r306905.

Note the version PF first appeared in FreeBSD & from which version it was ported from.
Address the contractions raised by igor.

PR: 212574
Approved by: bcr (mentor)
MFC after: 4 days
Differential R

Note the version PF first appeared in FreeBSD & from which version it was ported from.
Address the contractions raised by igor.

PR: 212574
Approved by: bcr (mentor)
MFC after: 4 days
Differential Revision: https://reviews.freebsd.org/D8105

show more ...

IFC @r269962

Submitted by: Anish Gupta (akgupt3@gmail.com)

Merge head from 7/28

Sync to HEAD@r269943.

mdoc: remove superfluous paragraph macros.

Merge fresh head.

MFC @ r241285

IFC @ r242684

Sync from head

Minor mdoc fix.

o Create directory sys/netpfil, where all packet filters should
reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.

o Create directory sys/netpfil, where all packet filters should
reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.c -> sys/netpfil/pf/
sys/contrib/pf/net/*.h -> sys/net/
contrib/pf/pfctl/*.c -> sbin/pfctl
contrib/pf/pfctl/*.h -> sbin/pfctl
contrib/pf/pfctl/pfctl.8 -> sbin/pfctl
contrib/pf/pfctl/*.4 -> share/man/man4
contrib/pf/pfctl/*.5 -> share/man/man5

sys/netinet/ipfw -> sys/netpfil/ipfw

The arguable movement is pf/net/*.h -> sys/net. There are
future plans to refactor pf includes, so I decided not to
break things twice.

Not modified bits of pf left in contrib: authpf, ftp-proxy,
tftp-proxy, pflogd.

The ipfw(4) movement is planned to be merged to stable/9,
to make head and stable match.

Discussed with: bz, luigi

show more ...