| fc353e5e | 14-Jan-2026 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: allow new page character (^L) in pf.conf
PF configuration files can contains many things.
Using the new page characters (i.e. ^L, \014) to mark the beginning of parts is useful because many
pfctl: allow new page character (^L) in pf.conf
PF configuration files can contains many things.
Using the new page characters (i.e. ^L, \014) to mark the beginning of parts is useful because many editors such as emacs and vim has facilities to jump next/previous ones.
PR: 86635 MFC after: 2 weeks Submitted by: MOROHOSHI Akihiko <moro@remus.dti.ne.jp> Submitted by: Simon Wollwage <rootnode+freebsd@wollwage.com> Sponsored by: Rubicon Communications, LLC ("Netgate")
show more ...
|
| e28dfd6b | 12-Jan-2026 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: make the source limiter output match the input
When printing source limiters use the same keywords as we accept on input, that is use 'entries' for the entries value (not 'limit') and 'limit'
pfctl: make the source limiter output match the input
When printing source limiters use the same keywords as we accept on input, that is use 'entries' for the entries value (not 'limit') and 'limit' for the limit value (and not 'states').
Update the test case to match.
Sponsored by: Rubicon Communications, LLC ("Netgate")
show more ...
|
| 8716d8c7 | 12-Jan-2026 |
Kristof Provost <kp@FreeBSD.org> |
pf: configurable action on limiter exceeded
This change extends pf(4) limiters so administrator can specify action the rule executes when limit is reached. By default when limit is reached the limit
pf: configurable action on limiter exceeded
This change extends pf(4) limiters so administrator can specify action the rule executes when limit is reached. By default when limit is reached the limiter overrides action specified by rule to no-match. If administrator wants to block packet instead then rule with limiter should be changed to:
pass in from any to any state limiter test (block)
OK dlg@
Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 04394254d9 Sponsored by: Rubicon Communications, LLC ("Netgate")
show more ...
|
| 68fe0d9c | 08-Jul-2025 |
Siva Mahadevan <me@svmhdvn.name> |
pfctl tests: use require.kmods instead of manual check for pf
Reviewed by: kp Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/fr
pfctl tests: use require.kmods instead of manual check for pf
Reviewed by: kp Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/1762
show more ...
|
| 0a376f7e | 09-Apr-2025 |
Kristof Provost <kp@FreeBSD.org> |
pfctl: route-to, dup-to, reply-to should not override the block action
Spotted by Dilli Paudel <dilli ! paudel at oracle ! com>
ok jung@, ok mikeb@
Add a pfctl test case to ensure this doesn't reg
pfctl: route-to, dup-to, reply-to should not override the block action
Spotted by Dilli Paudel <dilli ! paudel at oracle ! com>
ok jung@, ok mikeb@
Add a pfctl test case to ensure this doesn't regress.
Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 1ae008c822 Sponsored by: Rubicon Communications, LLC ("Netgate")
show more ...
|
| 7a372bde | 22-Jan-2025 |
Kristof Provost <kp@FreeBSD.org> |
pf: make reply-to work with nat64
Just like route-to reply-to is problematic when used in combination with nat64.
In the normal (i.e. without nat64) flow we return immediately from pf_route(). Howe
pf: make reply-to work with nat64
Just like route-to reply-to is problematic when used in combination with nat64.
In the normal (i.e. without nat64) flow we return immediately from pf_route(). However, with nat64 we need to continue and do a route lookup. In that case we should not make the extra pf_test(PF_OUT) call to remain similar to the non-nat64 flow.
We also have to fix the interface binding. We can only bind to the interface after we've done the route lookup, not before.
Add a funcional test case, and a test for pfctl's rule printing.
Sponsored by: Rubicon Communications, LLC ("Netgate")
show more ...
|