pf tests: test clearing counters for all addresses in a table

Basic test case so we exercise the DIOCRCLRTSTATS call.

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: fix test skipping when pf is not loaded

Two test cases in table.sh didn't call pft_init and thus didn't skip if pf is
not loaded.
The fragmentation_pass:v6_route_to test had the test body

pf tests: fix test skipping when pf is not loaded

Two test cases in table.sh didn't call pft_init and thus didn't skip if pf is
not loaded.
The fragmentation_pass:v6_route_to test had the test body in the cleanup
function, so got run even when pf was not loaded.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: verify that table counters work on match rules

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: check cleared time when zeroing stats for table addresses

Verify that we reset the cleared time when we zero an address' counters in
a table.

PR: 282877, 282984
Reviewed by: kp
MFC after

pf tests: check cleared time when zeroing stats for table addresses

Verify that we reset the cleared time when we zero an address' counters in
a table.

PR: 282877, 282984
Reviewed by: kp
MFC after: 2 weeks
Signed-off-by: Leonid Evdokimov <leon@darkk.net.ru>
Differential Revision: https://reviews.freebsd.org/D48242

show more ...

pfctl: add -T `reset` to touch pfras_tzero only for non-zero entries

This will make it easier for scripts to detect idle hosts in tables.

PR: 282984
Reviewed by: kp
MFC after: 2 weeks

pfctl: clear statistic for specified addresses

The ioctl DIOCRCLRASTATS provides the functionality of clearing stats
not only for the whole table for for addresses stored in that table. The
function

pfctl: clear statistic for specified addresses

The ioctl DIOCRCLRASTATS provides the functionality of clearing stats
not only for the whole table for for addresses stored in that table. The
functionality was missing from pfctl, though. Add it now.

PR: 282877
Obtained from: OpenBSD, kirill <kirill@openbsd.org>, e496dff3a7
MFC after: 3 weeks

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

pf: Add code to enable filtering for locally delivered packets

This is disabled by default since it potentially changes the behavior of
existing filter rule sets. To enable this extra filter for pac

pf: Add code to enable filtering for locally delivered packets

This is disabled by default since it potentially changes the behavior of
existing filter rule sets. To enable this extra filter for packets being
delivered locally, use:

sysctl net.pf.filter_local=1
service pf restart

PR: 268717
Reviewed-by: kp
MFC-after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D40373

show more ...

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

pf tests: Test per-anchor tables

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: remove a stray 'set -x'

'set -x' is very useful when debugging tests, but does not need to be
left in.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: Test adding counters to an existing table

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34132

pf tests: Test PR259689

We didn't populate dyncnt/tblcnt, so `pfctl -sr -vv` might not have the
table element count.

PR: 259689
MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netga

pf tests: Test PR259689

We didn't populate dyncnt/tblcnt, so `pfctl -sr -vv` might not have the
table element count.

PR: 259689
MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32893

show more ...

pf tests: Test using '<ifgroup>:network' in tables

MFC after: 1 week

pf tests: Test automatically generated tables

Add a test case where the pfctl optimizer will generate a table
automatically. These tables have long names, which we accidentally broke
in the nvlist A

pf tests: Test automatically generated tables

Add a test case where the pfctl optimizer will generate a table
automatically. These tables have long names, which we accidentally broke
in the nvlist ADDRULE ioctl.

Reviewed by: melifaro
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D29989

show more ...

pf tests: Test case for bug #251414

Changing a table from not having counters to having counters (or vice versa)
may trigger panics.

PR: 251414
MFC after: 1 week
Differential Revision: https://rev

pf tests: Test case for bug #251414

Changing a table from not having counters to having counters (or vice versa)
may trigger panics.

PR: 251414
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D27441

show more ...

ping: fix some man pages and tests after r368045

MFC-with: r368045

Add a basic table entry counter regression test.

Reviewed by: kp
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D24809