Remove the information about the new "scrub" syntax because that has been included in FreeBSD 14.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed Advanced Search
Advanced Search
Advanced Search
Sat, Nov 1
Sat, Nov 1
Thu, Oct 30
Thu, Oct 30
vegeta_tuxpowered.net committed rGee1f417a8609: pf: Check if source nodes use a valid redirection address (authored by vegeta_tuxpowered.net).
pf: Check if source nodes use a valid redirection address
vegeta_tuxpowered.net committed rG646798b67831: pf: Make nat-to and rdr-to work properly both on in and out rules (authored by vegeta_tuxpowered.net).
pf: Make nat-to and rdr-to work properly both on in and out rules
Wed, Oct 22
Wed, Oct 22
vegeta_tuxpowered.net updated the summary of D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
vegeta_tuxpowered.net updated the diff for D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
Don't forbid address translation on non-usual direction, since OpenBSD allows it too. Enable the test for nat-to on inbound direction.
vegeta_tuxpowered.net added inline comments to D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
Tue, Oct 21
Tue, Oct 21
vegeta_tuxpowered.net updated the diff for D53231: pf: Check if source nodes use a valid redirection address.
Assert the rpool.
vegeta_tuxpowered.net updated the diff for D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
Restore the proper patch
vegeta_tuxpowered.net added inline comments to D53231: pf: Check if source nodes use a valid redirection address.
vegeta_tuxpowered.net requested review of D53231: pf: Check if source nodes use a valid redirection address.
Mon, Oct 20
Mon, Oct 20
vegeta_tuxpowered.net added inline comments to D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
vegeta_tuxpowered.net updated the summary of D53216: pf: Make nat-to and rdr-to work properly both on in and out rules.
Oct 1 2025
Oct 1 2025
vegeta_tuxpowered.net committed rG013708fd3167: pf: Fix rule and state counters (authored by vegeta_tuxpowered.net).
pf: Fix rule and state counters
vegeta_tuxpowered.net committed rGad428a318b60: pf: Fix interface counters for af-to rules (authored by vegeta_tuxpowered.net).
pf: Fix interface counters for af-to rules
vegeta_tuxpowered.net committed rG048b8123ee87: pf: Always skip outbound filtering for inbound af-to rules (authored by vegeta_tuxpowered.net).
pf: Always skip outbound filtering for inbound af-to rules
vegeta_tuxpowered.net committed rGf12dba5d1746: pf: Fix interface binding for af-to with route-to (authored by vegeta_tuxpowered.net).
pf: Fix interface binding for af-to with route-to
vegeta_tuxpowered.net committed rGe345fb2e91bc: pf: Add pfsync protocol for FreeBSD 15 (authored by vegeta_tuxpowered.net).
pf: Add pfsync protocol for FreeBSD 15
Sep 28 2025
Sep 28 2025
vegeta_tuxpowered.net committed rG7cd3854f827f: pf: Fix interface counters for af-to rules (authored by vegeta_tuxpowered.net).
pf: Fix interface counters for af-to rules
vegeta_tuxpowered.net committed rG6353f5d9a5c6: pf: Fix rule and state counters (authored by vegeta_tuxpowered.net).
pf: Fix rule and state counters
vegeta_tuxpowered.net committed rG938ae26ffda8: pf: Always skip outbound filtering for inbound af-to rules (authored by vegeta_tuxpowered.net).
pf: Always skip outbound filtering for inbound af-to rules
Sep 23 2025
Sep 23 2025
vegeta_tuxpowered.net committed rG42441d342071: pf: Fix interface binding for af-to with route-to (authored by vegeta_tuxpowered.net).
pf: Fix interface binding for af-to with route-to
vegeta_tuxpowered.net committed rG99475087d63b: pf: Add pfsync protocol for FreeBSD 15 (authored by vegeta_tuxpowered.net).
pf: Add pfsync protocol for FreeBSD 15
Sep 17 2025
Sep 17 2025
vegeta_tuxpowered.net added inline comments to D52445: pf: Fix interface binding for af-to with route-to.
vegeta_tuxpowered.net updated the diff for D52445: pf: Fix interface binding for af-to with route-to.
Sep 16 2025
Sep 16 2025
vegeta_tuxpowered.net added inline comments to D52445: pf: Fix interface binding for af-to with route-to.
Sep 9 2025
Sep 9 2025
Fix the altq_queues test.
Update the man page for pfsync.
Fix struct alignment. Add a test for rt_af, document why it can't check all cases yet.
vegeta_tuxpowered.net requested review of D52446: pf: Always skip outbound filtering for inbound af-to rules.
vegeta_tuxpowered.net requested review of D52445: pf: Fix interface binding for af-to with route-to.
Aug 30 2025
Aug 30 2025
Aug 29 2025
Aug 29 2025
vegeta_tuxpowered.net committed rG65c318630123: pf: Add prefer-ipv6-nexthop option for route-to pools (authored by vegeta_tuxpowered.net).
pf: Add prefer-ipv6-nexthop option for route-to pools
Aug 28 2025
Aug 28 2025
Remove syncing of altq queue names, sync their IDs instead. The queue names are very long and if queues are kept identical on both routers, it will still work fine. Improve locking in tagname2tag().
Aug 27 2025
Aug 27 2025
Aug 22 2025
Aug 22 2025
vegeta_tuxpowered.net updated the diff for D50781: pf: Add prefer-ipv6-nexthop option for route-to pools.
Fixed spelling mistakes, added pfctl tests.
Aug 8 2025
Aug 8 2025
vegeta_tuxpowered.net retitled D50781: pf: Add prefer-ipv6-nexthop option for route-to pools from pf: Add RFC5549 support for route-to to pf: Add prefer-ipv6-nexthop option for route-to pools.
vegeta_tuxpowered.net updated the diff for D50781: pf: Add prefer-ipv6-nexthop option for route-to pools.
Aug 7 2025
Aug 7 2025
vegeta_tuxpowered.net retitled D51797: [pfil loop prevention experiment 1/5] pf tests: Add tests for syncookies and synproxy with route-to from pfil loop prevention experiment ; pf tests: Add tests for syncookies and synproxy with route-to to [pfil loop prevention experiment 1/5] pf tests: Add tests for syncookies and synproxy with route-to.
In D51789#1183098, @kp wrote:No objection, but things just build even on LINT-NOINET6 kernels without this change, so I'm not sure what the motivation is.
vegeta_tuxpowered.net committed rG5bbdd368c7b1: pf tests: Improve tests for af-to (authored by vegeta_tuxpowered.net).
pf tests: Improve tests for af-to
Aug 5 2025
Aug 5 2025
Aug 1 2025
Aug 1 2025
vegeta_tuxpowered.net committed rGd2761422eb0a: pf: Use different address family for source and redirection address (authored by vegeta_tuxpowered.net).
pf: Use different address family for source and redirection address
vegeta_tuxpowered.net committed rG539da08f5567: pfctl: Use sa_family_t for af instead of int (authored by vegeta_tuxpowered.net).
pfctl: Use sa_family_t for af instead of int
vegeta_tuxpowered.net updated the summary of D51659: pf: Use different address family for source and redirection address.
vegeta_tuxpowered.net updated the diff for D51659: pf: Use different address family for source and redirection address.
Trim too long lines, update comments.
Jul 31 2025
Jul 31 2025
Jul 13 2025
Jul 13 2025
vegeta_tuxpowered.net committed rG2b2ac1aa9a34: pf tests: Fix rdr pass test to really use 'pass … rdr-to' syntax (authored by vegeta_tuxpowered.net).
pf tests: Fix rdr pass test to really use 'pass … rdr-to' syntax
vegeta_tuxpowered.net committed rGc46bf1e3c9c5: pf tests: Add jail configuration for route_to and ipv6-nexthop tests (authored by vegeta_tuxpowered.net).
pf tests: Add jail configuration for route_to and ipv6-nexthop tests
vegeta_tuxpowered.net committed rG04dcbb44340f: pf: Prevent infinite looping over tables in round-robin pools (authored by vegeta_tuxpowered.net).
pf: Prevent infinite looping over tables in round-robin pools
vegeta_tuxpowered.net committed rGcbd06dd2afd5: pf: Fix error handling when pf_map_addr() fails (authored by vegeta_tuxpowered.net).
pf: Fix error handling when pf_map_addr() fails
Jul 12 2025
Jul 12 2025
vegeta_tuxpowered.net added inline comments to D50763: pf: Fix error handling when pf_map_addr() fails.
I have pushed the commit without proper footer by mistake, so I'm closing this manually.
vegeta_tuxpowered.net committed rG16a9f31b8aae: pf: Don't access sk and nk before they are allocated (authored by vegeta_tuxpowered.net).
pf: Don't access sk and nk before they are allocated
vegeta_tuxpowered.net committed rGdedb4d3597e5: pf: Don't return src node and hash from pf_map_addr_sn (authored by vegeta_tuxpowered.net).
pf: Don't return src node and hash from pf_map_addr_sn
Jul 4 2025
Jul 4 2025
vegeta_tuxpowered.net added a comment to D50781: pf: Add prefer-ipv6-nexthop option for route-to pools.
In D50781#1159156, @kp wrote:really dislike the 'RFC5549' naming of the flag and variables. Unfortunately I don't immediately have a better suggestion.
Jun 10 2025
Jun 10 2025