User Details
- User Since
- Sep 6 2022, 11:10 AM (144 w, 2 d)
Tue, Jun 10
Mon, Jun 9
Fri, May 30
Apr 28 2025
Apr 27 2025
pf.conf(5): fixed a typo, updated date.
Apr 21 2025
Added binat support, modified pf.conf(5) man page to cover the new syntax, re-enabled a few more original OpenBSD pfctl tests.
Apr 7 2025
Mar 28 2025
Mar 25 2025
I have re-enabled OpenBSD tests. Some of them required modification to resolve port numbers to service names, include the "keep state" keyword, insert commas between table members, not auto-expand redirection table-like syntax into tables.
I've moved the tests back to pfctl.
Mar 21 2025
Mar 5 2025
Mar 4 2025
Mar 3 2025
Feb 27 2025
Fix too long lines and other syntax issues. Deduplicate calculation of src, dst, psrc, pdst for state tracking, which also fixes outbound NAT64 for UDP traffic.
Feb 24 2025
Feb 16 2025
Feb 13 2025
Feb 12 2025
Restored original variable names in libpfctl, added typedef for the enum.
Feb 11 2025
Source node locking issues have been solved in another review. This patch now covers only adding source node types.
Feb 6 2025
Feb 3 2025
Jan 28 2025
Dec 9 2024
Improve the situation a bit: force logging if state creation fails.
This isn't totally right as we'll end up logging the packet twice in
this case, but it's better than not logging the drop at all.
Dec 5 2024
Dec 4 2024
Improve some comments.
Dec 3 2024
Nov 29 2024
Restore the old value of _Static_assert(sizeof(struct pf_kstate))
Plug holes in pf_rule_actions
Nov 28 2024
Use style(9)-compliant boolean tests
As promised yesterday, I propose how to get further with simplifying source node handling. This is a draft/proposal, however it compiles and passes all tests, at least the ones not skipped, which for me are dummynet and altq, I need to revive my custom kernel config to get those running.
Change limited to bool. Fix one missing PF_SRC_NODE… macro.
Make pf_hashsrc() available from everywhere. Use PF_SRC_NODE… macros now that pf_hashsrc() is accessible. The OB1 error in pf_insert_src_node() is gone, adjust the tests accordingly. Simplify pf_src_connlimit() logic,
Nov 27 2024
Nov 26 2024
This patch only aims to fix issues with locking, not the other issues found in D39880 (which will require some modifications, as while writing this one, I found some issues with the 2 different paths reaching pf_map_addr_sn(), which D39880 does not take into account). I suppose it could be MFC'd into the currently maintained releases of FreeBSD after more testing.
Nov 22 2024
Nov 21 2024
There's no need for additional variable, time is used only once.
Nov 20 2024
This code suffers from very old OpenBSD idea of (ab)using the same data structure for in-kernel storage and communication with userspace over ioctl. There is no need for struct pf_threshold *t, as pfctl only displays its count and seconds properties. Instead of having a separate function nlattr_add_pf_threshold() with all its PF_TH_… variables we could just add new variables PF_SN_CONN_RATE_RATE and PF_SN_CONN_RATE_SECONDS directly into the source node. And rename PF_SN_CREATION to PF_SN_AGE since it's the age of the SN, calculated during the export, not its creation time, as stored in kernel.
Nov 19 2024
This is also broken on FreeBSD 14.
Nov 15 2024
Nov 13 2024
Closed by commit rG65b20771713c: pf tests: Simplify handling of pfctl -s