Page MenuHomeFreeBSD

vegeta_tuxpowered.net (Kajetan Staszkiewicz)
User

Projects

User does not belong to any projects.

User Details

User Since
Sep 6 2022, 11:10 AM (77 w, 22 h)

Recent Activity

Tue, Feb 13

vegeta_tuxpowered.net abandoned D43866: pf: Fix match_rules memory leak.
In D43866#1000864, @kp wrote:

I failed to apply this patch, and I think it's because you already fixed this problem in https://cgit.freebsd.org/src/commit/?id=4d19eceaefb7106d761bc9504bb0da737ae0d674

Or am I missing something else?

Tue, Feb 13, 9:25 PM
vegeta_tuxpowered.net abandoned D43867: pf: Fix match_rules memory leak.

This is a duplicate.

Tue, Feb 13, 4:47 PM
vegeta_tuxpowered.net requested review of D43867: pf: Fix match_rules memory leak.
Tue, Feb 13, 4:41 PM
vegeta_tuxpowered.net requested review of D43866: pf: Fix match_rules memory leak.
Tue, Feb 13, 4:40 PM
vegeta_tuxpowered.net updated the diff for D43862: pfsync: Fix offset calculation.

pfsync: Fix offset calculation

Tue, Feb 13, 4:32 PM
vegeta_tuxpowered.net added a reviewer for D43862: pfsync: Fix offset calculation: kp.
Tue, Feb 13, 9:42 AM
vegeta_tuxpowered.net requested review of D43862: pfsync: Fix offset calculation.
Tue, Feb 13, 9:17 AM

Mon, Feb 5

vegeta_tuxpowered.net updated the summary of D43741: pf: Ensure that st->kif is obtained in a way which respects the r->rpool->mtx mutex.
Mon, Feb 5, 10:15 AM
vegeta_tuxpowered.net updated the diff for D43741: pf: Ensure that st->kif is obtained in a way which respects the r->rpool->mtx mutex.

A slightly less invasive patch.

Mon, Feb 5, 10:15 AM

Sun, Feb 4

vegeta_tuxpowered.net requested review of D43741: pf: Ensure that st->kif is obtained in a way which respects the r->rpool->mtx mutex.
Sun, Feb 4, 9:01 PM

Oct 26 2023

vegeta_tuxpowered.net updated the summary of D42354: pf tests: Add option to send fragmented packets.
Oct 26 2023, 1:05 PM
vegeta_tuxpowered.net added a comment to D42363: pf tests: Fix missing pf enabling.
In D42363#966766, @kp wrote:

The bug is in D42355, where we remove part of this test case, including the pfctl -e.
This fixes it, but I'm going to squash this together with the other review to keep the history simpler.

Oct 26 2023, 1:05 PM
vegeta_tuxpowered.net added a comment to D42355: pf: Fix packet reassembly.
In D42355#966767, @kp wrote:

Is this Sponsored by: InnoGames GmbH?

Oct 26 2023, 1:03 PM

Oct 25 2023

vegeta_tuxpowered.net added a comment to D42355: pf: Fix packet reassembly.
In D42355#966621, @kp wrote:

I've not yet investigated why, but I'm seeing a lot of failures with both of these patches:

fragmentation_compat:reassemble  ->  failed: atf-check failed; see the output of the test for details  [1.535s]
…
Oct 25 2023, 5:48 PM
vegeta_tuxpowered.net requested review of D42363: pf tests: Fix missing pf enabling.
Oct 25 2023, 5:42 PM
vegeta_tuxpowered.net updated the diff for D42355: pf: Fix packet reassembly.

Fix test cleanups.

Oct 25 2023, 4:27 PM

Oct 24 2023

vegeta_tuxpowered.net requested review of D42355: pf: Fix packet reassembly.
Oct 24 2023, 8:05 PM
vegeta_tuxpowered.net requested review of D42354: pf tests: Add option to send fragmented packets.
Oct 24 2023, 7:56 PM

Oct 18 2023

vegeta_tuxpowered.net updated the diff for D42270: pf: Update documentation regarding matching, scrubbing and reassembly.
Oct 18 2023, 11:41 AM
vegeta_tuxpowered.net added inline comments to D42270: pf: Update documentation regarding matching, scrubbing and reassembly.
Oct 18 2023, 11:39 AM

Oct 17 2023

vegeta_tuxpowered.net updated the diff for D42270: pf: Update documentation regarding matching, scrubbing and reassembly.

Update man page's date.

Oct 17 2023, 6:45 PM
vegeta_tuxpowered.net requested review of D42270: pf: Update documentation regarding matching, scrubbing and reassembly.
Oct 17 2023, 6:35 PM

Oct 16 2023

vegeta_tuxpowered.net updated the diff for D42235: pfsync: Provide documentation regarding message version.

Remove pf.conf.5 changes added by mistake.

Oct 16 2023, 9:22 PM
vegeta_tuxpowered.net updated the summary of D42235: pfsync: Provide documentation regarding message version.
Oct 16 2023, 9:20 PM
vegeta_tuxpowered.net requested review of D42235: pfsync: Provide documentation regarding message version.
Oct 16 2023, 8:45 PM
vegeta_tuxpowered.net added a comment to D42214: 14.0 relnotes: additions to date.
In D42214#963332, @kp wrote:

https://ipv6.social/@tuxpowered/111239166771971768
pfsync format changed
@kp might be able to suggest a description

Possibly something like

The pfsync packet format has been extended to improve support for route-to rules. This format is incompatible with older releases. The old format can be selected using ifconfig pfsync0 version 1301. This is especially important if members of a pfsync cluster are not upgraded simultaneously.

Oct 16 2023, 6:00 PM

Oct 12 2023

vegeta_tuxpowered.net updated the summary of D42169: pf: Free pf_rule_items when state is not created.
Oct 12 2023, 4:20 PM
vegeta_tuxpowered.net requested review of D42169: pf: Free pf_rule_items when state is not created.
Oct 12 2023, 4:20 PM

Sep 28 2023

vegeta_tuxpowered.net accepted D42002: pf: add note about changes ported from OpenBSD after 4.5.
Sep 28 2023, 11:46 AM

Sep 13 2023

vegeta_tuxpowered.net added a comment to D41517: Draft: pf: Switch pf_route() to PACKET_TAG_IPFORWARD tag.
In D41517#953290, @kp wrote:

Yeah, I think you're taking the right direction here, but sadly I don't think we can get rid of the old behaviour right now.
One of the big users of route-to is pfSense's multi-wan support, where we basically have two default routes and pf is used to direct traffic down one or the other link.

Sep 13 2023, 8:28 AM

Sep 9 2023

vegeta_tuxpowered.net accepted D41779: pfsync: fix state leak.
Sep 9 2023, 7:51 PM

Aug 23 2023

vegeta_tuxpowered.net updated the test plan for D41570: pf: Access r->rpool.cur->kif under mutex protection.
Aug 23 2023, 11:13 PM
vegeta_tuxpowered.net requested review of D41570: pf: Access r->rpool.cur->kif under mutex protection.
Aug 23 2023, 11:13 PM
vegeta_tuxpowered.net added a comment to D41517: Draft: pf: Switch pf_route() to PACKET_TAG_IPFORWARD tag.
In D41517#946200, @kp wrote:

I'm generally in agreement that pf_route() approach isn't the best, but I'm also very, very afraid of making major changes there, because a lot of rulesets out there rely on it, and any change we make is going to break things and come with a pile of bug reports. My enthusiasm for wading through dozens of bug reports trying to understand if it's a configuration error, misguided setup or real bug is not particularly high.

Aug 23 2023, 9:33 AM

Aug 20 2023

vegeta_tuxpowered.net updated the summary of D41517: Draft: pf: Switch pf_route() to PACKET_TAG_IPFORWARD tag.
Aug 20 2023, 6:31 PM
vegeta_tuxpowered.net requested review of D41517: Draft: pf: Switch pf_route() to PACKET_TAG_IPFORWARD tag.
Aug 20 2023, 6:30 PM
vegeta_tuxpowered.net added a comment to D41502: pf: Enable the syncookie feature for IPv6 and reduce indentation.
In D41502#945945, @kp wrote:

Also, is this Sponsored by: InnoGames GmbH?

Aug 20 2023, 6:29 PM
vegeta_tuxpowered.net updated the diff for D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 20 2023, 2:50 PM

Aug 18 2023

vegeta_tuxpowered.net updated the diff for D41502: pf: Enable the syncookie feature for IPv6 and reduce indentation.

Add the missing "Respond to SYN with a syncookie" part.

Aug 18 2023, 6:12 PM
vegeta_tuxpowered.net updated the diff for D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 18 2023, 5:24 PM
vegeta_tuxpowered.net retitled D41502: pf: Enable the syncookie feature for IPv6 and reduce indentation from pf: Enable synproxy feature for IPv6 and reduce indentation to pf: Enable the syncookie feature for IPv6 and reduce indentation.
Aug 18 2023, 3:48 PM
vegeta_tuxpowered.net added a comment to D41502: pf: Enable the syncookie feature for IPv6 and reduce indentation.
In D41502#945583, @kp wrote:

I didn't realise we didn't support synproxy on IPv6, and I'm a little confused, given that we have the pf/synproxy:local_v6 test case which appears to pass.

I'll take a deeper look sometime next week. If you get a moment can you create a test case like synproxy:synproxy for IPv6?

Aug 18 2023, 3:48 PM
vegeta_tuxpowered.net requested review of D41502: pf: Enable the syncookie feature for IPv6 and reduce indentation.
Aug 18 2023, 7:34 AM

Aug 17 2023

vegeta_tuxpowered.net updated the diff for D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 17 2023, 5:44 PM
vegeta_tuxpowered.net updated the summary of D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 17 2023, 5:41 PM
vegeta_tuxpowered.net updated the summary of D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 17 2023, 5:41 PM
vegeta_tuxpowered.net updated the diff for D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.

Updated to cover the IPv6 forwarding too

Aug 17 2023, 5:36 PM
vegeta_tuxpowered.net retitled D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in from ip_fastfwd: Don't overwrite a next hop installed by pfil to Draft: fastfwd: Don't overwrite a next hop installed by pfil.
Aug 17 2023, 5:35 PM

Aug 16 2023

vegeta_tuxpowered.net requested review of D41479: Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
Aug 16 2023, 7:04 AM

Jul 12 2023

vegeta_tuxpowered.net updated the summary of D41009: pf: Simplify rule actions logic.
Jul 12 2023, 5:03 PM
vegeta_tuxpowered.net requested review of D41009: pf: Simplify rule actions logic.
Jul 12 2023, 4:54 PM
vegeta_tuxpowered.net updated the summary of D41008: pf: Fix duplicate storage of direction.
Jul 12 2023, 4:36 PM
vegeta_tuxpowered.net requested review of D41008: pf: Fix duplicate storage of direction.
Jul 12 2023, 4:34 PM

Jun 17 2023

vegeta_tuxpowered.net updated the summary of D40587: pf: Fix usage of pf tags with syncookies.
Jun 17 2023, 7:23 PM
vegeta_tuxpowered.net requested review of D40587: pf: Fix usage of pf tags with syncookies.
Jun 17 2023, 7:20 PM
vegeta_tuxpowered.net abandoned D40259: pfctl: Add missing state parameters in DIOCGETSTATESV2.

This change has been in fact merged.

Jun 17 2023, 7:06 PM

May 28 2023

vegeta_tuxpowered.net added inline comments to D40259: pfctl: Add missing state parameters in DIOCGETSTATESV2.
May 28 2023, 1:03 PM

May 24 2023

vegeta_tuxpowered.net requested review of D40259: pfctl: Add missing state parameters in DIOCGETSTATESV2.
May 24 2023, 8:38 PM
vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Added tcpdump and netstat changes to this patch because of change of struct pfsync_state to struct pfsync_state_1301.

May 24 2023, 8:34 PM
vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Split userspace export into a separate commit for DIOCGETSTATESV2.

May 24 2023, 8:27 PM

May 15 2023

vegeta_tuxpowered.net added a reviewer for D40013: pf: Standardize rtableid: kp.
May 15 2023, 3:25 PM
vegeta_tuxpowered.net added inline comments to D40004: pfsync: Remove deletion of states using the full pfsync_state struct.
May 15 2023, 3:22 PM
vegeta_tuxpowered.net updated the diff for D40004: pfsync: Remove deletion of states using the full pfsync_state struct.

Don't remove tcpdump compatibility.

May 15 2023, 3:21 PM

May 9 2023

vegeta_tuxpowered.net added a comment to D40013: pf: Standardize rtableid.

The new kernel code uses uint32_t as the table id, I’m curious why do you want to have rtableid signef.

May 9 2023, 11:54 AM

May 8 2023

vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Fixed broken rebase on main.

May 8 2023, 9:27 PM
vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Rebased again, the previous diff has been wrongly generated.

May 8 2023, 9:08 PM
vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Rebased on D40004 and D40013 as separate commits.

May 8 2023, 8:53 PM
vegeta_tuxpowered.net added inline comments to D39392: Make contents of struct pfsync_state configurable.
May 8 2023, 8:49 PM
vegeta_tuxpowered.net requested review of D40013: pf: Standardize rtableid.
May 8 2023, 8:47 PM
vegeta_tuxpowered.net updated the diff for D40004: pfsync: Remove deletion of states using the full pfsync_state struct.

Remove support for printing the old state deletion messages from tcpdump.

May 8 2023, 8:26 PM
vegeta_tuxpowered.net updated the summary of D40004: pfsync: Remove deletion of states using the full pfsync_state struct.
May 8 2023, 7:56 PM
vegeta_tuxpowered.net requested review of D40004: pfsync: Remove deletion of states using the full pfsync_state struct.
May 8 2023, 7:42 PM

May 7 2023

vegeta_tuxpowered.net abandoned D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

This revision has been merged.

May 7 2023, 7:10 PM

May 5 2023

vegeta_tuxpowered.net added inline comments to D39392: Make contents of struct pfsync_state configurable.
May 5 2023, 5:48 PM
vegeta_tuxpowered.net added a comment to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

@kp , I see that you've merged it on 2023-04-13. But this review is still opened. What's the procedure here, will you close it or should I abandon it?

May 5 2023, 5:46 PM

May 2 2023

vegeta_tuxpowered.net requested review of D39940: pf: Improve source node error handling.
May 2 2023, 8:41 PM

May 1 2023

vegeta_tuxpowered.net added a comment to D39888: pf :Reduce number of hashing operations when handling source nodes.

The returnlocked flag is now a booelan.

May 1 2023, 1:54 PM
vegeta_tuxpowered.net updated the diff for D39888: pf :Reduce number of hashing operations when handling source nodes.
May 1 2023, 1:53 PM
vegeta_tuxpowered.net updated the diff for D39888: pf :Reduce number of hashing operations when handling source nodes.
May 1 2023, 1:50 PM
vegeta_tuxpowered.net updated the diff for D39888: pf :Reduce number of hashing operations when handling source nodes.

Updated pointer handing. Changed the flag to boolean.

May 1 2023, 1:31 PM

Apr 30 2023

vegeta_tuxpowered.net updated the diff for D39888: pf :Reduce number of hashing operations when handling source nodes.

Removed unnecessary state lock assertion.

Apr 30 2023, 9:28 PM
vegeta_tuxpowered.net requested review of D39888: pf :Reduce number of hashing operations when handling source nodes.
Apr 30 2023, 7:40 PM

Apr 29 2023

vegeta_tuxpowered.net requested review of D39880: Draft: Fix source tracking for route-to rules and for global tracking.
Apr 29 2023, 10:23 PM

Apr 15 2023

vegeta_tuxpowered.net requested review of D39586: Add missing pf reasons and actions to tcpdump.
Apr 15 2023, 7:05 PM

Apr 9 2023

vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Added function pfsync_sstate_to_qid to translates pf_kstate->sync_state to queue name. This removes multiple such translations scattered around the code and fixes pfsync_q_del.

Apr 9 2023, 9:23 PM

Apr 4 2023

vegeta_tuxpowered.net updated the summary of D39392: Make contents of struct pfsync_state configurable.
Apr 4 2023, 4:45 PM

Apr 3 2023

vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Apr 3 2023, 9:03 PM
vegeta_tuxpowered.net added inline comments to D39392: Make contents of struct pfsync_state configurable.
Apr 3 2023, 8:10 AM

Apr 2 2023

vegeta_tuxpowered.net added inline comments to D39392: Make contents of struct pfsync_state configurable.
Apr 2 2023, 9:20 PM
vegeta_tuxpowered.net updated the diff for D39392: Make contents of struct pfsync_state configurable.

Remove debug printfs

Apr 2 2023, 9:07 PM
vegeta_tuxpowered.net requested review of D39392: Make contents of struct pfsync_state configurable.
Apr 2 2023, 9:05 PM

Apr 1 2023

vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Apr 1 2023, 9:58 PM
vegeta_tuxpowered.net updated the diff for D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

Created PFSTATE_DN_IS_PIPE and PFSTATE_DN_IS_QUEUE mapped from corresponding PFRULE_DN_IS_.*. Grouped all of PFRULE_.* and PFSTATE_.* flags together, aligned them and documented to which variables they get assigned.

Apr 1 2023, 9:39 PM

Mar 20 2023

vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Mar 20 2023, 6:41 PM
vegeta_tuxpowered.net updated the diff for D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

Fix "fragment" in printing rules. Use proper integer types. Restore actions for pfsynced states. Expand pfsync_state->state_flags to 16b.

Mar 20 2023, 6:38 PM
vegeta_tuxpowered.net updated the diff for D38129: netpfil tests: Add tests for the new scrub syntax.

Update tests to use new test function names.

Mar 20 2023, 8:44 AM

Mar 12 2023

vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Mar 12 2023, 10:49 PM
vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Mar 12 2023, 10:46 PM
vegeta_tuxpowered.net updated the diff for D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

Make normalization functions behave in more straightforward manner. If there are no scrub rules then the normalization of IP and TCP is enforced just like in OpenBSD. Otherwise if scrub rules are present, obey them.

Mar 12 2023, 10:44 PM
vegeta_tuxpowered.net added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Mar 12 2023, 4:18 PM