Page MenuHomeFreeBSD

vegeta_tuxpowered.net (Kajetan Staszkiewicz)
User

Projects

User does not belong to any projects.

User Details

User Since
Sep 6 2022, 11:10 AM (144 w, 2 d)

Recent Activity

Tue, Jun 10

vegeta_tuxpowered.net requested review of D50781: WIP: pf: Add RFC5549 support for route-to.
Tue, Jun 10, 7:45 PM
vegeta_tuxpowered.net requested review of D50779: pf: Prevent infinite looping over tables in round-robin pools.
Tue, Jun 10, 3:16 PM

Mon, Jun 9

vegeta_tuxpowered.net requested review of D50768: pf: Don't access sk and nk before they are allocated.
Mon, Jun 9, 9:30 PM
vegeta_tuxpowered.net requested review of D50764: pf tests: Add jail configuration for route_to and rfc5549 tests.
Mon, Jun 9, 8:48 PM
vegeta_tuxpowered.net requested review of D50763: pf: Fix error handling when pf_map_addr() fails.
Mon, Jun 9, 8:44 PM
vegeta_tuxpowered.net requested review of D50762: pf: Don't return src node and hash from pf_map_addr_sn.
Mon, Jun 9, 8:43 PM

Fri, May 30

vegeta_tuxpowered.net added inline comments to D50579: pf: rework anchor handling to recurse.
Fri, May 30, 5:24 PM

Apr 28 2025

vegeta_tuxpowered.net committed rGe0fe26691fc9: pf: Add modern NAT syntax (authored by vegeta_tuxpowered.net).
pf: Add modern NAT syntax
Apr 28 2025, 8:08 PM

Apr 27 2025

vegeta_tuxpowered.net updated the diff for D49221: pf: Add modern NAT syntax.

pf.conf(5): fixed a typo, updated date.

Apr 27 2025, 8:28 PM
vegeta_tuxpowered.net retitled D49221: pf: Add modern NAT syntax from pfctl: Add modern NAT syntax to pf: Add modern NAT syntax.
Apr 27 2025, 6:58 PM

Apr 21 2025

vegeta_tuxpowered.net updated the diff for D49221: pf: Add modern NAT syntax.

Added binat support, modified pf.conf(5) man page to cover the new syntax, re-enabled a few more original OpenBSD pfctl tests.

Apr 21 2025, 5:48 PM
vegeta_tuxpowered.net added inline comments to D49221: pf: Add modern NAT syntax.
Apr 21 2025, 3:49 PM

Apr 7 2025

vegeta_tuxpowered.net added inline comments to D49665: pfctl: fix no nat / no rdr rules.
Apr 7 2025, 1:14 PM

Mar 28 2025

vegeta_tuxpowered.net committed rGaeddee83341e: pfctl: Split pool parsing into separate functions (authored by vegeta_tuxpowered.net).
pfctl: Split pool parsing into separate functions
Mar 28 2025, 4:10 PM
vegeta_tuxpowered.net closed D49218: pfctl: Split pool parsing into separate functions.
Mar 28 2025, 4:09 PM

Mar 25 2025

vegeta_tuxpowered.net updated the diff for D49221: pf: Add modern NAT syntax.

I have re-enabled OpenBSD tests. Some of them required modification to resolve port numbers to service names, include the "keep state" keyword, insert commas between table members, not auto-expand redirection table-like syntax into tables.

Mar 25 2025, 7:42 PM
vegeta_tuxpowered.net updated the diff for D49218: pfctl: Split pool parsing into separate functions.

I've moved the tests back to pfctl.

Mar 25 2025, 7:11 PM

Mar 21 2025

vegeta_tuxpowered.net added inline comments to D49433: pf: do a lock dance in pf_unlink_state().
Mar 21 2025, 11:14 AM

Mar 5 2025

vegeta_tuxpowered.net added a comment to D49218: pfctl: Split pool parsing into separate functions.
In D49218#1123087, @kp wrote:
Mar 5 2025, 4:47 PM
vegeta_tuxpowered.net added a comment to D49218: pfctl: Split pool parsing into separate functions.
In D49218#1123087, @kp wrote:

Are the tests doing something we can't do in the sbin/pfctl/tests tests? Those don't spin up a jail, they just feed input to pfctl and compare the parsed result to an expected output.
It's significantly faster to run those than it is to mess with real jails and interfaces.

Ah, yeah, these tests also have expected failures, which I don't think the pfctl tests support. I wonder if it's worth adding that and migrating these tests, or if we just keep the ones you have.

Mar 5 2025, 4:36 PM

Mar 4 2025

vegeta_tuxpowered.net changed the visibility for D49221: pf: Add modern NAT syntax.
Mar 4 2025, 4:34 PM
vegeta_tuxpowered.net updated the summary of D49221: pf: Add modern NAT syntax.
Mar 4 2025, 4:33 PM
vegeta_tuxpowered.net updated the summary of D49221: pf: Add modern NAT syntax.
Mar 4 2025, 4:31 PM
vegeta_tuxpowered.net updated the diff for D49221: pf: Add modern NAT syntax.
Mar 4 2025, 4:21 PM
vegeta_tuxpowered.net added a comment to D49218: pfctl: Split pool parsing into separate functions.
In D49218#1122711, @kp wrote:

This fails one of the new tests on my machine:

(kp@geb)  /usr/tests/sys/netpfil % sudo kyua debug pf/redirection_pool_syntax:af_to                                                                                                [11:14]
Testing rule:
pass in on vlan0 inet6 from any to 64:ff9b::/96 af-to inet from 192.0.2.102 to 198.51.100.102
Parsed ruleset difference:
--- /tmp/kyua.JWtsI2/2/work/tmp.aCH51evNTr      2025-03-04 10:14:41.041368000 +0000
+++ /tmp/kyua.JWtsI2/2/work/tmp.HYltlMftHQ      2025-03-04 10:14:41.060891000 +0000
@@ -1 +1 @@
-@0 pass in on vlan0 inet6 from any to 64:ff9b::/96 flags S/SA keep state af-to inet from 192.0.2.102 to 198.51.100.102
+@0 pass in on vlan0 inet6 from any to 64:ff9b::/96 flags S/SA keep state af-to inet from 192.0.2.102
Mar 4 2025, 2:10 PM
vegeta_tuxpowered.net committed rG2624ba37e633: pfctl: Fix printing af-to "to" pool (authored by vegeta_tuxpowered.net).
pfctl: Fix printing af-to "to" pool
Mar 4 2025, 12:16 PM
vegeta_tuxpowered.net closed D49213: pfctl: Fix printing af-to "to" pool.
Mar 4 2025, 12:16 PM

Mar 3 2025

vegeta_tuxpowered.net requested review of D49221: pf: Add modern NAT syntax.
Mar 3 2025, 5:09 PM
vegeta_tuxpowered.net retitled D49218: pfctl: Split pool parsing into separate functions from pfctl: Split pool parsing into a separate functions to pfctl: Split pool parsing into separate functions.
Mar 3 2025, 4:53 PM
vegeta_tuxpowered.net updated the summary of D49218: pfctl: Split pool parsing into separate functions.
Mar 3 2025, 4:51 PM
vegeta_tuxpowered.net requested review of D49218: pfctl: Split pool parsing into separate functions.
Mar 3 2025, 4:45 PM
vegeta_tuxpowered.net requested review of D49213: pfctl: Fix printing af-to "to" pool.
Mar 3 2025, 11:39 AM

Feb 27 2025

vegeta_tuxpowered.net committed rGf6f116cdbd2a: pf: Make af-to work on outbound interface (authored by vegeta_tuxpowered.net).
pf: Make af-to work on outbound interface
Feb 27 2025, 3:34 PM
vegeta_tuxpowered.net closed D49122: pf: Make af-to work on outbound interface.
Feb 27 2025, 3:34 PM
vegeta_tuxpowered.net updated the diff for D49122: pf: Make af-to work on outbound interface.

Fix too long lines and other syntax issues. Deduplicate calculation of src, dst, psrc, pdst for state tracking, which also fixes outbound NAT64 for UDP traffic.

Feb 27 2025, 12:55 PM
vegeta_tuxpowered.net added inline comments to D49122: pf: Make af-to work on outbound interface.
Feb 27 2025, 12:47 PM

Feb 24 2025

vegeta_tuxpowered.net requested review of D49122: pf: Make af-to work on outbound interface.
Feb 24 2025, 1:27 PM

Feb 16 2025

vegeta_tuxpowered.net closed D39880: pf: Add support for multiple source node types.
Feb 16 2025, 6:30 AM

Feb 13 2025

vegeta_tuxpowered.net committed rG07e070ef0869: pf: Add support for multiple source node types (authored by vegeta_tuxpowered.net).
pf: Add support for multiple source node types
Feb 13 2025, 3:01 PM

Feb 12 2025

vegeta_tuxpowered.net added inline comments to D39880: pf: Add support for multiple source node types.
Feb 12 2025, 5:40 PM
vegeta_tuxpowered.net updated the diff for D39880: pf: Add support for multiple source node types.

Restored original variable names in libpfctl, added typedef for the enum.

Feb 12 2025, 5:37 PM

Feb 11 2025

vegeta_tuxpowered.net added inline comments to D39880: pf: Add support for multiple source node types.
Feb 11 2025, 4:18 PM
vegeta_tuxpowered.net updated the diff for D39880: pf: Add support for multiple source node types.

Source node locking issues have been solved in another review. This patch now covers only adding source node types.

Feb 11 2025, 12:07 PM

Feb 6 2025

vegeta_tuxpowered.net committed rGdaea703963f5: pf: Use pf_map_addr() only once when choosing source port and address (authored by vegeta_tuxpowered.net).
pf: Use pf_map_addr() only once when choosing source port and address
Feb 6 2025, 1:19 PM
vegeta_tuxpowered.net closed D48821: pf: Use pf_map_addr() only once when choosing source port and address.
Feb 6 2025, 1:19 PM

Feb 3 2025

vegeta_tuxpowered.net requested review of D48821: pf: Use pf_map_addr() only once when choosing source port and address.
Feb 3 2025, 7:13 PM

Jan 28 2025

vegeta_tuxpowered.net added a watcher for firewall: vegeta_tuxpowered.net.
Jan 28 2025, 4:07 PM

Dec 9 2024

vegeta_tuxpowered.net added a comment to D47953: pf: Force logging if pf_create_state() fails.

Improve the situation a bit: force logging if state creation fails.
This isn't totally right as we'll end up logging the packet twice in
this case, but it's better than not logging the drop at all.

Dec 9 2024, 11:08 AM

Dec 5 2024

vegeta_tuxpowered.net committed rGad6562ec858f: pf: Don't pfsync states with unrecoverable routing information (authored by vegeta_tuxpowered.net).
pf: Don't pfsync states with unrecoverable routing information
Dec 5 2024, 10:10 PM
vegeta_tuxpowered.net closed D47906: pf: Don't pfsync states with unrecoverable routing information.
Dec 5 2024, 10:10 PM

Dec 4 2024

vegeta_tuxpowered.net updated the diff for D47906: pf: Don't pfsync states with unrecoverable routing information.

Improve some comments.

Dec 4 2024, 2:49 PM
vegeta_tuxpowered.net added inline comments to D47906: pf: Don't pfsync states with unrecoverable routing information.
Dec 4 2024, 1:50 PM
vegeta_tuxpowered.net requested review of D47906: pf: Don't pfsync states with unrecoverable routing information.
Dec 4 2024, 11:55 AM

Dec 3 2024

vegeta_tuxpowered.net committed rGc49c9da239ca: pf: Move route-to information to rule actions (authored by vegeta_tuxpowered.net).
pf: Move route-to information to rule actions
Dec 3 2024, 1:10 PM
vegeta_tuxpowered.net closed D47827: Draft: pf: Move route-to information to pf_rule_actions.
Dec 3 2024, 1:10 PM

Nov 29 2024

vegeta_tuxpowered.net updated the diff for D47827: Draft: pf: Move route-to information to pf_rule_actions.

Restore the old value of _Static_assert(sizeof(struct pf_kstate))

Nov 29 2024, 1:33 PM
vegeta_tuxpowered.net added inline comments to D47827: Draft: pf: Move route-to information to pf_rule_actions.
Nov 29 2024, 12:58 PM
vegeta_tuxpowered.net updated the diff for D47827: Draft: pf: Move route-to information to pf_rule_actions.

Plug holes in pf_rule_actions

Nov 29 2024, 8:31 AM

Nov 28 2024

vegeta_tuxpowered.net committed rGb9c0321d54e9: pf: Fix source node locking (authored by vegeta_tuxpowered.net).
pf: Fix source node locking
Nov 28 2024, 5:34 PM
vegeta_tuxpowered.net closed D47770: pf: Fix source node locking.
Nov 28 2024, 5:34 PM
vegeta_tuxpowered.net added inline comments to D47827: Draft: pf: Move route-to information to pf_rule_actions.
Nov 28 2024, 5:12 PM
vegeta_tuxpowered.net updated the diff for D47770: pf: Fix source node locking.

Use style(9)-compliant boolean tests

Nov 28 2024, 3:44 PM
vegeta_tuxpowered.net added a comment to D47827: Draft: pf: Move route-to information to pf_rule_actions.

As promised yesterday, I propose how to get further with simplifying source node handling. This is a draft/proposal, however it compiles and passes all tests, at least the ones not skipped, which for me are dummynet and altq, I need to revive my custom kernel config to get those running.

Nov 28 2024, 3:17 PM
vegeta_tuxpowered.net retitled D47827: Draft: pf: Move route-to information to pf_rule_actions from pf: Move route-to information to pf_rule_actions to Draft: pf: Move route-to information to pf_rule_actions.
Nov 28 2024, 3:16 PM
vegeta_tuxpowered.net requested review of D47827: Draft: pf: Move route-to information to pf_rule_actions.
Nov 28 2024, 3:16 PM
vegeta_tuxpowered.net updated the diff for D47770: pf: Fix source node locking.

Change limited to bool. Fix one missing PF_SRC_NODE… macro.

Nov 28 2024, 11:47 AM
vegeta_tuxpowered.net updated the diff for D47770: pf: Fix source node locking.

Make pf_hashsrc() available from everywhere. Use PF_SRC_NODE… macros now that pf_hashsrc() is accessible. The OB1 error in pf_insert_src_node() is gone, adjust the tests accordingly. Simplify pf_src_connlimit() logic,

Nov 28 2024, 11:43 AM
vegeta_tuxpowered.net closed D47697: pf: Set cleared time when zeroing stats for table addresses.
Nov 28 2024, 9:41 AM
vegeta_tuxpowered.net committed rG1a5dc6ee62b3: pf: Set cleared time when zeroing stats for table addresses (authored by vegeta_tuxpowered.net).
pf: Set cleared time when zeroing stats for table addresses
Nov 28 2024, 9:41 AM
vegeta_tuxpowered.net closed D47758: pf: Use a single pointer to state in pf_src_connlimit().
Nov 28 2024, 9:41 AM
vegeta_tuxpowered.net committed rG9f9cf83f114a: pf: Use a single pointer to state in pf_src_connlimit() (authored by vegeta_tuxpowered.net).
pf: Use a single pointer to state in pf_src_connlimit()
Nov 28 2024, 9:41 AM
vegeta_tuxpowered.net added inline comments to D47788: pf: extra route lookup in pf_route(6)().
Nov 28 2024, 9:23 AM
vegeta_tuxpowered.net added inline comments to D47783: pf: partially import OpenBSD's NAT rewrite.
Nov 28 2024, 9:10 AM

Nov 27 2024

vegeta_tuxpowered.net added inline comments to D47788: pf: extra route lookup in pf_route(6)().
Nov 27 2024, 5:21 PM
vegeta_tuxpowered.net added inline comments to D47783: pf: partially import OpenBSD's NAT rewrite.
Nov 27 2024, 5:11 PM
vegeta_tuxpowered.net added inline comments to D47770: pf: Fix source node locking.
Nov 27 2024, 12:23 PM

Nov 26 2024

vegeta_tuxpowered.net added a comment to D47770: pf: Fix source node locking.

This patch only aims to fix issues with locking, not the other issues found in D39880 (which will require some modifications, as while writing this one, I found some issues with the 2 different paths reaching pf_map_addr_sn(), which D39880 does not take into account). I suppose it could be MFC'd into the currently maintained releases of FreeBSD after more testing.

Nov 26 2024, 6:42 PM
vegeta_tuxpowered.net requested review of D47770: pf: Fix source node locking.
Nov 26 2024, 6:34 PM
vegeta_tuxpowered.net requested review of D47758: pf: Use a single pointer to state in pf_src_connlimit().
Nov 26 2024, 3:17 PM

Nov 22 2024

vegeta_tuxpowered.net abandoned D47698: pfctl: clear statistic for the address.

Duplicate of https://cgit.freebsd.org/src/commit/?id=6463b6b59152fb1695bbe0de78f6e2675c5a765a

Nov 22 2024, 3:31 PM

Nov 21 2024

vegeta_tuxpowered.net updated the summary of D47698: pfctl: clear statistic for the address.
Nov 21 2024, 10:22 PM
vegeta_tuxpowered.net requested review of D47698: pfctl: clear statistic for the address.
Nov 21 2024, 10:21 PM
vegeta_tuxpowered.net updated the diff for D47697: pf: Set cleared time when zeroing stats for table addresses.

There's no need for additional variable, time is used only once.

Nov 21 2024, 8:53 PM
vegeta_tuxpowered.net requested review of D47697: pf: Set cleared time when zeroing stats for table addresses.
Nov 21 2024, 8:39 PM
vegeta_tuxpowered.net committed rG7d929a444587: pf: Fix timestamps and connection rate in source node export (authored by vegeta_tuxpowered.net).
pf: Fix timestamps and connection rate in source node export
Nov 21 2024, 2:28 PM
vegeta_tuxpowered.net committed rGe8eb3096d8d1: pf: Fix missing connection rate for DIOCGETSRCNODES (authored by vegeta_tuxpowered.net).
pf: Fix missing connection rate for DIOCGETSRCNODES
Nov 21 2024, 2:28 PM
vegeta_tuxpowered.net closed D47321: pf: Fix timestamps and connection rate in source node export.
Nov 21 2024, 2:28 PM
vegeta_tuxpowered.net closed D47679: pf: Fix timestamps and connection rate in source node export to userspace.
Nov 21 2024, 2:28 PM

Nov 20 2024

vegeta_tuxpowered.net added a comment to D47321: pf: Fix timestamps and connection rate in source node export.

This code suffers from very old OpenBSD idea of (ab)using the same data structure for in-kernel storage and communication with userspace over ioctl. There is no need for struct pf_threshold *t, as pfctl only displays its count and seconds properties. Instead of having a separate function nlattr_add_pf_threshold() with all its PF_TH_… variables we could just add new variables PF_SN_CONN_RATE_RATE and PF_SN_CONN_RATE_SECONDS directly into the source node. And rename PF_SN_CREATION to PF_SN_AGE since it's the age of the SN, calculated during the export, not its creation time, as stored in kernel.

Nov 20 2024, 9:00 AM

Nov 19 2024

vegeta_tuxpowered.net added a comment to D47679: pf: Fix timestamps and connection rate in source node export to userspace.

This is also broken on FreeBSD 14.

Nov 19 2024, 10:10 PM
vegeta_tuxpowered.net updated the diff for D47321: pf: Fix timestamps and connection rate in source node export.
Nov 19 2024, 10:02 PM
vegeta_tuxpowered.net retitled D47321: pf: Fix timestamps and connection rate in source node export from pf: Fix timestamps in source node export to userspace to pf: Fix timestamps and connection rate in source node export.
Nov 19 2024, 10:01 PM
vegeta_tuxpowered.net updated the summary of D47679: pf: Fix timestamps and connection rate in source node export to userspace.
Nov 19 2024, 9:58 PM
vegeta_tuxpowered.net requested review of D47679: pf: Fix timestamps and connection rate in source node export to userspace.
Nov 19 2024, 9:55 PM

Nov 15 2024

vegeta_tuxpowered.net added a comment to D47543: pf: close nc file descriptors in killstates test.

So regardless of why I already stated this is a technical issue that is by no means "pointless", what do you suggest to improve this particular test to make it more robust? Uncontrolled creation of processes that inherit file descriptors isn't exactly clean design but I can see why you do not want to apply this mere bandaid with that larger issue at hand.

Nov 15 2024, 1:47 PM

Nov 13 2024

vegeta_tuxpowered.net closed D47435: pf tests: Simplify handling of pfctl -s.

Closed by commit rG65b20771713c: pf tests: Simplify handling of pfctl -s

Nov 13 2024, 8:46 AM

Nov 12 2024

vegeta_tuxpowered.net committed rG65b20771713c: pf tests: Simplify handling of pfctl -s (authored by vegeta_tuxpowered.net).
pf tests: Simplify handling of pfctl -s
Nov 12 2024, 5:21 PM
vegeta_tuxpowered.net closed D47440: pf: Merge pf_clear_srcnodes() and pf_kill_srcnodes().
Nov 12 2024, 5:21 PM
vegeta_tuxpowered.net committed rG452e6f549cdb: pf: Merge pf_clear_srcnodes() and pf_kill_srcnodes() (authored by vegeta_tuxpowered.net).
pf: Merge pf_clear_srcnodes() and pf_kill_srcnodes()
Nov 12 2024, 5:21 PM

Nov 4 2024

vegeta_tuxpowered.net added a comment to D47435: pf tests: Simplify handling of pfctl -s.
In D47435#1081961, @kp wrote:
Nov 4 2024, 9:18 PM