aboutsummaryrefslogtreecommitdiff
path: root/lib/libpfctl
Commit message (Collapse)AuthorAgeFilesLines
...
* pfctl: Add missing state parameters in DIOCGETSTATESV2Kajetan Staszkiewicz2023-05-302-2/+26
| | | | | | Reviewed by: kp Sponsored by: InnoGames GmbH Different Revision: https://reviews.freebsd.org/D40259
* pf: introduce ridentifier and labels to ether rulesChristian McDonald2023-04-262-1/+22
| | | | | | | | Make Ethernet rules more similar to the usual layer 3 rules by also allowing ridentifier and labels to be set on them. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate")
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-191-0/+0
|
* pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rulesKajetan Staszkiewicz2023-04-142-1/+3
| | | | | | | | | | | Introduce the OpenBSD syntax of "scrub" option for "match" and "pass" rules and the "set reassemble" flag. The patch is backward-compatible, pf.conf can be still written in FreeBSD-style. Obtained from: OpenBSD MFC after: never Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38025
* libpfctl: Don't pass stack garbage to free.John Baldwin2023-03-221-2/+0
| | | | | | | | GCC 9 on stable/12 reports a -Wmaybe-uninitialized error for the call to free in _pfctl_clear_states. Reviewed by: mjg Differential Revision: https://reviews.freebsd.org/D39198
* pf: bridge-toKristof Provost2022-11-022-0/+6
| | | | | | | | | | | | Allow pf (l2) to be used to redirect ethernet packets to a different interface. The intended use case is to send 802.1x challenges out to a side interface, to enable AT&T links to function with pfSense as a gateway, rather than the AT&T provided hardware. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D37193
* pf: expose syncookie active/inactive statusKristof Provost2022-10-312-0/+2
| | | | | | | | When syncookies are in adaptive mode they may be active or inactive. Expose this status to users. Suggested by: Guido van Rooij Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: use time_to for timestampsKristof Provost2022-10-051-2/+2
| | | | | | | | | | Use time_t rather than uint32_t to represent the timestamps. That means we have 64 bits rather than 32 on all platforms except i386, avoiding the Y2K38 issues on most platforms. Reviewed by: Zhenlei Huang Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D36837
* libpfctl: improve syncookie watermark calculationKristof Provost2022-09-121-2/+10
| | | | | | | | | | | | | | | Ensure that we always pass sane limits for the high and low watermark values. This is especially important if users do something silly, like set the state limit to 1. In that case we wound up calculating 0/0 as a limit, which gets rejected by the kernel. While here also shift the calculation to use uint64_t, so we don't end up with overflows (and subsequently higher low than high values) with very large state limits. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D36497
* pf: support matching on tags for Ethernet rulesKristof Provost2022-06-202-0/+9
| | | | | Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D35362
* pf: Add per-rule timestamps for rule and eth_ruleReid Linnemann2022-04-222-1/+11
| | | | | | | | | | | Similar to ipfw rule timestamps, these timestamps internally are uint32_t snaps of the system time in seconds. The timestamp is CPU local and updated each time a rule or a state associated with a rule or state is matched. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34970
* libpfctl: grow request buffer on ENOSPCKristof Provost2022-04-201-139/+61
| | | | | | | | | | | | | When we issue a request to pf and expect a serialised nvlist as a reply we have to supply a suitable buffer to the kernel. The required size for this buffer is difficult to predict, and may be (slightly) different from request to request. If it's insufficient the kernel will return ENOSPC. Teach libpfctl to catch this and send the request again with a larger buffer. MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34908
* libpfctl: relocate implementations of pfr_add/get/set_addrsReid Linnemann2022-04-042-1/+105
| | | | | | Reviewed by: kp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D34740
* pf: handle duplicate rules gracefullyMateusz Guzik2022-04-011-0/+2
| | | | | | | Reviewed by: kp Reported by: dch PR: 262971 Sponsored by: Rubicon Communications, LLC ("Netgate")
* libpfct: Return errno from pfctl_add_eth_rule()Kristof Provost2022-03-301-2/+3
| | | | | | | | If the pfctl_add_eth_rule() ioctl fails return the errno, not the error returned by ioctl(). That will give us slightly more insight into what went wrong, because ioctl() would always return -1. Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: support listing ethernet anchorsKristof Provost2022-03-302-0/+89
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: support basic L3 filtering in the Ethernet rulesKristof Provost2022-03-142-1/+10
| | | | | | | | | Allow filtering based on the source or destination IP/IPv6 address in the Ethernet layer rules. Reviewed by: pauamma_gundo.com (man), debdrup (man) Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34482
* libpfct: factor out pfctl_get_rules_info()Kristof Provost2022-03-082-0/+29
| | | | | | | | | | | Introduce pfctl_get_rules_info(), similar to pfctl_get_eth_rules_info() to retrieve rules information (ticket and total number of rules). Use the new function in pfctl. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34443
* libpfctl: support flushing rules/nat/ethKristof Provost2022-03-082-0/+92
| | | | | | | | | Move the code to flush regular rules, nat rules and Ethernet rules into libpfctl for easier re-use. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34442
* pf: support masking mac addressesKristof Provost2022-03-022-0/+6
| | | | | | | | | When filtering Ethernet packets allow rules to specify a mac address with a mask. This indicates which bits of the specified address are significant. This allows users to do things like filter based on device manufacturer. Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: add anchor support for ether rulesKristof Provost2022-03-022-8/+51
| | | | | | | Support anchors in ether rules. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32482
* pf: support dummynet on L2 rulesKristof Provost2022-03-022-0/+8
| | | | | | | | | | Allow packets to be tagged with dummynet information. Note that we do not apply dummynet shaping on the L2 traffic, but instead mark it for dummynet processing in the L3 code. This is the same approach as we take for ALTQ. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32222
* pfctl: Don't print (ether) to / from if they're not setKristof Provost2022-03-022-0/+5
| | | | | | | | If we're not filtering on a specific MAC address don't print it at all, rather than showing an all-zero address. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31749
* pfctl: Print Ethernet rulesKristof Provost2022-03-022-0/+221
| | | | | | | | Extent pfctl to be able to read configured Ethernet filtering rules from the kernel and print them. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31738
* libpfctl: fix pfctl_kill_states()Kristof Provost2022-01-311-1/+1
| | | | | | | | | | 735748f30a changed the output of the states so that the creator id endianness would be consistent. This means that we need to convert the host endianness creatorid back to big-endian before we give it to the kernel. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
* libpfctl: fix creatorid endiannessKristof Provost2022-01-271-2/+2
| | | | | | | | | | | | | We provide the hostid (which is the state creatorid) to the kernel as a big endian number (see pfctl/pfctl.c pfctl_set_hostid()), so convert it back to system endianness when we get it from the kernel. This avoids a confusing mismatch between the value the user configures and the value displayed in the state. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33989
* pf tests: Test PR259689Kristof Provost2021-11-101-1/+1
| | | | | | | | | | We didn't populate dyncnt/tblcnt, so `pfctl -sr -vv` might not have the table element count. PR: 259689 MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32893
* pf: ensure we populate dyncnt/tblcnt in struct pf_addr_wrapKristof Provost2021-11-101-2/+8
| | | | | | | PR: 259689 MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32892
* libpfct: be consistent with u_int vs. uintKristof Provost2021-11-052-79/+79
| | | | | | | | | Always use uint64_t over u_int64_t, for the sake of consistency. No functional change. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: Introduce ridentifierKristof Provost2021-11-052-0/+3
| | | | | | | | | | | | | Allow users to set a number on rules which will be exposed as part of the pflog header. The intent behind this is to allow users to correlate rules across updates (remember that pf rules continue to exist and match existing states, even if they're removed from the active ruleset) and pflog. Obtained from: pfSense MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32750
* pfctl: userspace adaptive syncookies configrationKristof Provost2021-09-292-6/+55
| | | | | | | | Hook up the userspace bits to configure syncookies in adaptive mode. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D32136
* pf: support dummynetKristof Provost2021-09-242-0/+9
| | | | | | | | | | | | Allow pf to use dummynet pipes and queues. We re-use the currently unused IPFW_IS_DUMMYNET flag to allow dummynet to tell us that a packet is being re-injected after being delayed. This is needed to avoid endlessly looping the packet between pf and dummynet. MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31904
* libpfctl: Implement DIOCGETSTATUS wrappersKristof Provost2021-08-292-0/+145
| | | | | | MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31696
* libpfctl: fix double freeKristof Provost2021-08-291-1/+0
| | | | | | | Reviewed by: donner MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31695
* libpfctl: Fix endianness issuesKristof Provost2021-08-201-5/+5
| | | | | | | | Several fields are supplied in big-endian format, so we need to convert them before we display them. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate")
* pfctl: syncookie configurationKristof Provost2021-07-202-0/+68
| | | | | | | | | pfctl and libpfctl code required to enable/disable the syncookie feature. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31140
* libpfctl: migrate to DIOCGETSTATESV2Kristof Provost2021-07-091-115/+77
| | | | | | | | | | | | | Stop using the *NV version to retrieve states, as its performance is unacceptably bad. For 1,000,000 states the nvlist version needed ~100 seconds to retrieve the states, the new version needs ~3 seconds. Reviewed by: mjg MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31098
* libpfctl: memory leak fixKristof Provost2021-07-021-0/+1
| | | | | | | | | | We must remember to free the nvlist we create from the kernel's response to DIOCGETSTATESNV, on every iteration. Reviewed by: donner MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30957
* pf: Reduce the data returned in DIOCGETSTATESNVKristof Provost2021-07-022-34/+0
| | | | | | | | | | | | | | | | This call is particularly slow due to the large amount of data it returns. Remove all fields pfctl does not use. There is no functional impact to pfctl, but it somewhat speeds up the call. It might affect other (i.e. non-FreeBSD) code that uses the new interface, but this call is very new, so there's unlikely to be any. No releases contained the previous version, so we choose to live with the ABI modification. Reviewed by: donner MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30944
* libpfctl: Improve error handling in pfctl_get_states()Kristof Provost2021-05-311-11/+17
| | | | | | | | | Ensure that we always free nvlists and other allocated memory. Reviewed by: scottl MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30493
* libpfctl: fix memory leakKristof Provost2021-05-311-0/+9
| | | | | | | | | | | | | When we create an nvlist and insert it into another nvlist we must remember to destroy it. The nvlist_add_nvlist() function makes a copy, just like nvlist_add_string() makes a copy of the string. See also 4483fb47735c29408c72045469c9c4b3e549668b Reviewed by: scottl MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30492
* pf: Track the original kif for floating statesKristof Provost2021-05-202-0/+3
| | | | | | | | | Track (and display) the interface that created a state, even if it's a floating state (and thus uses virtual interface 'all'). MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30245
* pfctl: Use DIOCGETSTATESNVKristof Provost2021-05-202-0/+233
| | | | | | | | | Migrate to using the new nvlist-based DIOCGETSTATESNV call to obtain the states list. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30244
* pf: Support killing 'matching' statesKristof Provost2021-05-072-0/+2
| | | | | | | | | | | | | | Optionally also kill states that match (i.e. are the NATed state or opposite direction state entry for) the state we're killing. See also https://redmine.pfsense.org/issues/8555 Submitted by: Steven Brown Reviewed by: bcr (man page) Obtained from: https://github.com/pfsense/FreeBSD-src/pull/11/ MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30092
* pf: Allow states to by killed per 'gateway'Kristof Provost2021-05-072-0/+2
| | | | | | | | | | | | This allows us to kill states created from a rule with route-to/reply-to set. This is particularly useful in multi-wan setups, where one of the WAN links goes down. Submitted by: Steven Brown Obtained from: https://github.com/pfsense/FreeBSD-src/pull/11/ MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30058
* pfctl: Start using DIOCKILLSTATESNVKristof Provost2021-05-072-4/+22
| | | | | | MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30055
* pfctl: Start using DIOCCLRSTATESNVKristof Provost2021-05-072-0/+77
| | | | | | MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30053
* pf: Fix parsing of long table namesKristof Provost2021-04-261-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When parsing the nvlist for a struct pf_addr_wrap we unconditionally tried to parse "ifname". This broke for PF_ADDR_TABLE when the table name was longer than IFNAMSIZ. PF_TABLE_NAME_SIZE is longer than IFNAMSIZ, so this is a valid configuration. Only parse (or return) ifname or tblname for the corresponding pf_addr_wrap type. This manifested as a failure to set rules such as these, where the pfctl optimiser generated an automatic table: pass in proto tcp to 192.168.0.1 port ssh pass in proto tcp to 192.168.0.2 port ssh pass in proto tcp to 192.168.0.3 port ssh pass in proto tcp to 192.168.0.4 port ssh pass in proto tcp to 192.168.0.5 port ssh pass in proto tcp to 192.168.0.6 port ssh pass in proto tcp to 192.168.0.7 port ssh Reported by: Florian Smeets Tested by: Florian Smeets Reviewed by: donner X-MFC-With: 5c11c5a3655842a176124ef2334fcdf830422c8a MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29962
* pf: Allow multiple labels to be set on a ruleKristof Provost2021-04-262-4/+16
| | | | | | | | | | | | Allow up to 5 labels to be set on each rule. This offers more flexibility in using labels. For example, it replaces the customer 'schedule' keyword used by pfSense to terminate states according to a schedule. Reviewed by: glebius MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29936
* pf: Optionally attempt to preserve rule counter values across ruleset updatesKristof Provost2021-04-192-0/+23
| | | | | | | | | | Usually rule counters are reset to zero on every update of the ruleset. With keepcounters set pf will attempt to find matching rules between old and new rulesets and preserve the rule counters. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29780
generated by cgit v1.3 (git 2.53.0) at 2026-04-02 12:37:50 +0000