From e4f3ab161a9e149fd2f657f6d8af2ba3c618255f Mon Sep 17 00:00:00 2001
From: Kristof Provost <kp@FreeBSD.org>
Date: Wed, 24 Jun 2026 12:21:20 +0200
Subject: pflog: create bpf tapping points without ifnet(9)

Just as was done for ipfw's log device stop creating entire struct
ifnet's for pflog devices. Create only a bpf_t.

This does mean we lose the create/destroy infrastructure provided by the
clone interface. Rather than implement this ourselves we allow users to
configure the number of pflog interfaces using the net.pflog.if_count
sysctl. We default to 8 devices, but allow up to 256.

The /etc/rc.d/pflog script will create extra devices as required.

While it was possible to rename pflog devices pfctl expected the pflogX
name, so it's safe to assume users never did this.

Requested by:	glebius
Reviewed by:	glebius
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D57851
---
 libexec/rc/rc.d/pflog | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

(limited to 'libexec')

diff --git a/libexec/rc/rc.d/pflog b/libexec/rc/rc.d/pflog
index b47252a23e0f..8441e56eb8f6 100755
--- a/libexec/rc/rc.d/pflog
+++ b/libexec/rc/rc.d/pflog
@@ -27,18 +27,11 @@ pflog_prestart()
 {
 	load_kld pflog || return 1
 
-	# create pflog_dev interface if needed
-	if ! ifconfig $pflog_dev > /dev/null 2>&1; then
-		if ! ifconfig $pflog_dev create; then
-			warn "could not create $pflog_dev."
-			return 1
-		fi
-	fi
-
-	# set pflog_dev interface to up state
-	if ! ifconfig $pflog_dev up; then
-		warn "could not bring up $pflog_dev."
-		return 1
+	# Do we need to create more devices?
+	unit=${pflog_dev#pflog}
+	max=$(sysctl -n net.pflog.if_count)
+	if [ "$unit" -ge "$max" ]; then
+		sysctl net.pflog.if_count=$(expr ${unit} + 1)
 	fi
 
 	# -p flag requires stripping pidfile's leading /var/run and trailing .pid
@@ -53,11 +46,6 @@ pflog_prestart()
 
 pflog_poststop()
 {
-	if ! ifconfig $pflog_dev down; then
-		warn "could not bring down $pflog_dev."
-		return 1
-	fi
-
 	if [ "$pflog_instances" ] && [ -n "$pflog_instances" ]; then
 		rm $pidfile
 	fi
-- 
cgit v1.3