src/lib/libpfctl/libpfctl.c, branch releng/14.0

Remove $FreeBSD$: two-line .h pattern

2023-08-16T17:54:16+00:00

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/

libpfct: ensure the initial allocation is large enough

2023-07-26T08:30:22+00:00

Ensure that we allocate enough memory for the packed nvlist, no matter
what size hint was provided.

MFC after:	1 week
Reported by:	R. Christian McDonald 
Sponsored by:	Rubicon Communications, LLC ("Netgate")

pfctl: Add missing state parameters in DIOCGETSTATESV2

2023-05-30T12:28:57+00:00

Reviewed by:	kp
Sponsored by:	InnoGames GmbH
Different Revision:	https://reviews.freebsd.org/D40259

pf: introduce ridentifier and labels to ether rules

2023-04-26T09:14:41+00:00

Make Ethernet rules more similar to the usual layer 3 rules by also
allowing ridentifier and labels to be set on them.

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")

pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rules

2023-04-14T07:04:06+00:00

Introduce the OpenBSD syntax of "scrub" option for "match" and "pass"
rules and the "set reassemble" flag. The patch is backward-compatible,
pf.conf can be still written in FreeBSD-style.

Obtained from:	OpenBSD
MFC after:	never
Sponsored by:	InnoGames GmbH
Differential Revision:	https://reviews.freebsd.org/D38025

libpfctl: Don't pass stack garbage to free.

2023-03-22T19:33:59+00:00

GCC 9 on stable/12 reports a -Wmaybe-uninitialized error for the call
to free in _pfctl_clear_states.

Reviewed by:	mjg
Differential Revision:	https://reviews.freebsd.org/D39198

pf: bridge-to

2022-11-02T14:45:23+00:00

Allow pf (l2) to be used to redirect ethernet packets to a different
interface.

The intended use case is to send 802.1x challenges out to a side
interface, to enable AT&T links to function with pfSense as a gateway,
rather than the AT&T provided hardware.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D37193

pf: expose syncookie active/inactive status

2022-10-31T17:14:09+00:00

When syncookies are in adaptive mode they may be active or inactive.
Expose this status to users.

Suggested by:	Guido van Rooij
Sponsored by:	Rubicon Communications, LLC ("Netgate")

libpfctl: improve syncookie watermark calculation

2022-09-12T07:32:02+00:00

Ensure that we always pass sane limits for the high and low watermark
values.
This is especially important if users do something silly, like set the
state limit to 1. In that case we wound up calculating 0/0 as a limit,
which gets rejected by the kernel.

While here also shift the calculation to use uint64_t, so we don't end
up with overflows (and subsequently higher low than high values) with
very large state limits.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D36497

pf: support matching on tags for Ethernet rules

2022-06-20T08:16:20+00:00

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D35362