aboutsummaryrefslogtreecommitdiff
path: root/lib/libpfctl
Commit message (Collapse)AuthorAgeFilesLines
* libpfctl: ensure we return useful error codesKristof Provost2024-09-291-9/+25
| | | | | | | | | | Return errno rather than -1 on error. This allows pfctl to report much more useful errors. Reported by: Alexander Leidinger <Alexander@Leidinger.net> MFC after: 1 week (cherry picked from commit 93e96359c980ccf318fe089b30b863f7c910b622)
* libpfctl: fix incorrect pcounters array sizeKristof Provost2024-05-132-2/+2
| | | | | | | | | The array is 2 x 2 x 2, not 2 x 2 x 3. Sponsored by: Rubicon Communications, LLC ("Netgate") MFC after: 2 weeks (cherry picked from commit a3f7176523e8611b259cefd7431c01e24f446db7)
* libpfctl: handle pfctl_do_ioctl() failures betterKristof Provost2023-11-241-18/+24
| | | | | | | | | | Ensure that we free nvlists and other allocations if pfctl_do_ioctl() fails. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 498934c5ff51e6b0d3199db5d27ed11b1e8b9582)
* libpfctl: handle allocation failureKristof Provost2023-11-241-0/+7
| | | | | | | | | | | While it's unlikely for userspace to fail to allocate memory it is still possible. Handle malloc() returning NULL. Reported by: Bill Meeks <bill@themeeks.net> MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 33d55d0d0f33787e9e2796b5000be73af42573bc)
* pf: expose more syncookie state information to userspaceKristof Provost2023-11-132-0/+2
| | | | | | | | | | Allow userspace to retrieve low and high water marks, as well as the current number of half open states. MFC after: 1 week Sponsored by: Modirum MDPay (cherry picked from commit a6173e94635b03aa7aab90a67785c8c3e7c6247b)
* libpfctl: be more tolerant of kernel extensionsKristof Provost2023-11-071-2/+1
| | | | | | | | | | | | | Allow the kernel to supply more array elements than expected, but cut off when we hit what we think the maximum is. This will improve forward compatibility (i.e. old userspace with newer kernel). Reviewed by: zlei MFC after: 1 week Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D42392 (cherry picked from commit 2b1eb63fc9c6d6f64baaac59b7ea7c2a3228c03f)
* libpfctl: remove unused field from struct pfctl_statesKristof Provost2023-11-021-1/+0
| | | | | | | | | We never populate this, or use it, so remove it. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 87c5032353106764f324e82541662f448e68f38a)
* libpfctl: add missing pfctl_status_lcounter() functionKristof Provost2023-11-022-0/+7
| | | | | | | | | | We already had accessors for the other types of counters, but not this one. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 1c824f430a395cdc66e22406e72f20ebd300e47e)
* libpfctl: fix Coverity issuesKristof Provost2023-11-011-2/+4
| | | | | | | | | | | | | | | - handle snl_finalize_msg() returning NULL - insert the correct data into the states list - add missing nvlist_destroy() - incorrect order for array bounds Coverity: 1522929, 1522925, 1522923, 1522921, 1522780, 1522770, 1522764, 1487785, 1471250 Reviewed by: emaste MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42330 (cherry picked from commit 4abc3b482e0d246cd3518622223795c8de102130)
* libpfctl: fix pfctl_do_ioctl()Kristof Provost2023-11-011-3/+4
| | | | | | | | | | | | | | | | | pfctl_do_ioctl() copies the packed request data into the request buffer and then frees it. However, it's possible for the buffer to be too small for the reply, causing us to allocate a new buffer. We then copied from the freed request, and freed it again. Do not free the request buffer until we're all the way done. PR: 274614 Reviewed by: emaste MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42329 (cherry picked from commit 2cffb52514b070e716e700c7f58fdb8cd9b05335)
* libpfctl: implement status counter accessor functionsKristof Provost2023-09-092-0/+34
| | | | | | | | | | | | | | The new nvlist-based status call allows us to easily add new counters. However, the libpfctl interface defines a TAILQ, so it's not quite trivial to find the counter consumers are interested in. Provide convenience functions to access the counters. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D41649 (cherry picked from commit e3d3d61a7d94a4155ef70048a8b578985fca8383)
* libpfctl: allow pfctl_free_status(NULL)Kristof Provost2023-09-091-0/+3
| | | | | | | | | | Mimic free() and friends, and allow free()ing of NULL. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D41648 (cherry picked from commit 0b01878fd00b128ce3dead119b37781048744d39)
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-162-4/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* libpfct: ensure the initial allocation is large enoughKristof Provost2023-07-261-0/+2
| | | | | | | | | Ensure that we allocate enough memory for the packed nvlist, no matter what size hint was provided. MFC after: 1 week Reported by: R. Christian McDonald <rcm@rcm.sh> Sponsored by: Rubicon Communications, LLC ("Netgate")
* pfctl: Add missing state parameters in DIOCGETSTATESV2Kajetan Staszkiewicz2023-05-302-2/+26
| | | | | | Reviewed by: kp Sponsored by: InnoGames GmbH Different Revision: https://reviews.freebsd.org/D40259
* pf: introduce ridentifier and labels to ether rulesChristian McDonald2023-04-262-1/+22
| | | | | | | | Make Ethernet rules more similar to the usual layer 3 rules by also allowing ridentifier and labels to be set on them. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate")
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-191-0/+0
|
* pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rulesKajetan Staszkiewicz2023-04-142-1/+3
| | | | | | | | | | | Introduce the OpenBSD syntax of "scrub" option for "match" and "pass" rules and the "set reassemble" flag. The patch is backward-compatible, pf.conf can be still written in FreeBSD-style. Obtained from: OpenBSD MFC after: never Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38025
* libpfctl: Don't pass stack garbage to free.John Baldwin2023-03-221-2/+0
| | | | | | | | GCC 9 on stable/12 reports a -Wmaybe-uninitialized error for the call to free in _pfctl_clear_states. Reviewed by: mjg Differential Revision: https://reviews.freebsd.org/D39198
* pf: bridge-toKristof Provost2022-11-022-0/+6
| | | | | | | | | | | | Allow pf (l2) to be used to redirect ethernet packets to a different interface. The intended use case is to send 802.1x challenges out to a side interface, to enable AT&T links to function with pfSense as a gateway, rather than the AT&T provided hardware. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D37193
* pf: expose syncookie active/inactive statusKristof Provost2022-10-312-0/+2
| | | | | | | | When syncookies are in adaptive mode they may be active or inactive. Expose this status to users. Suggested by: Guido van Rooij Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: use time_to for timestampsKristof Provost2022-10-051-2/+2
| | | | | | | | | | Use time_t rather than uint32_t to represent the timestamps. That means we have 64 bits rather than 32 on all platforms except i386, avoiding the Y2K38 issues on most platforms. Reviewed by: Zhenlei Huang Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D36837
* libpfctl: improve syncookie watermark calculationKristof Provost2022-09-121-2/+10
| | | | | | | | | | | | | | | Ensure that we always pass sane limits for the high and low watermark values. This is especially important if users do something silly, like set the state limit to 1. In that case we wound up calculating 0/0 as a limit, which gets rejected by the kernel. While here also shift the calculation to use uint64_t, so we don't end up with overflows (and subsequently higher low than high values) with very large state limits. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D36497
* pf: support matching on tags for Ethernet rulesKristof Provost2022-06-202-0/+9
| | | | | Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D35362
* pf: Add per-rule timestamps for rule and eth_ruleReid Linnemann2022-04-222-1/+11
| | | | | | | | | | | Similar to ipfw rule timestamps, these timestamps internally are uint32_t snaps of the system time in seconds. The timestamp is CPU local and updated each time a rule or a state associated with a rule or state is matched. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34970
* libpfctl: grow request buffer on ENOSPCKristof Provost2022-04-201-139/+61
| | | | | | | | | | | | | When we issue a request to pf and expect a serialised nvlist as a reply we have to supply a suitable buffer to the kernel. The required size for this buffer is difficult to predict, and may be (slightly) different from request to request. If it's insufficient the kernel will return ENOSPC. Teach libpfctl to catch this and send the request again with a larger buffer. MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34908
* libpfctl: relocate implementations of pfr_add/get/set_addrsReid Linnemann2022-04-042-1/+105
| | | | | | Reviewed by: kp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D34740
* pf: handle duplicate rules gracefullyMateusz Guzik2022-04-011-0/+2
| | | | | | | Reviewed by: kp Reported by: dch PR: 262971 Sponsored by: Rubicon Communications, LLC ("Netgate")
* libpfct: Return errno from pfctl_add_eth_rule()Kristof Provost2022-03-301-2/+3
| | | | | | | | If the pfctl_add_eth_rule() ioctl fails return the errno, not the error returned by ioctl(). That will give us slightly more insight into what went wrong, because ioctl() would always return -1. Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: support listing ethernet anchorsKristof Provost2022-03-302-0/+89
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: support basic L3 filtering in the Ethernet rulesKristof Provost2022-03-142-1/+10
| | | | | | | | | Allow filtering based on the source or destination IP/IPv6 address in the Ethernet layer rules. Reviewed by: pauamma_gundo.com (man), debdrup (man) Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34482
* libpfct: factor out pfctl_get_rules_info()Kristof Provost2022-03-082-0/+29
| | | | | | | | | | | Introduce pfctl_get_rules_info(), similar to pfctl_get_eth_rules_info() to retrieve rules information (ticket and total number of rules). Use the new function in pfctl. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34443
* libpfctl: support flushing rules/nat/ethKristof Provost2022-03-082-0/+92
| | | | | | | | | Move the code to flush regular rules, nat rules and Ethernet rules into libpfctl for easier re-use. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34442
* pf: support masking mac addressesKristof Provost2022-03-022-0/+6
| | | | | | | | | When filtering Ethernet packets allow rules to specify a mac address with a mask. This indicates which bits of the specified address are significant. This allows users to do things like filter based on device manufacturer. Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: add anchor support for ether rulesKristof Provost2022-03-022-8/+51
| | | | | | | Support anchors in ether rules. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32482
* pf: support dummynet on L2 rulesKristof Provost2022-03-022-0/+8
| | | | | | | | | | Allow packets to be tagged with dummynet information. Note that we do not apply dummynet shaping on the L2 traffic, but instead mark it for dummynet processing in the L3 code. This is the same approach as we take for ALTQ. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32222
* pfctl: Don't print (ether) to / from if they're not setKristof Provost2022-03-022-0/+5
| | | | | | | | If we're not filtering on a specific MAC address don't print it at all, rather than showing an all-zero address. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31749
* pfctl: Print Ethernet rulesKristof Provost2022-03-022-0/+221
| | | | | | | | Extent pfctl to be able to read configured Ethernet filtering rules from the kernel and print them. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31738
* libpfctl: fix pfctl_kill_states()Kristof Provost2022-01-311-1/+1
| | | | | | | | | | 735748f30a changed the output of the states so that the creator id endianness would be consistent. This means that we need to convert the host endianness creatorid back to big-endian before we give it to the kernel. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
* libpfctl: fix creatorid endiannessKristof Provost2022-01-271-2/+2
| | | | | | | | | | | | | We provide the hostid (which is the state creatorid) to the kernel as a big endian number (see pfctl/pfctl.c pfctl_set_hostid()), so convert it back to system endianness when we get it from the kernel. This avoids a confusing mismatch between the value the user configures and the value displayed in the state. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33989
* pf tests: Test PR259689Kristof Provost2021-11-101-1/+1
| | | | | | | | | | We didn't populate dyncnt/tblcnt, so `pfctl -sr -vv` might not have the table element count. PR: 259689 MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32893
* pf: ensure we populate dyncnt/tblcnt in struct pf_addr_wrapKristof Provost2021-11-101-2/+8
| | | | | | | PR: 259689 MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32892
* libpfct: be consistent with u_int vs. uintKristof Provost2021-11-052-81/+81
| | | | | | | | | Always use uint64_t over u_int64_t, for the sake of consistency. No functional change. MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: Introduce ridentifierKristof Provost2021-11-052-0/+3
| | | | | | | | | | | | | Allow users to set a number on rules which will be exposed as part of the pflog header. The intent behind this is to allow users to correlate rules across updates (remember that pf rules continue to exist and match existing states, even if they're removed from the active ruleset) and pflog. Obtained from: pfSense MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32750
* pfctl: userspace adaptive syncookies configrationKristof Provost2021-09-292-6/+55
| | | | | | | | Hook up the userspace bits to configure syncookies in adaptive mode. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D32136
* pf: support dummynetKristof Provost2021-09-242-0/+9
| | | | | | | | | | | | Allow pf to use dummynet pipes and queues. We re-use the currently unused IPFW_IS_DUMMYNET flag to allow dummynet to tell us that a packet is being re-injected after being delayed. This is needed to avoid endlessly looping the packet between pf and dummynet. MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31904
* libpfctl: Implement DIOCGETSTATUS wrappersKristof Provost2021-08-292-0/+145
| | | | | | MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31696
* libpfctl: fix double freeKristof Provost2021-08-291-1/+0
| | | | | | | Reviewed by: donner MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31695
* libpfctl: Fix endianness issuesKristof Provost2021-08-201-5/+5
| | | | | | | | Several fields are supplied in big-endian format, so we need to convert them before we display them. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate")
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-19 07:51:23 +0000