From nobody Thu Sep 25 12:41:34 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cXYHf744bz68SCm; Thu, 25 Sep 2025 12:41:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cXYHf3Zv9z42gl; Thu, 25 Sep 2025 12:41:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1758804094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lRT/SOvsa77bY7AoukUKrNYqkIMQV+4ciP7qTVxYzAA=; b=IUZExYdZv/8SrDRE6Jy+hGbKd+WC7BRacwQo3HPvByHISf1IqxpqKKwYY9IFwH9PrvjQCY 1lZ6cMVfjfD/SDaZJa23GbxP4hckK9rXDF2UbYECQAjbtuy6e/JgKfrJOyDxolLR+vMUGb iqKL7XB7RRqzo+6AJq2hraPMDMgXtN5s/BFYXRZvm6mm7YdDxsBwf7W5Lvl96XYjpJj1V8 jC8N1zbtlqaJ6Lp6E8J5qDgV0ZsJSnei8GNQNR01QQufzT4+IJzVKs1MIa48pWJr+72JVe Xnl3nwxwV24xF4iZFz2kZ72fbABEFMOhJxwhxnVx2lc7rcSXakZhaWT0tq2pmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1758804094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lRT/SOvsa77bY7AoukUKrNYqkIMQV+4ciP7qTVxYzAA=; b=HBacz4NotpZZEa9fd9psipuDjgDA99xQNt0kuJVg1pm1cWsZSwSsioyOF7aRCkluC+PzH4 OFoULYhUFbdJaVZPcRa/twZYGTJEcK3M0KtWw3ASmPjL7hvImI2W8hehCyOBbCIIa4+sNu IxPM1jsGmDur45AojZybdKJXS2eGmPHCRpRod/AP5GT/ZW6b4rwK7WMGBf+gDgnvkSaOcL 8Ngf2kPZlnsfR2fykHlhdCQA6nKIa4gnCMnSKSbCVkkaH31EKEQEDywfLVe2bdH3pzvGvo MzRPhFpayZHTIT139DpNxucxjceYF+kiSI88DA3v6W80SmUHG8QZjCFS5uxvOw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1758804094; a=rsa-sha256; cv=none; b=v3JjjUcIqfNmeJwKbjx/n/ESIL5o83SdtH5v1U5ajIpI5KrtdP2qr9IOfytewivSdy7tEQ I0jRJPdIqEkgR29AF8G6QuaFDMfqstipj0o31HwjhWHyet7rZKiVcK+oh5gHyEDvQaS8jY D9AiJram+Brbuol2sYdlLk3q7biEGdt15xzSTP7duDK7lOc34XZpolfV4cxf2THc+skOpm MYR4drw9Ck0z2Y0T5qLCtDGdanVGLlm50ATx2Wofmh7LObdzEz3Fd8kbtDTXKaja/ufl6n ZQdLsqfj7Ip/NpcPICXUpGa2f3x7tiVRTYGZII3eC1T1kFDFeUJOZOWczvCV0g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4cXYHf30QHz1GsP; Thu, 25 Sep 2025 12:41:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 58PCfY9f000818; Thu, 25 Sep 2025 12:41:34 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 58PCfY5M000815; Thu, 25 Sep 2025 12:41:34 GMT (envelope-from git) Date: Thu, 25 Sep 2025 12:41:34 GMT Message-Id: <202509251241.58PCfY5M000815@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 882121672704 - main - pfctl: One shot rules can be used in pf.conf by specifying a "once" filter option. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8821216727043dde9cb23a66b884f7918c80063c Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8821216727043dde9cb23a66b884f7918c80063c commit 8821216727043dde9cb23a66b884f7918c80063c Author: Kristof Provost AuthorDate: 2025-08-27 13:41:07 +0000 Commit: Kristof Provost CommitDate: 2025-09-25 12:41:08 +0000 pfctl: One shot rules can be used in pf.conf by specifying a "once" filter option. ok henning, mcbride Obtained from: OpenBSD, mikeb , 44b1b5a8a9 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 17 +++++++++++++++-- sbin/pfctl/pfctl_parser.c | 2 ++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 0628b387b4b3..c35460f5443d 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -267,7 +267,7 @@ static struct filter_opts { #define FOM_SETTOS 0x0100 #define FOM_SCRUB_TCP 0x0200 #define FOM_SETPRIO 0x0400 -#define FOM_ONCE 0x1000 /* not yet implemmented */ +#define FOM_ONCE 0x1000 #define FOM_PRIO 0x2000 #define FOM_SETDELAY 0x4000 #define FOM_FRAGCACHE 0x8000 /* does not exist in OpenBSD */ @@ -541,7 +541,7 @@ int parseport(char *, struct range *r, int); %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL %token DNPIPE DNQUEUE RIDENTIFIER -%token LOAD RULESET_OPTIMIZATION PRIO +%token LOAD RULESET_OPTIMIZATION PRIO ONCE %token STICKYADDRESS ENDPI MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW ALLOW_RELATED %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS @@ -1061,6 +1061,12 @@ anchorrule : ANCHOR anchorname dir quick interface af proto fromto } } + if ($9.marker & FOM_ONCE) { + yyerror("cannot specify 'once' " + "on anchors"); + YYERROR; + } + if (filteropts_to_rule(&r, &$9)) YYERROR; @@ -2390,6 +2396,9 @@ pfrule : action dir logquick interface route af proto fromto r.quick = $3.quick; r.af = $6; + if ($9.marker & FOM_ONCE) + r.rule_flag |= PFRULE_ONCE; + if (filteropts_to_rule(&r, &$9)) YYERROR; @@ -3036,6 +3045,9 @@ filter_opt : USER uids { } filter_opts.max_pkt_size = $2; } + | ONCE { + filter_opts.marker |= FOM_ONCE; + } | filter_sets ; @@ -6725,6 +6737,7 @@ lookup(char *s) { "no-route", NOROUTE}, { "no-sync", NOSYNC}, { "on", ON}, + { "once", ONCE}, { "optimization", OPTIMIZATION}, { "os", OS}, { "out", OUT}, diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c index 9609e880584f..ce493570a25e 100644 --- a/sbin/pfctl/pfctl_parser.c +++ b/sbin/pfctl/pfctl_parser.c @@ -1234,6 +1234,8 @@ print_rule(struct pfctl_rule *r, const char *anchor_call, int verbose, int numer printf(" %s %d", r->free_flags & PFRULE_DN_IS_PIPE ? "dnpipe" : "dnqueue", r->dnpipe); + if (r->rule_flag & PFRULE_ONCE) + printf(" once"); if (r->qname[0] && r->pqname[0]) printf(" queue(%s, %s)", r->qname, r->pqname); else if (r->qname[0])