From nobody Sat Jul 12 13:38:52 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bfV6N4wcnz61srK; Sat, 12 Jul 2025 13:38:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bfV6N3dWRz3Cl6; Sat, 12 Jul 2025 13:38:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752327532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iKHM7XRrmseoP3YwVQ+schDtahHKA/pz9Uq0Ex8HINA=; b=gszc80Cl48YFOaP23Twh2itpNzsJYhvL9wW3U1cD3/c5D81aq1sY0s9MsablM2rJkmf1ou 3ySlAjZek+EAz/NPieF9A5aZiwQyBX7YDPvdkU+aCaIBPHvXTKrjXjGfDzMsJ2FriMOB0l +TEQMu4jJ8udokvQGGDsZt+lXGhkM2sqW5a3Rtjk+TqBoISWHOTsxu0kNmC9YkJXFzuUya uK4Of/NKMGd8KsVDmCjajMafNPee3Arx2RfRcSk3AZV2DwCQOmhe12aFKcX+2CO/ZgahFX C9DwqnSrf0rmRiXBJh239o6NsCZOBKNHmiURRoNv3QcPIaMITYx0CPga/2qIoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752327532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iKHM7XRrmseoP3YwVQ+schDtahHKA/pz9Uq0Ex8HINA=; b=qzKUZroSpCudIHwfkVAQEDqomeoF034J/7602cea25r7Hfv6vnd4M2LLa+QQh6Lv+Ndj6z KKwcCyH/znh4sOoHkhWJqC7GfZU5vKJ7dP/vtC5bn7jgMzr8IuENb0DSLLNvyphDvtCddi ku6SMHB2iNCSxrm3TwWyDhkyBSSDN1qrWdgSKDsgc9NOba5exiR5FhOHKY3SQThQeQV+75 85P5gPKmCdMXHt7Kxa9VOD7sAPhd47is7NcKkWWbhG2KTBx5jG/qtao4xXjumTcB9khnDy OjVz+vlXLJPx3Yz0YmF9E3TVSEH5QbhYBR5W4fSxDMGEGknl10Fj5c88fmc2rg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1752327532; a=rsa-sha256; cv=none; b=dXGZfrFe//egJLRGrbVnqslTm0xt78ealFVO3LcMels8HntqvwDQD05FbacMbm5RO7aRhR owdjUNO9N1UnSZHeYvYRJr7nr2nTqEJ45NW4twt2lzyvuSi5opa1K3d2RKVSkSNYh75R6o 9sqECHhWlb0lZlZAoKr3s10IS/K1RwewRjSui0ssCKB5y6OPv9RP9sNTr1wvaLM+5gusjy ftcO4kTkDkK62Mm+x0UsWAtL1pWtL69Y/JR+lYRQEy8iv1M6PXCgr4A8KhlMZjSoVQKoH6 l7j0CbFxkEALL4ZQFfXcn+tILLyxpHAc9wBoGuL+qLg00szy0HYM0Ta/ZZ2FmQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bfV6N2xnGz95s; Sat, 12 Jul 2025 13:38:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56CDcqet088960; Sat, 12 Jul 2025 13:38:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56CDcqmn088957; Sat, 12 Jul 2025 13:38:52 GMT (envelope-from git) Date: Sat, 12 Jul 2025 13:38:52 GMT Message-Id: <202507121338.56CDcqmn088957@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 1ae17b65b676 - main - pf.conf.5: should clearly state range match operator ':' does not work for uid/gid. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1ae17b65b676d0bfa291b193aa4b70ba6f993aaf Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=1ae17b65b676d0bfa291b193aa4b70ba6f993aaf commit 1ae17b65b676d0bfa291b193aa4b70ba6f993aaf Author: Kristof Provost AuthorDate: 2025-07-07 07:12:36 +0000 Commit: Kristof Provost CommitDate: 2025-07-12 09:57:51 +0000 pf.conf.5: should clearly state range match operator ':' does not work for uid/gid. OK @kn, OK @sthen Obtained from: OpenBSD, sashan , 4521e23a38 Sponsored by: Rubicon Communications, LLC ("Netgate") --- share/man/man5/pf.conf.5 | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index fe848b030484..b5843d67e106 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -27,7 +27,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd July 2, 2025 +.Dd July 7, 2025 .Dt PF.CONF 5 .Os .Sh NAME @@ -2047,6 +2047,21 @@ connections: block out proto { tcp, udp } all pass out proto { tcp, udp } all user { < 1000, dhartmei } .Ed +.Pp +The example below permits users with uid between 1000 and 1500 +to open connections: +.Bd -literal -offset indent +block out proto tcp all +pass out proto tcp from self user { 999 >< 1501 } +.Ed +.Pp +The +.Sq \&: +operator, which works for port number matching, does not work for +.Cm user +and +.Cm group +match. .It Xo Ar flags Aq Ar a .Pf / Ns Aq Ar b .No \*(Ba / Ns Aq Ar b