From nobody Mon Dec 1 21:31:21 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dKxt16D95z6Hhlb for ; Mon, 01 Dec 2025 21:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dKxt148X1z3HRN for ; Mon, 01 Dec 2025 21:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764624681; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deoyrXGU3HXZQwcGPO89faoHW+MD84k/Mtr34EIs0KY=; b=ye7/iNji4450PidDeaEpXYI3MmO9d95EI4BPRZtQMoAzqa6NXjrdfZkC2CEnGZPrpgCPHp qSp95zI5EfTv8B7VKVy3iqbzcM0JozAaXkU3tAABRh+cEaXqhi+hejKtu4aF/hQarrhQp7 xbQLFv6RaGbACwhJYHnZaOR+5EGQY2ZOxiXLsdwfdgHk8NFL9ot8Rmt0i0klrHzw2DDTYu uuy9ILEWcvdDwPtLYAbT+42JiXiCJ/pWHUDCoALfqygnA7GrLEcGdHHRpG4eNpuoqSIZ6W oslhR+A36lr4yfGhpuKhEc0Ixtpgcjeu12Jx3oIhkQS3nYSS0NFsCNLxePruNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764624681; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deoyrXGU3HXZQwcGPO89faoHW+MD84k/Mtr34EIs0KY=; b=MYdaA8oHN733ELx174iYNWJezasH4z3rax23u/4dWmvEhcp9N83YHRzdYdODhpdLbPH5dA VRLWnk8O+NEkqqOK10+7w5r+BOfQw2nSzyCsAJCzhlf/AjFB9+pqfh5JfaEhMpwZkTq8q7 gqecmatj1evu0bzB5RgHaD/3l3+MTibjGplfPtpOgdoU/0n7Q6ikneQArAwtcxI5vZwOD7 rp68b9hp4AC+AdlXO01KoBt4gGy3+ON5xrFYJJLpswY61WkpeppG5Hw5qE3dRtZXavU59M oW21GkWBn439a7hwBhtcjFrIBP+LNo0+4vhNbkjMvPUlBGasvgIliKqOYg5+3Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1764624681; a=rsa-sha256; cv=none; b=f+cVFXOyfwL/lYlkcQVOBSkXM1IohHTIkzjFx5oFGpRIdmP8iPTERRGC+Kpwxr3KPdenWo wbYAExhrx6dj5rGl98ryfED3aT1xmn1/WmcTIYTZvHNIB1OjqifxGDKtCrmBM8QpVJBVGb 20yx2ZJjY/DCNAnk/lNxudlrrKws7LKxCuOWNMZAN2uCtO17wZk0GksY8ncsCdMZ9Po45H DTB3DMHEuTtnNSQ5Xk72tPov+QTAHGw/pP3rG50o3qKqFnVnLg25VakiM7NMhmYrpSfpMm sw1xVFvg/bNEsGRB4ZQ5tXgzEaqNibq3PMX2vDYbsLLbsCddQl0meUCBZDk8XA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dKxt13QgCzdJ4 for ; Mon, 01 Dec 2025 21:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3552a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 01 Dec 2025 21:31:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 7a283c40188f - main - pfctl: restore '-Tload -f pf.conf' functionality List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7a283c40188ff7b0a4bae1a47bbd9ecc17ded132 Auto-Submitted: auto-generated Date: Mon, 01 Dec 2025 21:31:21 +0000 Message-Id: <692e0929.3552a.7b0a98e@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7a283c40188ff7b0a4bae1a47bbd9ecc17ded132 commit 7a283c40188ff7b0a4bae1a47bbd9ecc17ded132 Author: Kristof Provost AuthorDate: 2025-12-01 15:05:09 +0000 Commit: Kristof Provost CommitDate: 2025-12-01 21:30:30 +0000 pfctl: restore '-Tload -f pf.conf' functionality Allow only tables to be loaded from a file, rather than everything (i.e. including options, rules). Add a test case for this. PR: 291318 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/pfctl.c | 3 ++- tests/sys/netpfil/pf/table.sh | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index ae3599b9e4e5..5ab4687dd35f 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -3406,7 +3406,8 @@ main(int argc, char *argv[]) if ((opts & PF_OPT_NODNS) && (opts & PF_OPT_USEDNS)) errx(1, "-N and -r are mutually exclusive"); - if ((tblcmdopt == NULL) ^ (tableopt == NULL)) + if ((tblcmdopt == NULL) ^ (tableopt == NULL) && + (tblcmdopt == NULL || *tblcmdopt != 'l')) usage(); if (tblcmdopt != NULL) { diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 6761ce652beb..0b2b56592404 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -808,6 +808,40 @@ replace_cleanup() pft_cleanup } +atf_test_case "load" "cleanup" +load_head() +{ + atf_set descr 'Test pfctl -T load (PR 291318)' + atf_set require.user root +} + +load_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + ifconfig ${epair_send}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair_send}b + jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + echo -e "table persist { 172.16/12 }\nblock\npass in from \n" \ + | atf_check -s exit:0 jexec alcatraz pfctl -Tload -f - + + atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 + + atf_check -s exit:0 -o not-match:"block" \ + jexec alcatraz pfctl -sr + atf_check -s exit:0 -o match:'172.16.0.0/12' \ + jexec alcatraz pfctl -Tshow -t private +} + +load_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4_counters" @@ -827,4 +861,5 @@ atf_init_test_cases() atf_add_test_case "show_recursive" atf_add_test_case "in_anchor" atf_add_test_case "replace" + atf_add_test_case "load" }