Date: Tue, 09 Dec 2025 11:18:43 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: c09ffa69b6c9 - stable/15 - pfctl: restore '-Tload -f pf.conf' functionality Message-ID: <69380593.3f25e.146738ab@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=c09ffa69b6c9f404e62dd07660abaa898f955c90 commit c09ffa69b6c9f404e62dd07660abaa898f955c90 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-12-01 15:05:09 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-12-09 10:47:33 +0000 pfctl: restore '-Tload -f pf.conf' functionality Allow only tables to be loaded from a file, rather than everything (i.e. including options, rules). Add a test case for this. PR: 291318 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 7a283c40188ff7b0a4bae1a47bbd9ecc17ded132) --- sbin/pfctl/pfctl.c | 3 ++- tests/sys/netpfil/pf/table.sh | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 48ae54dd2fec..19a20ce0ec3a 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -3326,7 +3326,8 @@ main(int argc, char *argv[]) if ((opts & PF_OPT_NODNS) && (opts & PF_OPT_USEDNS)) errx(1, "-N and -r are mutually exclusive"); - if ((tblcmdopt == NULL) ^ (tableopt == NULL)) + if ((tblcmdopt == NULL) ^ (tableopt == NULL) && + (tblcmdopt == NULL || *tblcmdopt != 'l')) usage(); if (tblcmdopt != NULL) { diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 65492545a13b..6f7c0939d31a 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -673,6 +673,40 @@ large_cleanup() pft_cleanup } +atf_test_case "load" "cleanup" +load_head() +{ + atf_set descr 'Test pfctl -T load (PR 291318)' + atf_set require.user root +} + +load_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + ifconfig ${epair_send}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair_send}b + jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + echo -e "table <private> persist { 172.16/12 }\nblock\npass in from <private>\n" \ + | atf_check -s exit:0 jexec alcatraz pfctl -Tload -f - + + atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 + + atf_check -s exit:0 -o not-match:"block" \ + jexec alcatraz pfctl -sr + atf_check -s exit:0 -o match:'172.16.0.0/12' \ + jexec alcatraz pfctl -Tshow -t private +} + +load_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4_counters" @@ -689,4 +723,5 @@ atf_init_test_cases() atf_add_test_case "anchor" atf_add_test_case "flush" atf_add_test_case "large" + atf_add_test_case "load" }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69380593.3f25e.146738ab>