From nobody Tue Dec 9 11:18:43 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dQbvR64Zyz6KQVv for ; Tue, 09 Dec 2025 11:18:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dQbvR4fD3z3VvW for ; Tue, 09 Dec 2025 11:18:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765279123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eFlyQyC5FzCSZn30dmMnmImRD1HjZM+NNcO1B7auorc=; b=Vp6J2ImIHyssfyXlWhP1bbaWoyGYrvPk2YxgcWLnGMHIsL6cao2UHAEEuH9kcdbKG019vn ndytHj3SDdKxHukkYbhcjYdGiASDoJANM8IyGQxiKvDZB7fxT5DnUhkSsVSITCoa62Dpoq GJ8Cfev5wwxp7SsxBOPVHSrsjZw5YEnn+LwE2oDF7RjfgUQV7dWijaHim8u49NRFPrJxHr 1uzpWcR9IHFDNaMIf5J739rr3AYp7RmrTvuW0R/87WOsGtb+J0NIJ4K06ymmmV3ug6hKnu soxmtgyZfGzUjS4As/R4NSiOPHqiGqGyDm8gU+TFFmHC1RmG0Pd71QPwOSLaZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765279123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eFlyQyC5FzCSZn30dmMnmImRD1HjZM+NNcO1B7auorc=; b=l0prC0FATybIdZ8GdgX83pKDds4T8SeZz5X7GL4Ga1+0IZI+1kF0lZW7K1DbM8smo4QgEs 0CXDIxsAcNYHSKMwv9FR/edtdGqcJ8MI0E/WiYccbp5pQDjx/8hyPa6xn10fHIMTIvMJtL FSgIVAW99Q+j/Kjqc6n6Dchlsjyi5VktqnOKjOeaODC6I0fT8RST9NrR2jkFcghQUM1/go PB4Bx9zglvxqiw8hmk+LHsSLisMNd0mm/fCApGTCzxc6aUs93cvBHGoihTHmk4Ciszm2dK SdpwDHP+OrEGnCrMpKcy/AhgBFEoV9M7vXlIPVhKC/15illw3dQiD+cUrHfJCg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765279123; a=rsa-sha256; cv=none; b=lSEuAW3exSBcp+RdVCntW7JHVxBUGSwtQjqAQUScDB5iGXoK7kADajJzKlEBJSDiKXIzQW ZEjMa+m8zXmnMxYhbytKadMlNpEC0q9U8omzIwXFXU2WtIfCOOqdqBp7JQGDlGLKHmqcB2 bkOddisvdicXGSkzHpd2Twzk153VHFcl4yL9nVyGAIFluDv6o+CxraFMj58M0gJ72+FToh qbsJCK8yoYAO3H+PUWfcJ7gxR2GDPwrh1O3cjiGMwCHATHw86pgWDgNWLxCI8p+lUntn68 9j699lEaD3g80fmUd5PIor1syFjejPfach9L3R47aPTAVLu9rC604fa8jamrdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dQbvR470YzwlY for ; Tue, 09 Dec 2025 11:18:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f25e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 09 Dec 2025 11:18:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: c09ffa69b6c9 - stable/15 - pfctl: restore '-Tload -f pf.conf' functionality List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c09ffa69b6c9f404e62dd07660abaa898f955c90 Auto-Submitted: auto-generated Date: Tue, 09 Dec 2025 11:18:43 +0000 Message-Id: <69380593.3f25e.146738ab@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=c09ffa69b6c9f404e62dd07660abaa898f955c90 commit c09ffa69b6c9f404e62dd07660abaa898f955c90 Author: Kristof Provost AuthorDate: 2025-12-01 15:05:09 +0000 Commit: Kristof Provost CommitDate: 2025-12-09 10:47:33 +0000 pfctl: restore '-Tload -f pf.conf' functionality Allow only tables to be loaded from a file, rather than everything (i.e. including options, rules). Add a test case for this. PR: 291318 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 7a283c40188ff7b0a4bae1a47bbd9ecc17ded132) --- sbin/pfctl/pfctl.c | 3 ++- tests/sys/netpfil/pf/table.sh | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 48ae54dd2fec..19a20ce0ec3a 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -3326,7 +3326,8 @@ main(int argc, char *argv[]) if ((opts & PF_OPT_NODNS) && (opts & PF_OPT_USEDNS)) errx(1, "-N and -r are mutually exclusive"); - if ((tblcmdopt == NULL) ^ (tableopt == NULL)) + if ((tblcmdopt == NULL) ^ (tableopt == NULL) && + (tblcmdopt == NULL || *tblcmdopt != 'l')) usage(); if (tblcmdopt != NULL) { diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 65492545a13b..6f7c0939d31a 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -673,6 +673,40 @@ large_cleanup() pft_cleanup } +atf_test_case "load" "cleanup" +load_head() +{ + atf_set descr 'Test pfctl -T load (PR 291318)' + atf_set require.user root +} + +load_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + ifconfig ${epair_send}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair_send}b + jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + echo -e "table persist { 172.16/12 }\nblock\npass in from \n" \ + | atf_check -s exit:0 jexec alcatraz pfctl -Tload -f - + + atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 + + atf_check -s exit:0 -o not-match:"block" \ + jexec alcatraz pfctl -sr + atf_check -s exit:0 -o match:'172.16.0.0/12' \ + jexec alcatraz pfctl -Tshow -t private +} + +load_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4_counters" @@ -689,4 +723,5 @@ atf_init_test_cases() atf_add_test_case "anchor" atf_add_test_case "flush" atf_add_test_case "large" + atf_add_test_case "load" }