From nobody Fri Aug 11 12:13:40 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RMjPd27D4z4TjNW; Fri, 11 Aug 2023 12:13:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RMjPd0ggfz3glP; Fri, 11 Aug 2023 12:13:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691756021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=a3YG4t29lqQ8Y9J48nwGPvX2ZFhE2GtBwO8OyMQAFws=; b=iGexz/fd73GYjBhByn58VMSbszSKMZ/rjlby31W1BAbbbtVUUHYtpb6QvAuzw7OwqXmkyI Mp7zt8CqTktcAE4P6HsqY7rDciCr/huZYGmfi1VsK/MYXfn7OVl58oBAxONqvrQhRhCWTM 4ALPokwvOm5C8WX0mDMsOEMU/Is0X+pxS7nnGRwafIzQEgL/Xu5sskga3MiEEIi6Eu32Bu gpynDDgNcPZMbj1Cgkc9vPTpcf9ExpWgPHeyZE3sRLedoMXsy5iMg1DWxUg6kwCpwixx5q Mkzfk45UfOa8JkcTDvgGJFO7+tnWatBjOh6+y5bufKTZFX8yL8qSgDlHxxjQqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691756021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=a3YG4t29lqQ8Y9J48nwGPvX2ZFhE2GtBwO8OyMQAFws=; b=hYLIaE52h9mWyd8qR1IdXjlwim4wCDjyO2m8P+IAPONH0ilvRbRjYuxwJaLPQqCJxS84ke hK9GEScHYDaPFtSU5r8dhUpZgthHBHuQK76YXjOaWJ7kNTiElDFkOlcARBivbsxKuUnHh8 L56rlB0LU2nmkUaMWwGa3fE+MPPy73oE66ET4RdLk7MK6uhHrhShEU6ERUAexiDSLoRcGL AFiWXOZgc21tq8ytd2686X5yzB/GVSQMMVEm3XjJJtX1XoCkbpgeBxA01zXc5XP1+bGUpY MmW+mFmqf22jhXzUV5DYH0HXnfQ2akP3m6PNlj3LO5x4SyY1ra8vwKJYAAUspQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1691756021; a=rsa-sha256; cv=none; b=J8UcCeCpYg4yxJ0Rn/wPGFiVeiYg658wVIOnYMA6ZTnOJ2/ltQMR82OMHJf8newyCv1BlY amojlArukbrBkE1B3LuaUHURMgYkRUEKdThbnm0e2Qwhv43dR7zhPwmtbTjteYnDBY6PsR IPfKj3cYvpB+yQMHkh0b8jLDEUMFfNiKaD9P+Fn0abW54hWBfjJSSsYUNp45tBc4QoCZA5 oTEynEvPDyf5FqzaDnxo63jQn3dxM33Jx6nh8C5bWc6R/RgwnC/3PpCvuBPjYTQg7m3q78 KM4TyE8w8SXYaB2FPeI1t7G0cz7wMIhm2FGSQRlANpG3x8OQi9TmeBoQKClj1w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RMjPc6XR8zdpf; Fri, 11 Aug 2023 12:13:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 37BCDeXU008852; Fri, 11 Aug 2023 12:13:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 37BCDeGl008849; Fri, 11 Aug 2023 12:13:40 GMT (envelope-from git) Date: Fri, 11 Aug 2023 12:13:40 GMT Message-Id: <202308111213.37BCDeGl008849@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: c46419526269 - stable/13 - pf.conf.5: document SCTP support List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: c46419526269025a797a365a240b8fcd307e4281 Auto-Submitted: auto-generated The branch stable/13 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=c46419526269025a797a365a240b8fcd307e4281 commit c46419526269025a797a365a240b8fcd307e4281 Author: Kristof Provost AuthorDate: 2023-06-21 08:04:07 +0000 Commit: Kristof Provost CommitDate: 2023-08-11 12:13:10 +0000 pf.conf.5: document SCTP support Mention SCTP in the pf.conf.5 Reviewed by: tuexen MFC after: 3 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D40870 (cherry picked from commit 47d0c1fe7d3279e9d38df75cf0c359b1fbc26d5e) --- share/man/man5/pf.conf.5 | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index cc1b902e0006..95710027bdf3 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -28,7 +28,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd September 25, 2021 +.Dd June 21, 2023 .Dt PF.CONF 5 .Os .Sh NAME @@ -491,6 +491,7 @@ action: Packet is silently dropped. .It Ar return A TCP RST is returned for blocked TCP packets, +an SCTP ABORT chunk is returned for blocked SCTP packets, an ICMP UNREACHABLE is returned for blocked UDP packets, and all other packets are silently dropped. .El @@ -515,6 +516,7 @@ actions are possible: Incoming packet is silently dropped. .It Ar return Incoming packet is dropped and TCP RST is returned for TCP packets, +an SCTP ABORT chunk is returned for blocked SCTP packets, an ICMP UNREACHABLE is returned for UDP packets, and no response is sent for other packets. .El @@ -1139,8 +1141,8 @@ A stateful connection is automatically created to track packets matching such a rule as long as they are not blocked by the filtering section of .Nm pf.conf . The translation engine modifies the specified address and/or port in the -packet, recalculates IP, TCP and UDP checksums as necessary, and passes it to -the packet filter for evaluation. +packet, recalculates IP, TCP and UDP checksums as necessary, and passes +it to the packet filter for evaluation. .Pp Since translation occurs before filtering the filter engine will see packets as they look after any @@ -1276,6 +1278,7 @@ and layer 4 (see .Xr icmp 4 , .Xr icmp6 4 , .Xr tcp 4 , +.Xr sctp 4 , .Xr udp 4 ) headers. In addition, packets may also be @@ -1325,7 +1328,8 @@ can be overridden by specifying a message as a code or number. .It Ar return This causes a TCP RST to be returned for .Xr tcp 4 -packets and an ICMP UNREACHABLE for UDP and other packets. +packets, an SCTP ABORT for SCTP +and an ICMP UNREACHABLE for UDP and other packets. .El .Pp Options returning ICMP packets currently have no effect if @@ -1515,6 +1519,7 @@ Common protocols are .Xr icmp 4 , .Xr icmp6 4 , .Xr tcp 4 , +.Xr sctp 4 , and .Xr udp 4 . For a list of all the protocol name to number mappings used by @@ -2717,6 +2722,14 @@ reference to an anchor name containing characters will require double quote .Pq Sq \&" characters around the anchor name. +.Sh SCTP CONSIDERATIONS +.Xr pf 4 +supports +.Xr sctp 4 +connections. +It can match ports, track state and NAT SCTP traffic. +However, it will not alter port numbers during nat or rdr translations. +Doing so would break SCTP multihoming. .Sh TRANSLATION EXAMPLES This example maps incoming requests on port 80 to port 8080, on which a daemon is running (because, for example, it is not run as root, @@ -3162,6 +3175,7 @@ Service name database. .Xr pf 4 , .Xr pfsync 4 , .Xr tcp 4 , +.Xr sctp 4 , .Xr udp 4 , .Xr hosts 5 , .Xr pf.os 5 ,