pfilctl: fix 'pfilctl hooks' when nothing is connectedThe 'hooks' command actually worked accidentially until now. It usedPFILIOC_LISTHEADS to determine current number of hooks. This worked when
pfilctl: fix 'pfilctl hooks' when nothing is connectedThe 'hooks' command actually worked accidentially until now. It usedPFILIOC_LISTHEADS to determine current number of hooks. This worked whenat least one head had a hook connected to it.(cherry picked from commit 1bfe195143ffb6832ac6702e281964541554fcb3)
show more ...
Remove $FreeBSD$: two-line nroff patternRemove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/
Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of BSD-2-Clause.Discussed with: pfgMFC After: 3 daysSponsored by: Netflix
pfilctl: improve formatting of "hooks" and "heads" command output.In "heads" output just improve the header to describe all of the columns.In "hooks" print filter name and hook name delimited with
pfilctl: improve formatting of "hooks" and "heads" command output.In "heads" output just improve the header to describe all of the columns.In "hooks" print filter name and hook name delimited with colon, so thatit matches "heads" output and also can be copy-and-pasted straight intothe command line for future "link" command.
Do a sweep and remove most WARNS=6 settingsRepeating the default WARNS here makes it slightly more difficult toexperiment with default WARNS changes, e.g. if we did something absolutelybananas an
Do a sweep and remove most WARNS=6 settingsRepeating the default WARNS here makes it slightly more difficult toexperiment with default WARNS changes, e.g. if we did something absolutelybananas and introduced a WARNS=7 and wanted to try lifting the default tothat.Drop most of them; there is one in the blake2 kernel module, but I suspectit should be dropped -- the default WARNS in the rest of the build doesn'tcurrently apply to kernel modules, and I haven't put too much thought intowhether it makes sense to make it so.
Hopefully fix compilation by other compilers.
New pfil(9) KPI together with newborn pfil API and control utility.The KPI have been reviewed and cleansed of features that were plannedback 20 years ago and never implemented. The pfil(9) intern
New pfil(9) KPI together with newborn pfil API and control utility.The KPI have been reviewed and cleansed of features that were plannedback 20 years ago and never implemented. The pfil(9) internals havebeen made opaque to protocols with only returned types and functiondeclarations exposed. The KPI is made more strict, but at the same timemore extensible, as kernel uses same command structures that userlandioctl uses.In nutshell [KA]PI is about declaring filtering points, declaringfilters and linking and unlinking them together.New [KA]PI makes it possible to reconfigure pfil(9) configuration:change order of hooks, rehook filter from one filtering point to adifferent one, disconnect a hook on output leaving it on input only,prepend/append a filter to existing list of filters.Now it possible for a single packet filter to provide multiple rulesetsthat may be linked to different points. Think of per-interface ACLs inCisco or Juniper. None of existing packet filters yet support that,however limited usage is already possible, e.g. default ruleset canbe moved to single interface, as soon as interface would pride theirfiltering points.Another future feature is possiblity to create pfil heads, that providenot an mbuf pointer but just a memory pointer with length. That wouldallow filtering at very early stages of a packet lifecycle, e.g. whenpacket has just been received by a NIC and no mbuf was yet allocated.Differential Revision: https://reviews.freebsd.org/D18951