From nobody Fri Oct 30 14:08:08 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGx35dPz6wwcj for ; Fri, 30 Oct 2026 14:08:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGNGw6BY9z4qXQ for ; Fri, 30 Oct 2026 14:08:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369288; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8UV2+mBuknuglEV63JBGnkjkdPRx/7SZNAl43fySeyg=; b=nOTKsVY+3hDAKvrFEsVZmKi1sMdNjJamhhInsI21mHhMf686e/holDjz0zp1NxbH4Jtwje GYwnCIHtwQSq+4R6VMwiWbOFZJVOxkJZBQlfo3Ng903PwlFKeF84LMz1lPwH3UWf5uoWBv yhzajpscAGrMTkUyW55jj/YQd8NrDv4WLduyo698Dfaq8mYP4hqrIaqsdSvlTF7727YSL1 jQirPV2gK7X8ImVWAPkl37ikvpL2mdlvtjNPGg2TOe3cpoKEDUE8A8cOqX6WxLZ8Edp/0W 5ttostiPO/K0Ma7D33bGwT67TjHRHXoxEl4hLv5KV2eWTErM2chCygjrO30CZQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793369288; b=RYdfIlJkwg72T+P5NkfpRNqmvcL7TeIz8s9NGw2pXlLFarHYhXxbqpG9vBpJvJD3cSt/I1 deyoS2iJyGBDGyfGVrHS9WGm39Vrnepfun0o4gPA4cbmkT3pfb1YPVTvyrbtUJBpsbBMki CgT9rUAGnDeerqzIWhe81hhXR7FMRw3QVImjrN6WHjXPT+a1F80Ztezutcjw8xCOxQKsyh Z7MT1USAQIfw57YDdQszSjhO+69FQUVH4Fxm0znlYLZUpDufm+4c2iQu18UQ7AHI0cw1rS 91i2gLuIkUiQiBRwE0TgyjKA0ux9ZN/BIExQT0s5m5G/DnN7tsVQSRPgpFk+Rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369288; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8UV2+mBuknuglEV63JBGnkjkdPRx/7SZNAl43fySeyg=; b=ny7ICSj1shcDniF3yyWXqxLqrYFEd6Lb7iYp/a4HOmNq9xyWQuj3i5NxCyz1/HjaI8Y2XQ ntqyHeydx5JDcgCOdj0iYM7MqJzD5Fn1jxh+YU4t0VQ3NFriFueSqRr8v+TJYbMe6xpb1H 1XQncHHWR5UZCYpMfjm8I7WQ00PylRtq/FxFr/sCNwdlKLT88PjjgXfHRhBSqhYoCgKtcA T8bvIyUVgW1qR8++ZG1ixGZD+4lPBNo29JvY/ar45WHRFJg3St62GeaK5jdYDkQ2zVJrax gpwqoc1CKn7834H2XQDRvs7lstpWwOQDqCLg12IorEVS6NtIicNO3PSY8ZL3Mg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGw5splzV6t for ; Fri, 30 Oct 2026 14:08:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22db0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 14:08:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Avinash Duduskar From: Kristof Provost Subject: git: 87a5d76973ca - main - pfctl: add -l to use an inherited Netlink socket List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 87a5d76973ca8eec3e112d4c8bf89933b813fe96 Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 14:08:08 +0000 Message-Id: <6ae4a4c8.22db0.5a4db73c@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=87a5d76973ca8eec3e112d4c8bf89933b813fe96 commit 87a5d76973ca8eec3e112d4c8bf89933b813fe96 Author: Avinash Duduskar AuthorDate: 2026-10-26 14:38:11 +0000 Commit: Kristof Provost CommitDate: 2026-10-30 14:07:04 +0000 pfctl: add -l to use an inherited Netlink socket pf's Netlink commands are checked against the credentials of the socket, so a socket opened by a privileged process keeps its authority across a privilege drop and exec, as the /dev/pf descriptor passed as -p /dev/fd/N already does. -l takes the descriptor number of such a socket and uses it for every request instead of creating a new one. authpf(8) uses this to run pfctl as the logged-in user. PR: 291981 Signed-off-by: Avinash Duduskar Reviewed by: kp Pull Request: https://github.com/freebsd/freebsd-src/pull/2508 --- sbin/pfctl/pfctl.8 | 12 +++++++++++- sbin/pfctl/pfctl.c | 19 +++++++++++++++---- 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/sbin/pfctl/pfctl.8 b/sbin/pfctl/pfctl.8 index fdc66b176e8f..a90b220db7df 100644 --- a/sbin/pfctl/pfctl.8 +++ b/sbin/pfctl/pfctl.8 @@ -24,7 +24,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd April 20, 2026 +.Dd October 26, 2026 .Dt PFCTL 8 .Os .Sh NAME @@ -45,6 +45,7 @@ .Oo Fl k .Ar host | network | label | id | gateway | source | nat .Oc Xc +.Op Fl l Ar fd .Op Fl o Ar level .Op Fl p Ar device .Op Fl s Ar modifier @@ -385,6 +386,15 @@ To remove a source from a source limiter use: .Pp .Dl # pfctl -I 1 -k source -k 192.0.2.2 .Pp +.It Fl l Ar fd +Use the already open Netlink socket +.Ar fd , +inherited from the parent process, instead of creating a new one. +No other process may use the socket while +.Nm +runs. +Used by +.Xr authpf 8 . .It Fl M Kill matching states in the opposite direction (on other interfaces) when killing states. diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index a8a870a740a2..e73f1c4d92e7 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -349,8 +349,9 @@ usage(void) fprintf(stderr, "usage: %s [-AdeghMmNnOPqRSrvz] [-a anchor] [-D macro=value] [-F modifier]\n" "\t[-f file] [-i interface] [-K host | network]\n" - "\t[-k host | network | gateway | label | id] [-o level] [-p device]\n" - "\t[-s modifier] [-t table -T command [address ...]] [-x level]\n", + "\t[-k host | network | gateway | label | id] [-l fd] [-o level]\n" + "\t[-p device] [-s modifier] [-t table -T command [address ...]]\n" + "\t[-x level]\n", __progname); exit(1); @@ -3671,6 +3672,7 @@ main(int argc, char *argv[]) int optimize = PF_OPTIMIZE_BASIC; char anchorname[MAXPATHLEN]; int anchor_wildcard = 0; + int nl_fd = -1; char *path; const char *idopt = NULL; @@ -3678,7 +3680,7 @@ main(int argc, char *argv[]) usage(); while ((ch = getopt(argc, argv, - "a:AdD:eqf:F:ghi:I:k:K:mMnNOo:Pp:rRs:St:T:vx:z")) != -1) { + "a:AdD:eqf:F:ghi:I:k:K:l:mMnNOo:Pp:rRs:St:T:vx:z")) != -1) { switch (ch) { case 'a': anchoropt = optarg; @@ -3731,6 +3733,15 @@ main(int argc, char *argv[]) src_node_kill[src_node_killers++] = optarg; mode = O_RDWR; break; + case 'l': { + const char *errstr; + + nl_fd = strtonum(optarg, 0, INT_MAX, &errstr); + if (errstr != NULL) + errx(1, "invalid netlink descriptor: %s", + errstr); + break; + } case 'm': opts |= PF_OPT_MERGE; break; @@ -3894,7 +3905,7 @@ main(int argc, char *argv[]) altqsupport = 1; #endif } - pfh = pfctl_open(pf_device); + pfh = pfctl_open_from_nl_fd(pf_device, nl_fd); if (pfh == NULL) err(1, "Failed to open netlink");