From nobody Mon Jul 07 15:08:01 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bbSKZ0jL0z61w7w; Mon, 07 Jul 2025 15:08:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bbSKY4p5Qz3wS1; Mon, 07 Jul 2025 15:08:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1751900881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i/7GYpb18p1tzEcfSX4ujATb1DFRV/IBmGtCBfiFg28=; b=dgmPcoiSobJ5ulajWQAxrBXSGpp4Qof4u7D98gNayMLCesw8bKlyCLjeTwCS0iElbTqWGA yCMDr8IIF89EFQT8iuhcxe3DlwYm5ZR8VK5IAbmeFrUif4pfJ7bDgJHqj1GExU3nHMVpzC xty57V/D3I6DLkhSijgi61JrjB6QD8Tpdi6sTudbD8FVmKtpm3pJ2d7BWriDhQe9RsKiGf N0UJh5ePl/frqhGe2ZNYByVWubo0bzF3/ELKSmS7To0ythEyhLXY9SK9sPuyMhu3TbWG7m ZGYuOj4H+VuOzTV96bi5OnfKVcicll1ExvRXtelGT8cmFghs9oa/no+Cs3Q86Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1751900881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i/7GYpb18p1tzEcfSX4ujATb1DFRV/IBmGtCBfiFg28=; b=SapDwsuRrYA22fUdsquJOg0mETo5pXb9ICToPJgZ0UrvPReS6AidecuIkcomP2x5PlegIl McIBIQY3n1OL2B5sn6JvLiM5gsiF9P1Mc5fRPVI2b/OWQPJdS6vzEz59K9wLRllMfj4CWv MFmBz11zvQxnDxq+WvpD1wL7S6UKflJSvnhBKLZG5F+LQ4p5xvcvMLeOB1pz1usyFSHmDX th13QzNFuEr7V3EeNtamb5xzjSk1wwwSuuZ9b26FBm6TlpviCqbFcp+DTdsZWRwFMTdl/y zr5w48v2k15bPzSDeKovWzun+76R2qWl1QHSRy0DJPJfsRZJ8ON7dceDwdnS3g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1751900881; a=rsa-sha256; cv=none; b=o5d31ucFfU5FXejhHNf+a3bHklBceQ77vln7ix3kYhJWv9oV0Mal1ksLGJsx2hbsS0tazV 23YudwMg/nBlf7b7lCv+E5UEeg6zUBpMppKBSDNLum6wOZhkj9DfMNYBbO+UuzqYhGNQOK 7FxhhdhbaQ7JdeHD15Sv+C4nhcAbqfS4mna9yypd+06oEK3XqeGjqXoyYu0BDliQm55IHM SJA0mNRJRQ6exv7rTs5l8QZzddhXdzgHSTik90+1MLwQbOb46neqQ8TK3kpddnCwPkhyi8 HtwisBSGrOrlHdIWfcsipNqUtYrTNLkYVOUWcjHmP/HkQgmI80aYz3ihCYFw1A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bbSKY4PdkzwH0; Mon, 07 Jul 2025 15:08:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 567F81DK016813; Mon, 7 Jul 2025 15:08:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 567F81NN016810; Mon, 7 Jul 2025 15:08:01 GMT (envelope-from git) Date: Mon, 7 Jul 2025 15:08:01 GMT Message-Id: <202507071508.567F81NN016810@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 613a144a4b78 - main - pfctl: introduce 'pfctl -FR' to reset settings to defaults List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 613a144a4b7819f2ac9619d3ae85dd4db08aac59 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=613a144a4b7819f2ac9619d3ae85dd4db08aac59 commit 613a144a4b7819f2ac9619d3ae85dd4db08aac59 Author: Kristof Provost AuthorDate: 2025-07-02 14:47:43 +0000 Commit: Kristof Provost CommitDate: 2025-07-07 15:06:51 +0000 pfctl: introduce 'pfctl -FR' to reset settings to defaults (discussed with many at tech@) OK deraadt@, kn@, sthen@, tedu@ Obtained from: OpenBSD, sashan , 22f3d0383c Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/pfctl.8 | 2 ++ sbin/pfctl/pfctl.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 47 insertions(+), 2 deletions(-) diff --git a/sbin/pfctl/pfctl.8 b/sbin/pfctl/pfctl.8 index 0c4a7b519bf6..2391c1d1cd12 100644 --- a/sbin/pfctl/pfctl.8 +++ b/sbin/pfctl/pfctl.8 @@ -223,6 +223,8 @@ Flush the filter information (statistics that are not bound to rules). Flush the tables. .It Fl F Cm osfp Flush the passive operating system fingerprints. +.It Fl F Cm Reset +Reset limits, timeouts and options back to default settings. .It Fl F Cm all Flush all of the above. .El diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 0fb0602eb04f..8c20c8250ed1 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -123,6 +123,7 @@ int pfctl_load_ruleset(struct pfctl *, char *, struct pfctl_ruleset *, int, int); int pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int); const char *pfctl_lookup_option(char *, const char * const *); +void pfctl_reset(int, int); static struct pfctl_anchor_global pf_anchors; struct pfctl_anchor pf_main_anchor; @@ -231,7 +232,7 @@ static const struct { static const char * const clearopt_list[] = { "nat", "queue", "rules", "Sources", "states", "info", "Tables", "osfp", "all", - "ethernet", NULL + "ethernet", "Reset", NULL }; static const char * const showopt_list[] = { @@ -2947,6 +2948,45 @@ pfctl_lookup_option(char *cmd, const char * const *list) return (NULL); } +void +pfctl_reset(int dev, int opts) +{ + struct pfctl pf; + struct pfr_buffer t; + int i; + + pf.dev = dev; + pf.h = pfh; + pfctl_init_options(&pf); + + /* Force reset upon pfctl_load_options() */ + pf.debug_set = 1; + pf.reass_set = 1; + pf.syncookieswat_set = 1; + pf.ifname = strdup("none"); + if (pf.ifname == NULL) + err(1, "%s: strdup", __func__); + pf.ifname_set = 1; + + memset(&t, 0, sizeof(t)); + t.pfrb_type = PFRB_TRANS; + if (pfctl_trans(dev, &t, DIOCXBEGIN, 0)) + err(1, "%s: DIOCXBEGIN", __func__); + + for (i = 0; pf_limits[i].name; i++) + pf.limit_set[pf_limits[i].index] = 1; + + for (i = 0; pf_timeouts[i].name; i++) + pf.timeout_set[pf_timeouts[i].timeout] = 1; + + pfctl_load_options(&pf); + + if (pfctl_trans(dev, &t, DIOCXCOMMIT, 0)) + err(1, "%s: DIOCXCOMMIT", __func__); + + pfctl_clear_interface_flags(dev, opts); +} + int main(int argc, char *argv[]) { @@ -3314,7 +3354,7 @@ main(int argc, char *argv[]) pfctl_clear_src_nodes(dev, opts); pfctl_clear_stats(pfh, opts); pfctl_clear_fingerprints(dev, opts); - pfctl_clear_interface_flags(dev, opts); + pfctl_reset(dev, opts); } break; case 'o': @@ -3323,6 +3363,9 @@ main(int argc, char *argv[]) case 'T': pfctl_do_clear_tables(anchorname, opts); break; + case 'R': + pfctl_reset(dev, opts); + break; } } if (state_killers) {