Re: PR 291981: authpf under netlink, and a pfctl adoption flag

On 25 Jul 2026, at 9:51, Avinash Duduskar wrote:
> From: Avinash H. Duduskar <avinash.duduskar@gmail.com>
>
>> The way to fix this is to just call libpfctl from change_filter() [...]
>> if libpfctl is missing functions I'll happily add them.
>
> Glad to drop the flag and go the libpfctl way.  But I want to be sure I
> have read the scope right before I start, because I audited it and it
> came out a lot bigger than a missing function.
>
> The table, the addresses and the state kill authpf already does through
> libpfctl.  What still forks is the ruleset load, and that part is the
> pf.conf parser: change_filter hands pfctl a file with macros, and
> turning that text into rules is parse.y, which is not in libpfctl.

Groan. I didn’t realise authpf changed rules. I had assumed it only added/deleted addresses in tables.
I’ve never used it myself, in case that wasn’t obvious already.

> So before I pick up a keyboard: is that really the scope you have in
> mind, or did you have a different design for how authpf gets its rules
> in without the fork?  You know parse.y far better than I do, so I would
> rather understand the design you are picturing than guess at one.
>
Yeah, that’s an amount of work that’s not reasonable for this issue.
I’m not even sure we would want to lift all of parse.y into libpfctl at all, and we certainly don’t want to do that in a hurry to fix something else.

Let me think about this for a bit. We may have to go down the horrible path anyway, or perhaps we can not drop root privs, but instead limit the child process through capsicum. Or perhaps there’s a MAC module way to do this. I know Kyle has in-progress work that may allow us to give non-root processes access to pf’s netlink interface.

Best regards,
Kristof