Program to add/delete a rule from pf

[Rajkumar S]

On 7/19/06, Rajkumar S <rajkumars at gmail.com> wrote:
> Just to clarify once more, My requirement is to add and remove rules
> like the one below inside an anchor.
>
> block in quick on fxp0 proto tcp from 192.168.3.3 port 1025 to
> 64.233.167.99 port 80
> block in quick on fxp0 proto tcp from 192.168.3.23 port 1054 to
> 72.14.207.99 port 8080

Got a reply from  Daniel Hartmeier in the main pf list:

<quote>
Why don't you create sub-anchors, one for each single rule? Then
removing one rule (and the sub-anchor that contains it) can be done by
simply flushing the sub-anchor.

You need one call in the main ruleset or the existing anchor, using the
wildcard '*', that call evaluates all sub-anchors, and the call doesn't
need to be updated when you insert/remove sub-anchors.

You could even use the sub-anchor names in some clever way, like put the
rule's expiration time (unix epoch) in that string, so to purge expired
rules, you can traverse the list of sub-anchors alphabetically and stop
when a name is larger than time(NULL).

Or store some ID in the name (which your plugin associates with the
entry), which helps you purge the sub-anchor without traversing them all
searching for some rule.

Unless you expect to have several thousand rules like this concurrently,
the overhead of the sub-anchor evaluation isn't that terrible.

IIRC, the ioctl API once contained a call to insert/remove one
particular rule in a certain place of the ruleset, but it was
cumbersome, and the entire (sub-)anchor concept makes it superfluous in
most cases.

Daniel
<quote>

This basically solves my problem. Thanks every one for help and suggetions.

raj