lgcosta
a0941b77fe
- hooks: packets are queued to pfk_netisr ordered wq (process context) and re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe, documented divergence vs OpenBSD in-place ip_input continuation - pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD) - pfk_net: holder-task+depth reentrancy (pid-based hack removed) - ifnet events deferred to ordered workqueue (rtnl AB-BA fix) - idr iteration start index fix (kifs were never attached -> kif==NULL drop) - pfk_lock_trace module param for lock diagnostics - tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh - docs/en/install.md: apply/build guide (core patch set currently EMPTY)
12 lines
702 B
Bash
Executable File
12 lines
702 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# M2 gate 3: pfr tables via pfctl -t
|
|
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
|
pf0 '/opt/pf/pfctl -e' >/dev/null
|
|
pf0 'printf "block in quick proto icmp from <blk>\npass out quick\n" | /opt/pf/pfctl -f -'
|
|
pf0 '/opt/pf/pfctl -t blk -T add 10.0.1.10' && ok "table add"
|
|
M=$(pf0 '/opt/pf/pfctl -t blk -T show | grep -c 10.0.1.10'); [ "$M" -ge 1 ] && ok "table shows entry" || bad "table empty"
|
|
cli "ping -c1 -W1 $SRV_IP >/dev/null 2>&1" && bad "blocked src passed" || ok "table block works"
|
|
pf0 "/opt/pf/pfctl -t blk -T kill 10.0.1.10" >/dev/null
|
|
cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "unblocked passes" || bad "kill failed"
|
|
pf0 '/opt/pf/pfctl -d' >/dev/null; finish
|