From b554c9a6efbbc95809ed63b2487140a16e10039c Mon Sep 17 00:00:00 2001 From: lgcosta Date: Wed, 11 Nov 2026 20:33:57 -0300 Subject: [PATCH] demo: ship the asciinema recording in the repo (out/demo-pf-linux.cast) --- .gitignore | 2 ++ out/demo-pf-linux.cast | 65 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 out/demo-pf-linux.cast diff --git a/.gitignore b/.gitignore index 08cc293..ba25723 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ _vendor/ out/ +!out/demo-pf-linux.cast *.o *.ko *.mod @@ -10,6 +11,7 @@ out/ modules.order Module.symvers tools/out/ +!out/demo-pf-linux.cast lab/seeds/ *.pcap *.log diff --git a/out/demo-pf-linux.cast b/out/demo-pf-linux.cast new file mode 100644 index 0000000..df7a22c --- /dev/null +++ b/out/demo-pf-linux.cast @@ -0,0 +1,65 @@ +{"version": 2, "width": 80, "height": 24, "timestamp": 1794439963, "env": {"SHELL": null, "TERM": "dumb"}} +[1.256598, "o", "\u001b[1m===============================================================\u001b[0m\r\n\u001b[1m PF on Linux - the OpenBSD PF 8.0 engine inside the Linux kernel\u001b[0m\r\n\u001b[1m===============================================================\u001b[0m\r\n\r\nLab: 3 Alpine VMs under libvirt.\r\n pftest-pf0 = firewall (kernel 7.3.4 built from source + pf.ko)\r\n pftest-cli = client 10.0.1.10 pftest-srv = server 10.0.2.20\r\n\r\n\u001b[1m--- 1. our kernel, the OpenBSD engine as a module ---\u001b[0m\r\n\u001b[1;36mpftest-pf0# uname -r\u001b[0m\r\n"] +[1.533174, "o", "7.3.4\r\n"] +[1.935704, "o", "\u001b[1;36mpftest-pf0# lsmod | grep '^pf ' || echo 'pf: not loaded yet'\u001b[0m\r\n"] +[2.205061, "o", "pf 548864 0\r\n"] +[2.607555, "o", "\u001b[1;36mpftest-pf0# insmod /opt/pf/pf.ko && dmesg | tail -3\u001b[0m\r\n"] +[2.893207, "o", "insmod: ERROR: could not insert module /opt/pf/pf.ko: File exists\r\n"] +[3.296808, "o", "\r\n\u001b[1m--- 2. pfctl talks to the module over the OpenBSD ioctl ABI ---\u001b[0m\r\n\u001b[1;36mpftest-pf0# /opt/pf/pfctl -s info | head -4\u001b[0m\r\n"] +[3.569271, "o", "Status: Disabled for 0 days 00:00:09 Debug: err\r\n\r\nState Table Total Rate\r\n current entries 32 \r\n"] +[3.972723, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -e && /opt/pf/pfctl -s info | head -1\u001b[0m\r\n"] +[4.233194, "o", "Status: Enabled Debug: err\r\npf enabled\r\n"] +[4.635445, "o", "\r\n"] +[4.635582, "o", "\u001b[1m--- 3. a real pf.conf: tables, stateful rules, an explicit drop ---\u001b[0m\r\n\u001b[1;36mpftest-pf0# cat /tmp/demo-pf.conf\u001b[0m\r\n"] +[4.909045, "o", "# PF-on-Linux demo ruleset (pf.conf syntax, real OpenBSD pfctl)\r\nset block-policy return\r\ntable { 10.0.1.0/24 }\r\n\r\n# transit traffic: stateful, table-driven\r\npass in quick on ingress proto icmp from keep state\r\npass out quick on egress proto icmp keep state\r\n\r\n# deny a specific destination\r\nblock drop in quick proto icmp to 10.0.9.99\r\n\r\n# everything else\r\npass in quick\r\npass out quick\r\n"] +[5.311192, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -f /tmp/demo-pf.conf && echo 'rules loaded'\u001b[0m\r\n"] +[5.585074, "o", "rules loaded\r\n"] +[5.987322, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -sr\u001b[0m\r\n"] +[6.253146, "o", "pass in quick on ingress proto icmp from to any\r\npass out quick on egress proto icmp all\r\nblock drop in quick inet proto icmp from any to 10.0.9.99\r\npass in quick all flags S/SA\r\npass out quick all flags S/SA\r\n"] +[6.656054, "o", "\r\n\u001b[1m--- 4. transit traffic is allowed and stateful ---\u001b[0m\r\n"] +[6.65621, "o", "\u001b[1;36mpftest-cli# ping -c2 -W2 10.0.2.20 | tail -3\u001b[0m\r\n"] +[7.891731, "o", "--- 10.0.2.20 ping statistics ---\r\n2 packets transmitted, 2 packets received, 0% packet loss\r\nround-trip min/avg/max = 0.374/0.398/0.423 ms\r\n"] +[8.295591, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -ss | grep -E 'icmp' | head -4\u001b[0m\r\n"] +[8.573677, "o", "all icmp 10.0.2.20:8 <- 10.0.1.10:4368 0:0\r\nall icmp 10.0.1.10:4368 -> 10.0.2.20:8 0:0\r\n"] +[8.976904, "o", "\r\n\u001b[1m--- 5. tables are live objects ---\u001b[0m\r\n\u001b[1;36mpftest-pf0# /opt/pf/pfctl -t trusted -T show\u001b[0m\r\n"] +[9.257023, "o", " 10.0.1.0/24\r\n"] +[9.65968, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -s Tables\u001b[0m\r\n"] +[9.92516, "o", "trusted\r\n"] +[10.328262, "o", "\r\n\u001b[1m--- 6. the drop rule actually drops ---\u001b[0m\r\n"] +[10.328317, "o", "\u001b[1;36mpftest-pf0# cat > /tmp/demo-block.conf < /tmp/demo-nat.conf < 10.0.2.20:8 0:0\r\n"] +[20.320866, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -f /tmp/demo-pf.conf && echo 'back to the stateful ruleset'\u001b[0m\r\n"] +[20.597072, "o", "back to the stateful ruleset\r\n"] +[20.999951, "o", "\r\n\u001b[1m--- 8. divert-to: the packet goes to userspace and comes back ---\u001b[0m\r\n\u001b[1;36mpftest-pf0# cat /tmp/demo-divert.conf\u001b[0m\r\n"] +[21.277077, "o", "pass in quick proto icmp from 10.0.1.10 to 10.0.1.1 divert-to \"10.0.1.1\" port 10000 keep state\r\npass out quick\r\n"] +[21.680804, "o", "\u001b[1;36mpftest-pf0# /opt/pf/pfctl -f /tmp/demo-divert.conf && echo 'divert rule loaded'\u001b[0m\r\n"] +[21.949469, "o", "divert rule loaded\r\n"] +[22.352874, "o", "\u001b[1;36mpftest-pf0# chmod +x /tmp/pdivert; (setsid /tmp/pdivert -p 10000 -f >/tmp/pdivert.log 2>&1 10.0.1.1\r\npdivert: got 84 bytes 10.0.1.10 -> 10.0.1.1\r\n"] +[26.284339, "o", " (pdivert flipped the last payload byte and fixed the ICMP checksum)\r\n\r\n"] +[26.284374, "o", "\u001b[1m--- 9. shutdown ---\u001b[0m\r\n"] +[26.284384, "o", "\u001b[1;36mpftest-pf0# pkill pdivert; /opt/pf/pfctl -f /dev/null; /opt/pf/pfctl -d; echo 'pf disabled'\u001b[0m\r\n"] +[26.545211, "o", "pf disabled\r\npf disabled\r\n"] +[26.948742, "o", "\u001b[1;36mpftest-pf0# lsmod | grep '^pf '\u001b[0m\r\n"] +[27.213013, "o", "pf 548864 0\r\n"] +[27.615658, "o", "\r\n\u001b[1mdemo over - port, gates and docs:\u001b[0m\r\n"] +[27.615733, "o", "\u001b[1m https://git.labexposed.com/lgcosta/pf-linux-port\u001b[0m\r\n\r\n"]