pf: emulate OpenBSD ingress/egress interface groups as any-interface (Linux has no ifgroups)

This commit is contained in:
lgcosta committed 2026-11-11 20:07:17 -03:00
1 parent 525fe7ee28
commit c449e01b9a
1 file changed
+11
+11
View File
@@ -90,6 +90,17 @@ pfi_kif_alloc(const char *kif_name, int mflags)
kif->pfik_flags |= PFI_IFLAG_ANY;
kif->pfik_flags_new |= PFI_IFLAG_ANY;
}
/*
* PFLINUX: OpenBSD creates the "ingress" and "egress" interface
* groups (ifgroups) automatically and both contain every interface;
* pf's direction (in/out ruleset) carries the actual meaning. Linux
* has no ifgroups, so emulate the groups as "any interface".
*/
if (!strcmp(kif->pfik_name, "ingress") ||
!strcmp(kif->pfik_name, "egress")) {
kif->pfik_flags |= PFI_IFLAG_ANY;
kif->pfik_flags_new |= PFI_IFLAG_ANY;
}
return (kif);
}