lgcosta
5323ee2c71
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer handling with NF_STOLEN + re-injection (documented divergence: re-entry) - pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback - pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires under the write lock — observed as full-VM network hang) - tools: static pfctl link for musl VMs
33 lines
1015 B
Plaintext
33 lines
1015 B
Plaintext
# PFLINUX offline parse test 1 — macros, tables, anchors, filter rules.
|
|
# Only lo is referenced so the config parses on any Linux host.
|
|
|
|
xif = "lo"
|
|
int_net = "127.0.0.0/8"
|
|
|
|
table <brutes> persist
|
|
table <blocked> const { 10.0.0.0/8, 127.0.0.1 }
|
|
table <web> const { $int_net }
|
|
|
|
set skip on lo
|
|
set block-policy return
|
|
set loginterface $xif
|
|
set ruleset-optimization basic
|
|
set state-policy if-bound
|
|
set timeout { tcp.established 3600, tcp.closed 90 }
|
|
set limit states 100000
|
|
set limit src-nodes 3000
|
|
|
|
anchor "in/*"
|
|
anchor "testsub" {
|
|
block drop in quick on $xif from <blocked> to any label "blocked-in"
|
|
pass in quick on $xif proto tcp from any to any port 22 keep state
|
|
}
|
|
|
|
load anchor "in/loaded" from "tests/anchor_loaded.conf"
|
|
|
|
pass in quick on $xif inet proto tcp from any to any port { 80 443 8080 } \
|
|
tag WEB keep state (max 1000)
|
|
pass in quick on $xif inet6 proto tcp from fe80::/10 to any port 443
|
|
pass out quick on $xif proto udp from any to any port 53
|
|
block drop in log quick on $xif from <brutes> to any
|