lgcosta
5323ee2c71
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer handling with NF_STOLEN + re-injection (documented divergence: re-entry) - pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback - pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires under the write lock — observed as full-VM network hang) - tools: static pfctl link for musl VMs
24 lines
972 B
Plaintext
24 lines
972 B
Plaintext
# PFLINUX offline parse test 2 — translations, redirections, diversion.
|
|
|
|
xif = "lo"
|
|
table <ext> const { 127.0.0.1 }
|
|
|
|
set reassemble yes no-df
|
|
set syncookies adaptive (start 25%, end 12%)
|
|
|
|
pass in quick on $xif inet proto tcp from any to any port 8080 \
|
|
rdr-to 127.0.0.1 port 80 sticky-address
|
|
pass out quick on $xif inet proto tcp from 127.0.0.0/8 to any \
|
|
nat-to <ext> static-port
|
|
pass in quick on $xif inet6 proto tcp from any to any port 8080 \
|
|
rdr-to ::1
|
|
pass in quick on $xif inet proto tcp from any to any port 1723 \
|
|
route-to 127.0.0.1
|
|
pass in quick on $xif proto tcp from any to any port 21 \
|
|
divert-to 127.0.0.1 port 7000
|
|
pass in quick on $xif proto tcp from any to any port 110 divert-packet port 2000
|
|
pass quick on $xif inet proto tcp from 127.0.0.5 to any binat-to 127.0.0.9
|
|
pass in quick on $xif inet proto tcp all af-to inet6 from ::1
|
|
match out quick on $xif inet proto tcp all set (delay 100)
|
|
block drop in quick on $xif inet from urpf-failed to any
|