lgcosta
5323ee2c71
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer handling with NF_STOLEN + re-injection (documented divergence: re-entry) - pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback - pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires under the write lock — observed as full-VM network hang) - tools: static pfctl link for musl VMs
19 lines
750 B
Plaintext
19 lines
750 B
Plaintext
# PFLINUX offline parse test 3 — HFSC/fq_codel queues, scrub, limits, delay.
|
|
|
|
xif = "lo"
|
|
|
|
queue rootq on $xif bandwidth 1G, max 900M, min 10M
|
|
queue rtq on $xif bandwidth 100M burst 200M for 50ms parent rootq qlimit 500
|
|
queue bulkq on $xif bandwidth 50M, min 5M parent rootq default
|
|
queue fqcq on $xif bandwidth 20M flows 1024 quantum 1514 parent rootq
|
|
|
|
set timeout { frag 20, interval 10 }
|
|
set limit frags 10000
|
|
|
|
match in on $xif proto tcp all scrub (random-id)
|
|
match in on $xif inet proto tcp all scrub (max-mss 1440 min-ttl 10)
|
|
pass in quick on $xif proto tcp from any to any port 80 queue rtq
|
|
pass out quick on $xif proto tcp from any to any queue bulkq
|
|
pass in quick on $xif proto udp from any to any queue fqcq
|
|
block drop in quick on $xif all
|