FreeBSD: use libpfctl #671
Conversation
|
I think we should |
|
Something like this then. I've added an 'r' pointer in most functions because it avoids a lot of ifdef USE_LIBPFCTL then rule.... #else pr.rule.... #endif all over the place. |
|
It looks great ! |
to prepare the use of libpfctl see #671
FreeBSD 15 has removed several ioctl calls (such as DIOCGETSTATUS and
DIOCGETRULE) and replaced them. The easiest way to cope with that is to
use the provided libpfctl library.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
@kprovost libpfctl will only be available starting with FreeBSD 15, right ? |
No, it's available on all support FreeBSD versions, 12.4, 13.2 and 14.0. The DIOCGETRULE ioctl no longer exists in 15, so there you either use libpfctl or implement the new nvlist-based ioctl (don't do that, it's likely to go away and be replaced as well). |
|
shouldn't pfctl_get_rules_info() be used instead of DIOCGETRULES ? |
|
We can, and in due course should, but it's not required on FreeBSD 15. I think I'd prefer to keep this patch as small as possible to fix the immediate problem (of not actually working with FreeBSD 15). We can continue other cleanup work in separate patches. |
FreeBSD 15 has removed several ioctl calls (such as DIOCGETSTATUS and DIOCGETRULE) and replaced them. The easiest way to cope with that is to use the provided libpfctl library.
NOTE: This version of the patch will break use on OpenBSD or NetBSD and is intended to serve as a basis for discussing the best approach to cope with these differences.
Sponsored by: Rubicon Communications, LLC ("Netgate")