[server] Bug fix for PF firewalls without ALTQ support on FreeBSD.

With this commit PF rules are added correctly regardless of whether ALTQ support
is available or not. Thanks to Barry Allard for discovering and reporting this
issue. Closes issue #121 on github.

CREDITS

@@ -180,3 +180,7 @@ Tim Heckman
     - Homebrew fwknop package maintainer for Mac OS X systems.
     - Suggested that fwknop support nftables when it is integrated into the
       mainline Linux kernel.
+
+Barry Allard
+    - Reported bug in PF support on FreeBSD systems where ALTQ is not available
+      would cause new PF rules to not be added (github issue #121).

ChangeLog

@@ -7,6 +7,10 @@ fwknop-2.6.3 (05//2014):
       are provided by SPA clients. This option is mostly useful for the fuzzing
       tests in the test suite to ensure broad code coverage under adverse
       conditions.
+    - [server] Bug fix for PF firewalls without ALTQ support on FreeBSD. With
+      this fix it doesn't matter whether ALTQ support is available or not.
+      Thanks to Barry Allard for discovering and reporting this issue.
+      Closes issue #121 on github.
     - [server] Add a new GPG_FINGERPRINT_ID variable to the access.conf file
       so that full GnuPG fingerprints can be required for incoming SPA packets
       in addition to the appreviated GnuPG signatures listed in GPG_REMOTE_ID.

server/fw_util_pf.h

@@ -38,7 +38,7 @@
 */
 #define PF_ADD_RULE_ARGS              "pass in quick proto %u from %s to any port %u keep state label " EXPIRE_COMMENT_PREFIX "%u"
 #define PF_WRITE_ANCHOR_RULES_ARGS    "-a %s -f -"
-#define PF_LIST_ANCHOR_RULES_ARGS     "-a %s -s rules 2>&1"
+#define PF_LIST_ANCHOR_RULES_ARGS     "-a %s -s rules 2> /dev/null"
 #define PF_ANCHOR_CHECK_ARGS          "-s Anchor 2>&1"  /* to check for fwknop anchor */
 #define PF_DEL_ALL_ANCHOR_RULES       "-a %s -F all 2>&1"