diff --git a/CREDITS b/CREDITS index 4d433160..66d860d2 100644 --- a/CREDITS +++ b/CREDITS @@ -180,3 +180,7 @@ Tim Heckman - Homebrew fwknop package maintainer for Mac OS X systems. - Suggested that fwknop support nftables when it is integrated into the mainline Linux kernel. + +Barry Allard + - Reported bug in PF support on FreeBSD systems where ALTQ is not available + would cause new PF rules to not be added (github issue #121). diff --git a/ChangeLog b/ChangeLog index 0b7de974..40a6c931 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,10 @@ fwknop-2.6.3 (05//2014): are provided by SPA clients. This option is mostly useful for the fuzzing tests in the test suite to ensure broad code coverage under adverse conditions. + - [server] Bug fix for PF firewalls without ALTQ support on FreeBSD. With + this fix it doesn't matter whether ALTQ support is available or not. + Thanks to Barry Allard for discovering and reporting this issue. + Closes issue #121 on github. - [server] Add a new GPG_FINGERPRINT_ID variable to the access.conf file so that full GnuPG fingerprints can be required for incoming SPA packets in addition to the appreviated GnuPG signatures listed in GPG_REMOTE_ID. diff --git a/server/fw_util_pf.h b/server/fw_util_pf.h index 71ecb056..777ceef8 100644 --- a/server/fw_util_pf.h +++ b/server/fw_util_pf.h @@ -38,7 +38,7 @@ */ #define PF_ADD_RULE_ARGS "pass in quick proto %u from %s to any port %u keep state label " EXPIRE_COMMENT_PREFIX "%u" #define PF_WRITE_ANCHOR_RULES_ARGS "-a %s -f -" -#define PF_LIST_ANCHOR_RULES_ARGS "-a %s -s rules 2>&1" +#define PF_LIST_ANCHOR_RULES_ARGS "-a %s -s rules 2> /dev/null" #define PF_ANCHOR_CHECK_ARGS "-s Anchor 2>&1" /* to check for fwknop anchor */ #define PF_DEL_ALL_ANCHOR_RULES "-a %s -F all 2>&1"