From 74428adae63f93c8e5679ce8ba0793e8e786f2ec Mon Sep 17 00:00:00 2001
From: Michael Rash <mbr@cipherdyne.org>
Date: Fri, 18 Jul 2014 20:54:11 -0400
Subject: [PATCH] [server] Bug fix for PF firewalls without ALTQ support on
 FreeBSD.

With this commit PF rules are added correctly regardless of whether ALTQ support
is available or not. Thanks to Barry Allard for discovering and reporting this
issue. Closes issue #121 on github.
---
 CREDITS             | 4 ++++
 ChangeLog           | 4 ++++
 server/fw_util_pf.h | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/CREDITS b/CREDITS
index 4d433160..66d860d2 100644
--- a/CREDITS
+++ b/CREDITS
@@ -180,3 +180,7 @@ Tim Heckman
     - Homebrew fwknop package maintainer for Mac OS X systems.
     - Suggested that fwknop support nftables when it is integrated into the
       mainline Linux kernel.
+
+Barry Allard
+    - Reported bug in PF support on FreeBSD systems where ALTQ is not available
+      would cause new PF rules to not be added (github issue #121).
diff --git a/ChangeLog b/ChangeLog
index 0b7de974..40a6c931 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,10 @@ fwknop-2.6.3 (05//2014):
       are provided by SPA clients. This option is mostly useful for the fuzzing
       tests in the test suite to ensure broad code coverage under adverse
       conditions.
+    - [server] Bug fix for PF firewalls without ALTQ support on FreeBSD. With
+      this fix it doesn't matter whether ALTQ support is available or not.
+      Thanks to Barry Allard for discovering and reporting this issue.
+      Closes issue #121 on github.
     - [server] Add a new GPG_FINGERPRINT_ID variable to the access.conf file
       so that full GnuPG fingerprints can be required for incoming SPA packets
       in addition to the appreviated GnuPG signatures listed in GPG_REMOTE_ID.
diff --git a/server/fw_util_pf.h b/server/fw_util_pf.h
index 71ecb056..777ceef8 100644
--- a/server/fw_util_pf.h
+++ b/server/fw_util_pf.h
@@ -38,7 +38,7 @@
 */
 #define PF_ADD_RULE_ARGS              "pass in quick proto %u from %s to any port %u keep state label " EXPIRE_COMMENT_PREFIX "%u"
 #define PF_WRITE_ANCHOR_RULES_ARGS    "-a %s -f -"
-#define PF_LIST_ANCHOR_RULES_ARGS     "-a %s -s rules 2>&1"
+#define PF_LIST_ANCHOR_RULES_ARGS     "-a %s -s rules 2> /dev/null"
 #define PF_ANCHOR_CHECK_ARGS          "-s Anchor 2>&1"  /* to check for fwknop anchor */
 #define PF_DEL_ALL_ANCHOR_RULES       "-a %s -F all 2>&1"