On 2026/06/26 11:55, Alexandr Nedvedicky wrote:
> Hello David,
>
> Sorry to coming back to you after some delay...
>
> I'm afraid I need some clarification. The commit/version you are referring
> to changed nothing as far as I can tell. It just moved the existing code
> to new place.
>
> also looking at pfctl_load_fingerprints() function call path itself I see
> there is nothing printed (nothing to stdout, nothing to stderr).
>
> can you share actual output of 'pfctl -sa' and output you would expect?
>
> thanks and
> regards
> sashan
>
> On Sat, Jun 13, 2026 at 09:29:37AM +0100, Tarma Support wrote:
> > Hello,
> >
> > According to its man page, pfctl(8) with option -s all should print all
> > filter parameters except the list of the interfaces and the list of
> > operating system fingerprints (OSFP).
> >
> > This worked as documented until revision 1.399 of src/sbin/pfctl/pfctl.c
> > (committed 11 November 2025), when the logic of the -s option was rewritten
> > to accommodate the new source and state limiters. Since that revision, the
> > OSFP list is printed as part of the -s all option.
Wrong commit, it worked with pfctl.c r1.399 but broke with the subsequent
commit. cvs di -D 2026/02/03 -D 2026/02/04
Section headers ("FILTER RULES:", "STATES:", etc) and whitespace between
sections, were dropped, and for pf.os, instead of printing "714
fingerprints loaded", the list of class/version/subtype for various
OS is printed.
-FILTER RULES:
pass quick inet proto tcp from any to 127.0.0.1 user = 55 flags S/SA
pass quick inet proto udp from any to 127.0.0.1 user = 55
<snip>
-
-STATES:
all tcp 10.15.5.2:1006 -> 10.15.5.3:2049 ESTABLISHED:ESTABLISHED
all tcp 10.15.5.2:934 -> 10.15.5.3:2049 ESTABLISHED:ESTABLISHED
all tcp 10.15.5.2:957 -> 10.15.5.3:2049 ESTABLISHED:ESTABLISHED
<snip>
-INFO:
-Status: Enabled for 9 days 10:51:03 Debug: err
-
+Status: Enabled for 9 days 10:51:23 Debug: err
State Table Total Rate
<snip>
no-route 0 0.0/s
ID USE/LIMIT RATE/SECS ADMIT HARDLIM RATELIM
ID USE/ADDRS LIMIT RATE/SECS ADMIT ADDRLIM HARDLIM RATELIM
-
-TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
@@ -3249,8 +1500,6 @@ interval 10s
adaptive.start 60000 states
adaptive.end 120000 states
src.track 0s
-
-LIMITS:
states hard limit 100000
src-nodes hard limit 10000
frags hard limit 16384
@@ -3258,10 +1507,350 @@ tables hard limit 1000
table-entries hard limit 200000
pktdelay-pkts hard limit 10000
anchors hard limit 512
-
-TABLES:
BADHOSTS
sshguard
-
-OS FINGERPRINTS:
-714 fingerprints loaded
+Class Version Subtype(subversion)
+----- ------- -------------------
+AIX
+AIX 4.3
+AIX 4.3 2
<snip>
