Hello,
I'm sorry I used a wrong pfctl for kernel I was running on my
test box so I could not spot it right away:
adaptive.end 120000 states
src.track 0s
states hard limit 100000
src-nodes hard limit 10000
frags hard limit 16384
tables hard limit 1000
table-entries hard limit 200000
pktdelay-pkts hard limit 10000
anchors hard limit 512
pfctl: Permission denied
I missed Permission denied, while I was looking for fingerprints...
On Fri, Jun 26, 2026 at 11:25:51AM +0100, Stuart Henderson wrote:
</snip>
>
> Wrong commit, it worked with pfctl.c r1.399 but broke with the subsequent
> commit. cvs di -D 2026/02/03 -D 2026/02/04
>
> Section headers ("FILTER RULES:", "STATES:", etc) and whitespace between
> sections, were dropped, and for pf.os, instead of printing "714
> fingerprints loaded", the list of class/version/subtype for various
> OS is printed.
thank you Stuart for digging that out. Looks like I accidentally deleted
the line which was supposed to stay.
The diff below should fix it. This is what I get with diff below:
adaptive.start 60000 states
adaptive.end 120000 states
src.track 0s
LIMITS:
states hard limit 100000
src-nodes hard limit 10000
frags hard limit 16384
tables hard limit 1000
table-entries hard limit 200000
pktdelay-pkts hard limit 10000
anchors hard limit 512
TABLES:
OS FINGERPRINTS:
714 fingerprints loaded
OK to commit?
thanks and
regards
sashan
--------8<---------------8<---------------8<------------------8<--------
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index a38583a9f13..786175d6fa9 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -3339,6 +3339,7 @@ main(int argc, char *argv[])
pfctl_show_limits(dev, opts);
break;
case SHOWOPT_ALL:
+ opts |= PF_OPT_SHOWALL;
pfctl_init_show_rules(&show_rules_pf, dev, opts);
pfctl_load_fingerprints(dev, opts);
pfctl_show_rules(&show_rules_pf, path, PFCTL_SHOW_RULES,
