introduce 'pfctl -FR' to reset settings to defaults

2019-03-26 Thread Alexandr Nedvedicky
Hello,

tedu@ has planted idea for diff below here [1].  That particular email is part
of thread [2], where various cleanup/unconfigure options for PF are discussed.
To keep progressing in small steps I've decided to factor out the first diff
here, which introduces '-FR' (a.k.a. reset settings) for pfctl(8).

OK?

thanks and
regards
sashan

[1] https://marc.info/?l=openbsd-tech&m=155356735115005&w=2

[2] https://marc.info/?l=openbsd-tech&m=155341612701577&w=2
[ this is a good start point where to gather the context ]

8<---8<---8<--8<
diff --git a/sbin/pfctl/pfctl.8 b/sbin/pfctl/pfctl.8
index 48b2893cfcd..ab1693e5854 100644
--- a/sbin/pfctl/pfctl.8
+++ b/sbin/pfctl/pfctl.8
@@ -197,8 +197,10 @@ Flush the filter information (statistics that are not 
bound to rules).
 Flush the tables.
 .It Fl F Cm osfp
 Flush the passive operating system fingerprints.
+.It Fl F Cm Reset
+Reset limits, timeouts and options back to default settings.
 .It Fl F Cm all
-Flush all of the above.
+Flush all of the above (+ reset settings).
 .El
 .It Fl f Ar file
 Replace the current ruleset with
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 493ff47af2f..a6cf265451c 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -105,6 +105,7 @@ int  pfctl_load_rule(struct pfctl *, char *, struct pf_rule 
*, int);
 const char *pfctl_lookup_option(char *, const char **);
 void   pfctl_state_store(int, const char *);
 void   pfctl_state_load(int, const char *);
+void   pfctl_restore_defaults(int, int);
 
 const char *clearopt;
 char   *rulesopt;
@@ -205,7 +206,8 @@ static const struct {
 };
 
 static const char *clearopt_list[] = {
-   "rules", "Sources", "states", "info", "Tables", "osfp", "all", NULL
+   "rules", "Sources", "states", "info", "Tables", "osfp", "Reset",
+   "all", NULL
 };
 
 static const char *showopt_list[] = {
@@ -2232,6 +2234,40 @@ pfctl_state_load(int dev, const char *file)
fclose(f);
 }
 
+void
+pfctl_restore_defaults(int dev, int opts)
+{
+   struct pfctlpf;
+   struct pfr_buffer t;
+   int i;
+
+   pf.dev = dev;
+   pfctl_init_options(&pf);
+
+   pf.debug_set = 1;
+   pf.reass_set = 1;
+   pf.syncookieswat_set = 1;
+   pf.ifname = strdup("none");
+   pf.ifname_set = 1;
+
+   memset(&t, 0, sizeof(t));
+   t.pfrb_type = PFRB_TRANS;
+   if (pfctl_trans(dev, &t, DIOCXBEGIN, 0))
+   warn("%s, DIOCXBEGIN", __func__);
+
+
+   for (i = 0; pf_limits[i].name; i++)
+   pf.limit_set[pf_limits[i].index] = 1;
+
+   for (i = 0; pf_timeouts[i].name; i++)
+   pf.timeout_set[pf_timeouts[i].timeout] = 1;
+
+   pfctl_load_options(&pf);
+
+   if (pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
+   warn("%s, DIOCXCOMMIT", __func__);
+}
+
 int
 main(int argc, char *argv[])
 {
@@ -2558,6 +2594,7 @@ main(int argc, char *argv[])
pfctl_clear_stats(dev, ifaceopt, opts);
pfctl_clear_fingerprints(dev, opts);
pfctl_clear_interface_flags(dev, opts);
+   pfctl_restore_defaults(dev, opts);
}
break;
case 'o':
@@ -2566,6 +2603,9 @@ main(int argc, char *argv[])
case 'T':
pfctl_clear_tables(anchorname, opts);
break;
+   case 'R':
+   pfctl_restore_defaults(dev, opts);
+   break;
}
}
if (state_killers) {



nsd 4.1.27

2019-03-26 Thread Florian Obser
Nothing to extravagant, if you want this in 6.5
now would be a good time to test and report back :)

>From the release announcement:

4.1.27

FEATURES:
- Deny ANY with only one RR in response, by default.  Patch from
  Daisuke Higashi.  The deny-any statement in nsd.conf sets ANY
  queries over UDP to be further moved to TCP as well.
  Also no additional section processig for type ANY, reducing
  the response size.
- Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds
  nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig
  and del_tsig.  These changes are gone after reload, edit the
  config file (or a file included from it) to make changes that
  last after restart.
BUG FIXES:
- Fix #4213: disable-ipv6 and dnstap compile error.
- Fix to reduce region_log_stats if condition, this removes a
  debug statement.
- Fix for FreeBSD port with dnstap enabled.
- Fix to remove unused code.
- Fix #6: nsd-control-setup: Change validity time to a shorter
  period (<2038).
- Fix unused definition in header remote.h.
- Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big.
- Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets.
- Fixed radtree_insert memory leak.
- Fixed access recycled variable.

diff --git Makefile.in Makefile.in
index fbfc44be33b..0fba1027b88 100644
--- Makefile.in
+++ Makefile.in
@@ -310,7 +310,7 @@ configparser.c configparser.h:  $(srcdir)/configparser.y
$(YACC) -d -o configparser.c $(srcdir)/configparser.y
 
 # dnstap
-dnstap.o:  $(srcdir)/dnstap/dnstap.c config.h \
+dnstap.o:  $(srcdir)/dnstap/dnstap.c config.h dnstap/dnstap_config.h \
dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h $(srcdir)/dnstap/dnstap.h \
$(srcdir)/util.h $(srcdir)/options.h $(srcdir)/rbtree.h \
$(srcdir)/region-allocator.h
@@ -347,6 +347,9 @@ depend:
-e 's?$$(srcdir)/configlexer.c?configlexer.c?g' \
-e 's?$$(srcdir)/configparser.c?configparser.c?g' \
-e 's?$$(srcdir)/configparser.h?configparser.h?g' \
+   -e 's?$$(srcdir)/dnstap/dnstap_config.h??g' \
+   -e 
's?$$(srcdir)/dnstap/dnstap.pb-c.c?dnstap/dnstap.pb-c.c?g' \
+   -e 
's?$$(srcdir)/dnstap/dnstap.pb-c.h?dnstap/dnstap.pb-c.h?g' \
-e 's?$$(srcdir)/zlexer.c?zlexer.c?g' \
-e 's?$$(srcdir)/zparser.c?zparser.c?g' \
-e 's?$$(srcdir)/zparser.h?zparser.h?g' \
@@ -403,7 +406,8 @@ namedb.o: $(srcdir)/namedb.c config.h $(srcdir)/namedb.h 
$(srcdir)/dname.h $(src
  $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/radtree.h $(srcdir)/rbtree.h 
$(srcdir)/nsec3.h
 netio.o: $(srcdir)/netio.c config.h $(srcdir)/netio.h 
$(srcdir)/region-allocator.h $(srcdir)/util.h
 nsd.o: $(srcdir)/nsd.c config.h $(srcdir)/nsd.h $(srcdir)/dns.h 
$(srcdir)/edns.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \
- $(srcdir)/util.h $(srcdir)/options.h $(srcdir)/rbtree.h $(srcdir)/tsig.h 
$(srcdir)/dname.h $(srcdir)/remote.h $(srcdir)/xfrd-disk.h
+ $(srcdir)/util.h $(srcdir)/options.h $(srcdir)/rbtree.h $(srcdir)/tsig.h 
$(srcdir)/dname.h $(srcdir)/remote.h $(srcdir)/xfrd-disk.h \
+ $(srcdir)/dnstap/dnstap_collector.h
 nsd-checkconf.o: $(srcdir)/nsd-checkconf.c config.h $(srcdir)/tsig.h 
$(srcdir)/buffer.h \
  $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dname.h 
$(srcdir)/options.h $(srcdir)/rbtree.h $(srcdir)/rrl.h $(srcdir)/query.h \
  $(srcdir)/namedb.h $(srcdir)/dns.h $(srcdir)/radtree.h $(srcdir)/nsd.h 
$(srcdir)/edns.h $(srcdir)/packet.h
@@ -442,7 +446,8 @@ rrl.o: $(srcdir)/rrl.c config.h $(srcdir)/rrl.h 
$(srcdir)/query.h $(srcdir)/name
 server.o: $(srcdir)/server.c config.h $(srcdir)/axfr.h $(srcdir)/nsd.h 
$(srcdir)/dns.h $(srcdir)/edns.h $(srcdir)/buffer.h \
  $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/query.h 
$(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/radtree.h $(srcdir)/rbtree.h \
  $(srcdir)/packet.h $(srcdir)/tsig.h $(srcdir)/netio.h $(srcdir)/xfrd.h 
$(srcdir)/options.h $(srcdir)/xfrd-tcp.h $(srcdir)/xfrd-disk.h \
- $(srcdir)/difffile.h $(srcdir)/udb.h $(srcdir)/nsec3.h $(srcdir)/ipc.h 
$(srcdir)/remote.h $(srcdir)/lookup3.h $(srcdir)/rrl.h
+ $(srcdir)/difffile.h $(srcdir)/udb.h $(srcdir)/nsec3.h $(srcdir)/ipc.h 
$(srcdir)/remote.h $(srcdir)/lookup3.h $(srcdir)/rrl.h \
+ $(srcdir)/dnstap/dnstap_collector.h
 tsig.o: $(srcdir)/tsig.c config.h $(srcdir)/tsig.h $(srcdir)/buffer.h 
$(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dname.h \
  $(srcdir)/tsig-openssl.h $(srcdir)/dns.h $(srcdir)/packet.h 
$(srcdir)/namedb.h $(srcdir)/radtree.h $(srcdir)/rbtree.h $(srcdir)/query.h 
$(srcdir)/nsd.h \
  $(srcdir)/edns.h
@@ -458,7 +463,7 @@ util.o: $(srcdir)/util.c config.h $(srcdir)/util.h 
$(srcdir)/region-allocator.h
 xfrd.o: $(srcdir)/xfrd.c config.h $(srcdir)/xfrd.h $(srcdir)/rbtree.h 
$(srcdir)/region-allocator.h $(srcdir)/namedb.h \
  $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util

Re: pfctl should allow administrator to flush _anchors

2019-03-26 Thread Alexandr Nedvedicky
Hello,

> > 
> > So how people feel about changing '-Fa' to kill all rules and tables, not 
> > just
> > those, which are attached to main ruleset (root)?
> > 
> > thanks and
> > regards
> > sashan
> > 
> 
> IMHO this is a needed feature, but I agree with your hesitation about
> using -Fa. This would be convenient to type, but the current documentation
> for pfctl -a says:
> 
> "In addition to the main ruleset, pfctl can load and manipulate
>additional rulesets by name, called anchors. The main ruleset is the
>default anchor."
> 
> The wording is slightly awkward but I read this as saying the current
> behaviour is intended.
> 
> There's an obvious alternative user interface for this. Currently
>  -a '*' is only described in conjunction with -s, but it would feel
> natural to allow this to be used with -F as well, e.g.
> 
># pfctl -a '*' -Fa
> 

I like this idea to interpret "-a '*'" option in conjunction with '-F...'
in the same way we do it for "-s" already.

I also like tedu's idea to introduce a '-Freset'. I'll try to cook up some
diffs. One diff will deal with "-a '*' -F..." the other will bring 
'-Freset'.

thanks and
regards
sashan



Re: pci_sdhc: Intel eMMC controller fix

2019-03-26 Thread Mark Kettenis
Did you test this with SD-cards in slots as well as with eMMC?



Re: delete dead code: tc_getfrequency

2019-03-26 Thread Reyk Floeter
We happen to use this in the vmm pvclock diff.

Reyk

> Am 26.03.2019 um 16:28 schrieb Scott Cheloha :
> 
> Dead since import by my reckoning... so, ~15 years dead?
> 
> ok?
> 
> Index: kern/kern_tc.c
> ===
> RCS file: /cvs/src/sys/kern/kern_tc.c,v
> retrieving revision 1.43
> diff -u -p -r1.43 kern_tc.c
> --- kern/kern_tc.c25 Mar 2019 23:32:00 -1.43
> +++ kern/kern_tc.c26 Mar 2019 15:27:51 -
> @@ -346,14 +346,6 @@ tc_init(struct timecounter *tc)
>timecounter = tc;
> }
> 
> -/* Report the frequency of the current timecounter. */
> -u_int64_t
> -tc_getfrequency(void)
> -{
> -
> -return (timehands->th_counter->tc_frequency);
> -}
> -
> /*
>  * Step our concept of UTC, aka the realtime clock.
>  * This is done by modifying our estimate of when we booted.
> Index: sys/timetc.h
> ===
> RCS file: /cvs/src/sys/sys/timetc.h,v
> retrieving revision 1.8
> diff -u -p -r1.8 timetc.h
> --- sys/timetc.h25 Mar 2019 23:32:00 -1.8
> +++ sys/timetc.h26 Mar 2019 15:27:51 -
> @@ -89,7 +89,6 @@ extern struct rwlock tc_lock;
> 
> extern struct timecounter *timecounter;
> 
> -u_int64_t tc_getfrequency(void);
> voidtc_init(struct timecounter *tc);
> voidtc_setclock(const struct timespec *ts);
> voidtc_setrealtimeclock(const struct timespec *ts);
> 



delete dead code: tc_getfrequency

2019-03-26 Thread Scott Cheloha
Dead since import by my reckoning... so, ~15 years dead?

ok?

Index: kern/kern_tc.c
===
RCS file: /cvs/src/sys/kern/kern_tc.c,v
retrieving revision 1.43
diff -u -p -r1.43 kern_tc.c
--- kern/kern_tc.c  25 Mar 2019 23:32:00 -  1.43
+++ kern/kern_tc.c  26 Mar 2019 15:27:51 -
@@ -346,14 +346,6 @@ tc_init(struct timecounter *tc)
timecounter = tc;
 }
 
-/* Report the frequency of the current timecounter. */
-u_int64_t
-tc_getfrequency(void)
-{
-
-   return (timehands->th_counter->tc_frequency);
-}
-
 /*
  * Step our concept of UTC, aka the realtime clock.
  * This is done by modifying our estimate of when we booted.
Index: sys/timetc.h
===
RCS file: /cvs/src/sys/sys/timetc.h,v
retrieving revision 1.8
diff -u -p -r1.8 timetc.h
--- sys/timetc.h25 Mar 2019 23:32:00 -  1.8
+++ sys/timetc.h26 Mar 2019 15:27:51 -
@@ -89,7 +89,6 @@ extern struct rwlock tc_lock;
 
 extern struct timecounter *timecounter;
 
-u_int64_t tc_getfrequency(void);
 void   tc_init(struct timecounter *tc);
 void   tc_setclock(const struct timespec *ts);
 void   tc_setrealtimeclock(const struct timespec *ts);



Re: [patch] Re: Possible sasyncd memory leak ?

2019-03-26 Thread Michał Koc

W dniu 25.03.2019 o 15:08, Otto Moerbeek pisze:

On Sat, Mar 23, 2019 at 06:07:02PM +0100, Michał Koc wrote:


... [snip]

This is almost good. You might fold host_ip() into net_set_sa(). the
double malloc and copy isn't really needed.

-Otto


Done, patch follows

Best regards
M.K


Index: conf.y
===
RCS file: /cvs/src/usr.sbin/sasyncd/conf.y,v
retrieving revision 1.19
diff -u -p -r1.19 conf.y
--- conf.y  9 Apr 2017 02:40:24 -   1.19
+++ conf.y  26 Mar 2019 14:51:52 -
@@ -32,6 +32,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -48,6 +49,7 @@ struct cfgstate   cfgstate;
 intconflen = 0;
 char   *confbuf, *confptr;
 
+intcheck_peer_addr(const char *);
 intyyparse(void);
 intyylex(void);
 void   yyerror(const char *);
@@ -172,29 +174,21 @@ setting   : INTERFACE STRING
| PEER STRING
{
struct syncpeer *peer;
-   int  duplicate = 0;
 
-   for (peer = LIST_FIRST(&cfgstate.peerlist); peer;
-peer = LIST_NEXT(peer, link))
-   if (strcmp($2, peer->name) == 0) {
-   duplicate++;
-   break;
-   }
-   if (duplicate)
-   free($2);
-   else {
+   if (check_peer_addr($2)) {
peer = calloc(1, sizeof *peer);
-   if (!peer) {
+   if (peer == NULL) {
log_err("config: calloc(1, %lu) "
"failed", sizeof *peer);
free($2);
YYERROR;
}
peer->name = $2;
-   }
-   LIST_INSERT_HEAD(&cfgstate.peerlist, peer, link);
-   cfgstate.peercnt++;
-   log_msg(2, "config: add peer %s", peer->name);
+   LIST_INSERT_HEAD(&cfgstate.peerlist, peer, 
link);
+   cfgstate.peercnt++;
+   log_msg(2, "config: add peer %s", peer->name);
+   } else
+   free($2);
}
| LISTEN ON STRING af port
{
@@ -281,6 +275,46 @@ match(char *token)
sizeof keywords[0], match_cmp);
 
return k ? k->value : STRING;
+}
+
+int
+check_peer_addr(const char *peer_addr)
+{
+   struct ifaddrs  *ifap = 0, *ifa;
+   struct syncpeer *peer;
+   struct sockaddr_storage  ss, peer_ss;
+
+   if(net_set_sa((struct sockaddr *)&ss, peer_addr, 0) == -1) {
+   log_msg(2, "config: skip unparseable peer %s", peer_addr);
+   return 0;
+   }
+
+   if (getifaddrs(&ifap) == 0) {
+   for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) {
+   if (ifa->ifa_addr == NULL || ifa->ifa_addr->sa_family 
!= ss.ss_family)
+   continue;
+
+   if (ss.ss_len == ifa->ifa_addr->sa_len && memcmp(&ss, 
ifa->ifa_addr, ss.ss_len) == 0) {
+   log_msg(2, "config: skip local peer %s", 
peer_addr);
+   freeifaddrs(ifap);
+   return 0;
+   }
+   }
+   freeifaddrs(ifap);
+   }
+
+   for (peer = LIST_FIRST(&cfgstate.peerlist); peer != NULL; peer = 
LIST_NEXT(peer, link)) {
+   if(net_set_sa((struct sockaddr *)&peer_ss, peer->name, 0) == -1) {
+   log_msg(2, "config: net_set_sa(%s) failed", peer->name);
+   continue;
+   }
+   if (ss.ss_len == peer_ss.ss_len && memcmp(&ss, &peer_ss, ss.ss_len) 
== 0) {
+   log_msg(2, "config: skip duplicate peer %s", peer_addr);
+   return 0;
+   }
+   }
+
+   return 1;
 }
 
 int
Index: net.c
===
RCS file: /cvs/src/usr.sbin/sasyncd/net.c,v
retrieving revision 1.23
diff -u -p -r1.23 net.c
--- net.c   12 Dec 2015 20:04:23 -  1.23
+++ net.c   26 Mar 2019 14:51:52 -
@@ -71,7 +71,6 @@ AES_KEY   aes_key[2];
 
 /* Local prototypes. */
 static u_int8_t *net_read(struct syncpeer *, u_int32_t *, u_int32_t *);
-static int  net_set_sa(struct sockaddr *, char *, in_port_t);
 static void net_check_peers(void *);
 
 /* Pretty-print a buffer. */
@@ -752,35 +751,30 @@ net_read(struct syncpeer *p, u_int32_t *
return msg;
 }
 
-static int
-net_set_sa(struct sockaddr *sa, 

Re: pfctl should allow administrator to flush _anchors

2019-03-26 Thread Stuart Henderson
On 2019/03/26 09:38, Alexandr Nedvedicky wrote:
> On Mon, Mar 25, 2019 at 10:28:40PM -0400, Ted Unangst wrote:
> > Alexandr Nedvedicky wrote:
> > > it is, however -Fall operates on main ruleset only. -Fall also does
> > > not reset limits and timeouts. Hence my first idea was to introduce
> > > '-FNuke', which kills all rulesets and tables.
> > > 
> > > I don't want to change behaviour of existing option ('-Fall'), 
> > > therefore
> > > I'm in favor to introduce a new option. Either '-FNuke' or '-U' works
> > > for me. I'm the most concerned about flushing all rulesets.
> > 
> > Is the existing behavior intentional or an oversight? I don't know when I
> > would want to use -Fall, but keep the old timeouts, and depend on that. I'd
> > guess most people using -Fall are keeping old timeout only by happen stance,
> > and not because they desire that.
> 
> I had similar question on my mind when I came to PF for the first time.
> my expectations about '-Fall' were the option removes all rules (and 
> tables)
> from kernel module. But it is not the case it acts on main ruleset only.
> Given '-Fall' works like that for ages, I see changing '-Fall' to remove
> all rules as disturbing (hence I'm in favor to introduce a new option). On
> the other hand if there will be consensus to fix '-Fall' so it will remove
> all rules (not just main ruleset), then we can forget about '-U'.
> 
> With '-Fall' changed, we can further fix pfctl. The proposed '-U', will
> be achieved by combination of various '-F' modifiers:
>   pfctl -FA -FS -Fs -Freset
> command above should revert PF driver state back to initial.
> 
> > 
> > In any case, if you're seeking input on the name, something like -Freset 
> > says
> > to me that it resets pf back to its initial state.
> 
> I like the '-Fresst' to reset all PF settings (variables modified by 
> 'set')
> back to defaults.
> 
> So how people feel about changing '-Fa' to kill all rules and tables, not just
> those, which are attached to main ruleset (root)?
> 
> thanks and
> regards
> sashan
> 

IMHO this is a needed feature, but I agree with your hesitation about
using -Fa. This would be convenient to type, but the current documentation
for pfctl -a says:

"In addition to the main ruleset, pfctl can load and manipulate
   additional rulesets by name, called anchors. The main ruleset is the
   default anchor."

The wording is slightly awkward but I read this as saying the current
behaviour is intended.

There's an obvious alternative user interface for this. Currently
 -a '*' is only described in conjunction with -s, but it would feel
natural to allow this to be used with -F as well, e.g.

   # pfctl -a '*' -Fa



Re: pfctl should allow administrator to flush _anchors

2019-03-26 Thread Alexandr Nedvedicky
On Mon, Mar 25, 2019 at 10:28:40PM -0400, Ted Unangst wrote:
> Alexandr Nedvedicky wrote:
> > it is, however -Fall operates on main ruleset only. -Fall also does
> > not reset limits and timeouts. Hence my first idea was to introduce
> > '-FNuke', which kills all rulesets and tables.
> > 
> > I don't want to change behaviour of existing option ('-Fall'), therefore
> > I'm in favor to introduce a new option. Either '-FNuke' or '-U' works
> > for me. I'm the most concerned about flushing all rulesets.
> 
> Is the existing behavior intentional or an oversight? I don't know when I
> would want to use -Fall, but keep the old timeouts, and depend on that. I'd
> guess most people using -Fall are keeping old timeout only by happen stance,
> and not because they desire that.

I had similar question on my mind when I came to PF for the first time.
my expectations about '-Fall' were the option removes all rules (and tables)
from kernel module. But it is not the case it acts on main ruleset only.
Given '-Fall' works like that for ages, I see changing '-Fall' to remove
all rules as disturbing (hence I'm in favor to introduce a new option). On
the other hand if there will be consensus to fix '-Fall' so it will remove
all rules (not just main ruleset), then we can forget about '-U'.

With '-Fall' changed, we can further fix pfctl. The proposed '-U', will
be achieved by combination of various '-F' modifiers:
pfctl -FA -FS -Fs -Freset
command above should revert PF driver state back to initial.

> 
> In any case, if you're seeking input on the name, something like -Freset says
> to me that it resets pf back to its initial state.

I like the '-Fresst' to reset all PF settings (variables modified by 'set')
back to defaults.

So how people feel about changing '-Fa' to kill all rules and tables, not just
those, which are attached to main ruleset (root)?

thanks and
regards
sashan



Re: [3/4] Re: Add support for Meinberg DCF600USB to umbg(4)

2019-03-26 Thread Jason McIntyre
On Tue, Mar 26, 2019 at 08:34:11AM +0100, Paul de Weerd wrote:
> This may have gotten lost in the noise - but I forgot to update the
> DESCRIPTION section of the umbg(4) manpage.
> 
> Diff again:
> 
> Index: umbg.4
> ===
> RCS file: /home/OpenBSD/cvs/src/share/man/man4/umbg.4,v
> retrieving revision 1.5
> diff -u -p -r1.5 umbg.4
> --- umbg.422 Mar 2019 12:04:25 -  1.5
> +++ umbg.422 Mar 2019 14:47:14 -
> @@ -25,8 +25,9 @@
>  .Sh DESCRIPTION
>  The
>  .Nm
> -driver provides support for the Meinberg Funkuhren USB5131, a time signal
> -station receiver for the German DCF77 station.
> +driver provides support for the Meinberg Funkuhren USB5131 and the
> +Meinberg Funkuhren DCF600USB, two time signal station receivers for
> +the German DCF77 station.
>  .Nm
>  implements a timedelta sensor and the delta (in nanoseconds) between the
>  received time information and the local time can be accessed through the
> 

you could shorten this a little:

The
.Nm
driver provides support for Meinberg Funkuhren USB5131 and
DCF600USB time signal receivers for the German DCF77 station.

but i'm ok either way.

jmc



Re: [3/4] Re: Add support for Meinberg DCF600USB to umbg(4)

2019-03-26 Thread Paul de Weerd
This may have gotten lost in the noise - but I forgot to update the
DESCRIPTION section of the umbg(4) manpage.

Diff again:

Index: umbg.4
===
RCS file: /home/OpenBSD/cvs/src/share/man/man4/umbg.4,v
retrieving revision 1.5
diff -u -p -r1.5 umbg.4
--- umbg.4  22 Mar 2019 12:04:25 -  1.5
+++ umbg.4  22 Mar 2019 14:47:14 -
@@ -25,8 +25,9 @@
 .Sh DESCRIPTION
 The
 .Nm
-driver provides support for the Meinberg Funkuhren USB5131, a time signal
-station receiver for the German DCF77 station.
+driver provides support for the Meinberg Funkuhren USB5131 and the
+Meinberg Funkuhren DCF600USB, two time signal station receivers for
+the German DCF77 station.
 .Nm
 implements a timedelta sensor and the delta (in nanoseconds) between the
 received time information and the local time can be accessed through the


Thanks,

Paul

On Fri, Mar 22, 2019 at 04:00:06PM +0100, Paul de Weerd wrote:
| Whoops.  I had missed one change to the manpage that's still needed:
| the DESCRIPTION section also mentions the supported devices.  This now
| supports two models, but I don't think it makes sense to turn this
| into a list of supported hardware just yet.
| 
| 
| Index: umbg.4
| ===
| RCS file: /home/OpenBSD/cvs/src/share/man/man4/umbg.4,v
| retrieving revision 1.5
| diff -u -p -r1.5 umbg.4
| --- umbg.422 Mar 2019 12:04:25 -  1.5
| +++ umbg.422 Mar 2019 14:47:14 -
| @@ -25,8 +25,9 @@
|  .Sh DESCRIPTION
|  The
|  .Nm
| -driver provides support for the Meinberg Funkuhren USB5131, a time signal
| -station receiver for the German DCF77 station.
| +driver provides support for the Meinberg Funkuhren USB5131 and the
| +Meinberg Funkuhren DCF600USB, two time signal station receivers for
| +the German DCF77 station.
|  .Nm
|  implements a timedelta sensor and the delta (in nanoseconds) between the
|  received time information and the local time can be accessed through the
| 
| 
| On Fri, Mar 22, 2019 at 10:04:19AM +0100, Paul de Weerd wrote:
| | 
| | Index: share/man/man4/umbg.4
| | ===
| | RCS file: /home/OpenBSD/cvs/src/share/man/man4/umbg.4,v
| | retrieving revision 1.4
| | diff -u -p -r1.4 umbg.4
| | --- share/man/man4/umbg.4   16 Jul 2013 16:05:49 -  1.4
| | +++ share/man/man4/umbg.4   20 Mar 2019 12:16:03 -
| | @@ -19,7 +19,7 @@
| |  .Os
| |  .Sh NAME
| |  .Nm umbg
| | -.Nd Meinberg Funkuhren USB5131 timedelta sensor
| | +.Nd Meinberg Funkuhren USB5131 and DCF600USB timedelta sensors
| |  .Sh SYNOPSIS
| |  .Cd "umbg* at uhub?"
| |  .Sh DESCRIPTION
| | Index: sys/dev/usb/umbg.c
| | ===
| | RCS file: /home/OpenBSD/cvs/src/sys/dev/usb/umbg.c,v
| | retrieving revision 1.25
| | diff -u -p -r1.25 umbg.c
| | --- sys/dev/usb/umbg.c  30 Dec 2017 20:47:00 -  1.25
| | +++ sys/dev/usb/umbg.c  22 Mar 2019 08:29:40 -
| | @@ -156,8 +156,9 @@ umbg_match(struct device *parent, void *
| | if (uaa->iface == NULL)
| | return UMATCH_NONE;
| |  
| | -   return uaa->vendor == USB_VENDOR_MEINBERG &&
| | -   uaa->product == USB_PRODUCT_MEINBERG_USB5131 ?
| | +   return uaa->vendor == USB_VENDOR_MEINBERG && (
| | +   uaa->product == USB_PRODUCT_MEINBERG_USB5131 ||
| | +   uaa->product == USB_PRODUCT_MEINBERG_DCF600USB) ?
| | UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
| |  }
| |  
| | @@ -172,6 +173,7 @@ umbg_attach(struct device *parent, struc
| | usb_endpoint_descriptor_t *ed;
| | usbd_status err;
| | int signal;
| | +   const char *desc;
| |  #ifdef UMBG_DEBUG
| | char fw_id[MBG_ID_LEN];
| |  #endif
| | @@ -182,7 +184,18 @@ umbg_attach(struct device *parent, struc
| |  
| | sc->sc_timedelta.type = SENSOR_TIMEDELTA;
| | sc->sc_timedelta.status = SENSOR_S_UNKNOWN;
| | -   strlcpy(sc->sc_timedelta.desc, "USB5131",
| | +   
| | +   switch (uaa->product) {
| | +   case USB_PRODUCT_MEINBERG_DCF600USB:
| | +   desc = "DCF600USB";
| | +   break;
| | +   case USB_PRODUCT_MEINBERG_USB5131:
| | +   desc = "USB5131";
| | +   break;
| | +   default:
| | +   desc = "Unspecified Radio clock";
| | +   }
| | +   strlcpy(sc->sc_timedelta.desc, desc,
| | sizeof(sc->sc_timedelta.desc));
| | sensor_attach(&sc->sc_sensordev, &sc->sc_timedelta);
| |  
| | 
| | -- 
| | >[<++>-]<+++.>+++[<-->-]<.>+++[<+
| | +++>-]<.>++[<>-]<+.--.[-]
| |  http://www.weirdnet.nl/ 
| | 
| 
| -- 
| >[<++>-]<+++.>+++[<-->-]<.>+++[<+
| +++>-]<.>++[<>-]<+.--.[-]
|  http://www.weirdnet.nl/ 
| 

-- 
>[<++>-]<+++.>+++[<-->-]<.>+++[<+
+++>-]<.>++[<>-]<+.--.[