Re: pfctl -s all should not print operating system fingerprints
Hrvoje Popovski <[email protected]> Fri, 26 Jun 2026 17:03:44 +0200
| Newsgroups | gmane.os.openbsd.bugs |
|---|---|
| Message-ID | <[email protected]> |
On 26.6.2026. 13:51, Alexandr Nedvedicky wrote: > diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c > index a38583a9f13..786175d6fa9 100644 > --- a/sbin/pfctl/pfctl.c > +++ b/sbin/pfctl/pfctl.c > @@ -3339,6 +3339,7 @@ main(int argc, char *argv[]) > pfctl_show_limits(dev, opts); > break; > case SHOWOPT_ALL: > + opts |= PF_OPT_SHOWALL; > pfctl_init_show_rules(&show_rules_pf, dev, opts); > pfctl_load_fingerprints(dev, opts); > pfctl_show_rules(&show_rules_pf, path, PFCTL_SHOW_RULES, Hi, with this diff I'm not getting fingerprints but I see Counters match 851940 41.9/s bad-offset 0 0.0/s fragment 0 0.0/s short 25 0.0/s normalize 5 0.0/s memory 0 0.0/s bad-timestamp 0 0.0/s congestion 0 0.0/s ip-option 210 0.0/s proto-cksum 0 0.0/s state-mismatch 842 0.0/s state-insert 0 0.0/s state-limit 0 0.0/s src-limit 0 0.0/s synproxy 0 0.0/s translate 0 0.0/s no-route 0 0.0/s ID USE/LIMIT RATE/SECS ADMIT HARDLIM RATELIM ID USE/ADDRS LIMIT RATE/SECS ADMIT ADDRLIM HARDLIM RATELIM TIMEOUTS: tcp.first 120s tcp.opening 30s tcp.established 86400s on older firewalls I can't see ID USE/LIMIT and that stuff Counters match 5150255955 1163.5/s bad-offset 0 0.0/s fragment 36 0.0/s short 15241 0.0/s normalize 150 0.0/s memory 0 0.0/s bad-timestamp 0 0.0/s congestion 0 0.0/s ip-option 16 0.0/s proto-cksum 0 0.0/s state-mismatch 500347 0.1/s state-insert 0 0.0/s state-limit 0 0.0/s src-limit 0 0.0/s synproxy 0 0.0/s translate 6646 0.0/s no-route 0 0.0/s TIMEOUTS: tcp.first 30s tcp.opening 5s tcp.established 18000s