From owner-freebsd-pf@FreeBSD.ORG Thu Aug 17 08:16:43 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AC67916A4DD for ; Thu, 17 Aug 2006 08:16:43 +0000 (UTC) (envelope-from solinym@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.183]) by mx1.FreeBSD.org (Postfix) with ESMTP id E04C243D6A for ; Thu, 17 Aug 2006 08:16:40 +0000 (GMT) (envelope-from solinym@gmail.com) Received: by py-out-1112.google.com with SMTP id c59so699460pyc for ; Thu, 17 Aug 2006 01:16:40 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=RcWTikcVue/X6sbMVuMtgLRGtrK9MDRtx5rVmpfzgk2NgsRIim7qdvJh44JpwI+4FNbSR6oeXRN9Q1o2oH5bJT8NrMIKZqDXkxaSDZZoRANJub24aq8ZQKJywFgrYse2mCnZK2Dle/TNLshJB5k3JxDoYZP3FhI2If0+Lf81QQ0= Received: by 10.35.29.6 with SMTP id g6mr3164413pyj; Thu, 17 Aug 2006 01:16:40 -0700 (PDT) Received: by 10.35.34.13 with HTTP; Thu, 17 Aug 2006 01:16:39 -0700 (PDT) Message-ID: Date: Thu, 17 Aug 2006 03:16:39 -0500 From: "Travis H." To: Volker In-Reply-To: <44DF4125.6060009@vwsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <000001c6bed4$680fd4d0$0a00a8c0@thebeast> <44DF4125.6060009@vwsoft.com> Cc: Greg Hennessy , freebsd-pf@freebsd.org Subject: Re: "Reset" Script, Anyone? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2006 08:16:43 -0000 Back when NetBSD was using ipfilter, there was a way to simulate throwing packets at a packet filter. I wrote a regression test harness around it, to make sure that a new config file would allow certain basic operations and prevent a few basic operations, as a kind of sanity check, before even loading it. It sure would be nice if pf had something like it. I suppose with some preprocessing judo, you could remap the interfaces to some temporary interface aliases you set up, but that's not a particularly easy or comprehensive way of testing your rules. Although I seem to recall someone suggesting a way to do something similar... anyone have any suggestions? -- "If you're not part of the solution, you're part of the precipitate." Unix "guru" for rent or hire -><- http://www.lightconsulting.com/~travis/ GPG fingerprint: 9D3F 395A DAC5 5CCC 9066 151D 0A6B 4098 0C55 1484