Merge pull request #884 from vgrebenschikov/feature/synlimit-pf-support

Add PF synlimit backend

src/config/tests/load_basic_tests.rs

@@ -62,6 +62,26 @@ fn synlimit_synfix_defaults_are_loaded_for_listener() {
     assert_eq!(listener.synlimit_hashlimit_size, 32_768);
 }
 
+#[test]
+fn synlimit_pf_mode_is_loaded_for_listener() {
+    let cfg = load_config_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [[server.listeners]]
+            ip = "0.0.0.0"
+            port = 443
+            synlimit = "pf"
+        "#,
+    );
+
+    assert_eq!(cfg.server.listeners[0].synlimit, SynLimitMode::Pf);
+}
+
 #[test]
 fn synlimit_synfix_zero_values_are_rejected() {
     for (field, expected) in [

src/config/types.rs

@@ -1471,6 +1471,8 @@ pub enum SynLimitMode {
     Iptables,
     /// Use nftables two-tier SYN-fix rules with per-source token-bucket meters.
     Nftables,
+    /// Use FreeBSD PF source tracking with connection-rate state limits.
+    Pf,
 }
 
 impl Serialize for SynLimitMode {
@@ -1482,6 +1484,7 @@ impl Serialize for SynLimitMode {
             Self::Off => serializer.serialize_bool(false),
             Self::Iptables => serializer.serialize_str("iptables"),
             Self::Nftables => serializer.serialize_str("nftables"),
+            Self::Pf => serializer.serialize_str("pf"),
         }
     }
 }
@@ -1497,7 +1500,7 @@ impl<'de> Deserialize<'de> for SynLimitMode {
             type Value = SynLimitMode;
 
             fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-                formatter.write_str("false, iptables, or nftables")
+                formatter.write_str("false, iptables, nftables, or pf")
             }
 
             fn visit_bool<E>(self, value: bool) -> std::result::Result<Self::Value, E>
@@ -1506,7 +1509,7 @@ impl<'de> Deserialize<'de> for SynLimitMode {
             {
                 if value {
                     Err(E::custom(
-                        "synlimit=true is ambiguous; use \"iptables\" or \"nftables\"",
+                        "synlimit=true is ambiguous; use \"iptables\", \"nftables\", or \"pf\"",
                     ))
                 } else {
                     Ok(SynLimitMode::Off)
@@ -1521,8 +1524,9 @@ impl<'de> Deserialize<'de> for SynLimitMode {
                     "false" | "off" | "disabled" | "none" => Ok(SynLimitMode::Off),
                     "iptables" => Ok(SynLimitMode::Iptables),
                     "nftables" => Ok(SynLimitMode::Nftables),
+                    "pf" => Ok(SynLimitMode::Pf),
                     _ => Err(E::custom(
-                        "synlimit must be false, \"iptables\", or \"nftables\"",
+                        "synlimit must be false, \"iptables\", \"nftables\", or \"pf\"",
                     )),
                 }
             }