Repository navigation
firewall: verify pf's main ruleset references the janus anchor - #71
Merged
Merged
Conversation
shreeve
force-pushed
the
firewall/anchor-reference
branch
from
October 11, 2026 12:32
0e2bdf2 to
b16828b
Compare
…nd reload pf.conf when it does not pfctl -F all, or a pfctl -f of a file without the reference, leaves the janus anchor's rules loaded but never evaluated; checkPf compared only the anchor's rules and called that verified. It now requires pfctl -sr to list anchor "janus" ahead of anchor "com.apple/*", and applyPf reloads /etc/pf.conf (parse-checked) when the reference is gone, even with pf.conf already wired.
shreeve
force-pushed
the
firewall/anchor-reference
branch
from
October 11, 2026 13:46
b16828b to
b206ed4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
checkPfchecked that pf is enabled and that the janus anchor holds exactly the anchor file's rules. It never checked that pf's main ruleset still references the anchor. Afterpfctl -F all, or apfctl -fof a file withoutanchor "janus"(a VPN client, a hand reload), the anchor's rules stay loaded but are never evaluated. The host was then wide open whilesudo janus statussaidverified. The #60 pf-verifier draft lists this as its finding 6.Change
checkPfrequirespfctl -srto listanchor "janus"beforeanchor "com.apple/*"(pfReferenced). Otherwise the verdict is "pf's main ruleset does not evaluate the janus anchor ahead of Apple's".applyPfused to reload only the anchor whenever pf.conf was already wired, sosudo janus firewallcould not fix a flushed reference, and with the new check it would just fail. It now reloads/etc/pf.confwhen the reference is gone (pfctl -nffirst, thenpfctl -f), leaving the file untouched. This is the repair the Draft contracts: confine, metrics, trust bootstrap, auth session lifetime, pf verifier #60 draft specifies for this failure.Tests
TestCheckPfVerdictscovers an empty main ruleset, a reference behind Apple's anchor, andanchor "janus/sub", which is not the anchor.TestApplyPfRestoresTheReferencecovers wired pf.conf with a flushed ruleset: the check fails, then apply parse-checks, reloads pf.conf without rewriting it, and the result verifies.pfctl -srnow lists the filter anchors of whichever pf.conf was last loaded (or the booted one).make test: unit suites pass and acceptance passes 174/174 in the foreground;go vetpasses for linux and windows.Not verified on a live host.
pfctl -srneeds root. Itsanchor "name" allformat is pfctl's standard listing, but the nextsudo janus statuson a macOS edge is the first real check.