Thanks for answer!
Am 20.03.2013 16:23, Ermal Luçi wrote:
> That is intended behavior.
What is intended bahavior, your reference is not clear to me.
> There is an option -m to merge the configs which should not break it.
Ok, but this option does never prevent pfctl from clearing all interface
option flags. If you run the command from the man page
echo "set loginterface fxp0" | pfctl -mf -
then every active running socket over lo0 breaks because the function
pfctl_clear_interface_flags() is called independent of the PF_OPT_MERGE
flag. In the example the option -m provokes that pfctl_load_logif() is
called as intended, but not pfctl_load_limit(), pfctl_load_timeout(),
pfctl_load_debug(), pfctl_load_hostid() and pfctl_file_fingerprints().
The lo0 breaking function pfctl_clear_interface_flags() is called when
the flag PFCTL_FLAG_OPTION is set. This is the case with option -O but
also if none of the options -N, -R, -A are set, thats a little bit
tricky. Therefore pfctl -N -R -A -f /etc/pf.conf never breaks lo0 but
does not exactly the same as pfctl -f /etc/pf.conf because the flag
PFCTL_FLAG_OPTION is not set.
Andreas Longwitz
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[email protected]"
