For thoses who don't follow source-changes, some significant changes have been commited wrt interface handling in PF. Complete list of changes at the end of that e-mail, but basically:
1) PF now support hot-pluggable/clonable interface devices. 2) The dynamic interface syntax "(fxp0)" has been much improved.
It would be very helpful for us if a maximum of PPL could run PF on -current, so we can discover if there is any remainings issues we've not yet discovered in that code. No need to change your ruleset, just knowing that existing ruleset works flawlessy would be helpful.
One bit of warning: "pass out from (fxp0)" will match all addresses attached to the fxp0 interface, not just the first one like it used to be. This is consistant with "pass out from fxp0", but you can restore the old behaviour by writing "pass out from (fxp0:0)". Same thing with "nat -> (fxp0)" or routing directives.
Thanks for your help, Cedric
Full list of changes:
1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs.
2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in.
3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all"
4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers.
5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour.
6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)"
7) Scrub rules now support the !if syntax.
8) States can be bound to the specific interface that created them or to a group of interfaces for example:
- pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating)
9) The default value when only keep state is given can be selected by using the "set state-policy" statement.
10) "pfctl -ss" will now print the interface scope of the state.
