Re: pfctl: stricter redirect specs

2014-06-24 Thread Stuart Henderson
On 2014/06/24 15:07, Mike Belopuhov wrote: > I propose to avoid the confusion by flagging such situations as > errors, e.g.: > > % echo 'pass out nat-to { ::1 1.1.1.1 }' | ./obj/pfctl -o none -vnf - > stdin:1: translation spec contains addresses with different address families > stdin:1: skipp

Re: pfctl: stricter redirect specs

2014-06-24 Thread Mike Belopuhov
On Tue, Jun 24, 2014 at 15:07 +0200, Mike Belopuhov wrote: > I have carefully tested that and do not expect any unrelated > fallout. And for the reasons stated above I don't believe > anyone is using this since it's largely error prone. > and a regress chunk that avoids using such combination.

pfctl: stricter redirect specs

2014-06-24 Thread Mike Belopuhov
Hi, Looking at some corner-cases I've realised that collapse_redirspec does a poor job of weeding out incompatibilities in the redirect pool specifications and hence inferring the rule address family from it. An example is a rule like this: pass out nat-to em0 Let's say that em0 has an IPv4 ad