What is wrong with pf in 5.0?

[Nino Dehne]

Hi,

I upgraded my router to 5.0.0_PATCH and somehow pf is borked.

Rules such as

pass in quick on $ext6_if inet6 from any to { $ext6_if_local, $ext6_net }
pass out quick on $ext6_if inet6 from { $ext6_if_local, $ext6_net } to any

get expanded to

pass in quick on gif0 inet6 from any to [...] flags S/SA keep state (if-bound)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
pass in quick on gif0 inet6 from any to [...] flags S/SA keep state (if-bound)
pass out quick on gif0 inet6 from [...] to any flags S/SA keep state (if-bound)
pass out quick on gif0 inet6 from [...] to any flags S/SA keep state (if-bound)

What the hell? Why does it apply TCP flags and state keeping when I didn't
request that anywhere?

Regards

[Hauke Fath]

Post by Nino Dehne
I upgraded my router to 5.0.0_PATCH and somehow pf is borked.

Is not.

Post by Nino Dehne
What the hell? Why does it apply TCP flags and state keeping when I didn't
request that anywhere?

That is the default for post-OpenBSD 4.1 pf.

HTH,
hauke

--
"It's never straight up and down" (DEVO)



--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Nino Dehne]

Post by Hauke Fath

Post by Nino Dehne
I upgraded my router to 5.0.0_PATCH and somehow pf is borked.

Is not.

Indeed.

Post by Hauke Fath

Post by Nino Dehne
What the hell? Why does it apply TCP flags and state keeping when I didn't
request that anywhere?

That is the default for post-OpenBSD 4.1 pf.

Thanks, I didn't notice for several reasons:

1) server is still running 4.0 and the router has no man pages
2) http://netbsd.gw.com/cgi-bin/man-cgi?pf.conf defaults to 3.0 man pages (?!)

I fixed the ruleset and all is well. Thanks.

Regards