[patch] Reloading pf rules breaks connections on lo0

[Andreas Longwitz]

Thanks for answer!

Am 20.03.2013 16:23, Ermal Luçi wrote:
 > That is intended behavior.
What is intended bahavior, your reference is not clear to me.

 > There is an option -m to merge the configs which should not break it.
Ok, but this option does never prevent pfctl from clearing all interface 
option flags. If you run the command from the man page
      echo "set loginterface fxp0" | pfctl -mf -
then every active running socket over lo0 breaks because the function
pfctl_clear_interface_flags() is called independent of the PF_OPT_MERGE
flag. In the example the option -m provokes that pfctl_load_logif() is 
called as intended, but not pfctl_load_limit(), pfctl_load_timeout(), 
pfctl_load_debug(), pfctl_load_hostid() and pfctl_file_fingerprints().

The lo0 breaking function pfctl_clear_interface_flags() is called when 
the flag PFCTL_FLAG_OPTION is set. This is the case with option -O but 
also if none of the options -N, -R, -A are set, thats a little bit 
tricky. Therefore pfctl -N -R -A -f /etc/pf.conf never breaks lo0 but 
does not exactly the same as pfctl -f /etc/pf.conf because the flag 
PFCTL_FLAG_OPTION is not set.

Andreas Longwitz