The enc(4) man page states ``all rules on the enc interface should
explicitly set `keep state (if-bound)'.''  Defaulting stateful rules
to if-bound on the enc0 interface seems like a good candidate for
OpenBSD's reasonable defaults policy.

Looking at pfctl/parse.y, the main issue in implementing this seems to
be that expand_rule() cannot tell whether ``floating'' was set
explicitly or not, so it cannot override the default on a
per-interface basis.  (The obvious hackish solution is to add another
bit for PFRULE_FLOATING, but that's gross.)

Reply via email to