Thanks, On Sat, 25 Jul 2020 15:00:07 +0200 Alexander Bluhm <[email protected]> wrote: > On Sat, Jul 25, 2020 at 09:37:37PM +0900, YASUOKA Masahiko wrote: >> Is this part a reason why we have "divert-reply"? > > Yes. > > Divert rules pass packets to the local network stack. With divert-to > you specify the socket address. This works for incomming connections. > The divert-to address can be 127.0.0.1 or anything else with > SO_BINDANY. > > When you use SO_BINDANY for outgoing connections and you don't know > the addresses when writing pf.conf, use divert-reply. > > As dangling states interfere with new connections, I added the > divert state cleanup. This is especially necessary for DGRAM or > RAW sockets.
Yes. My first message shows it is neccessary for TCP. Also my diff was totally wrong it deletes the states regardless of it's for divert or not. >> > Is that not possible for you? >> >> It's possible. > > Fine, then use divert-reply instead of changing the semantics. I have thought it's hard to create a divert-reply rule for relayd's "transparent forward to destination" case. But I noticed tftp-proxy is using "group _tftp_proxy" to match connections only from the program precisely. I'll send diffs to do the same thing for relayd in a separated mail.
