From owner-freebsd-questions@freebsd.org  Wed May 18 07:24:11 2016
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 582BDB40254;
 Wed, 18 May 2016 07:24:11 +0000 (UTC)
 (envelope-from stdin@niklaas.eu)
Received: from box-fra-01.niklaas.eu (box-fra-01.niklaas.eu
 [IPv6:2a00:c98:2200:af07:6::1])
 by mx1.freebsd.org (Postfix) with ESMTP id 280BB1E65;
 Wed, 18 May 2016 07:24:11 +0000 (UTC)
 (envelope-from stdin@niklaas.eu)
Received: by box-fra-01.niklaas.eu (Postfix, from userid 1001)
 id A510861FC4; Wed, 18 May 2016 09:24:09 +0200 (CEST)
Date: Wed, 18 May 2016 09:24:09 +0200
From: Niklaas Baudet von Gersdorff <stdin@niklaas.eu>
To: freebsd-questions@freebsd.org, freebsd-pf@freebsd.org
Subject: `echo <something> | pfctl -mf -` overriding instead of modifying
Message-ID: <20160518072409.GD99839@box-fra-01.niklaas.eu>
Mail-Followup-To: freebsd-questions@freebsd.org, freebsd-pf@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.24 (2015-08-30)
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 18 May 2016 07:24:11 -0000

Note: crossposting in freebsd-questions and freebsd-pf

On a 10.3-RELEASE system, in my `/etc/pf.conf` I have the following lines:

	ext_if="vtnet0"
	...
    rdr-anchor "jails/*" on $ext_if inet to $ext_if

In my `/etc/jail.conf` I have the following lines for some jail:

    exec.poststart += "echo 'rdr pass on vtnet0 inet  proto { udp tcp } to vtnet0 port domain ->   $private_ip4' | pfctl -a 'jails/$name' -f -";
    exec.poststart += "echo 'rdr pass on vtnet0 inet6 proto { udp tcp } to vtnet0 port domain ->   $private_ip6' | pfctl -a 'jails/$name' -mf -";

Nonetheless, if I start the jail, only the inet6 rules will stay in the
appropriate anchor. The inet rules will be overridden.

Initially, I only used the `-f -` flags for pfctl (instead of `-mf -`) and
realised that making changes to the anchor overrides existing rules. So
I read pfctl(8) where it says

     -m      Merge in explicitly given options without resetting those
     which are omitted.  Allows single options to be modified without
     disturbing the others:

        # echo "set loginterface fxp0" | pfctl -mf -

So I thought that adding `-m` to the rule in the second `exec.poststart`
will include (instead of replace) the rules into the anchor. But this is
not the case. What am I doing wrong? Do I misunderstand `-m`?
    
    Niklaas