Cardinality of ruleset

[iMac-ant]

Good morning to all, I have a question:

the number of rules in /tmp/rules.debug (starting from antispoof lof for <interface>)  is grather than the number of rules obtained through pfctl -s rules. Why?

I'm just considering the default ruleset.

[franco]

The generated rules in /tmp/rules.debug are a "proposal" to pfctl, the ruleset obtained from pfctl is the one that is already cleaned up somewhat regardless of optimization state.


Cheers,
Franco

[iMac-ant]

What is the cleaning criteria of pfctl? Is there any anomaly, suach as dependency anomaly o redundancy anonmaly?

[franco]

You will have to consult the source code for this to be sure.


Cheers,
Franco

[iMac-ant]

Thank you very mych.

Antonio