kernel side actually handles set-tos for IPvShit - see pf_scrub() in
pf_norm.c 

ok?

Index: sbin/pfctl/parse.y
===================================================================
RCS file: /cvs/src/sbin/pfctl/parse.y,v
retrieving revision 1.614
diff -u -p -r1.614 parse.y
--- sbin/pfctl/parse.y  7 Jul 2012 16:24:32 -0000       1.614
+++ sbin/pfctl/parse.y  7 Jul 2012 17:09:19 -0000
@@ -4172,9 +4192,9 @@ rule_consistent(struct pf_rule *r, int a
                problems++;
        }
        if (r->af == AF_INET6 && (r->scrub_flags &
-           (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SETTOS))) {
+           (PFSTATE_NODF|PFSTATE_RANDOMID))) {
                yyerror("address family inet6 does not support scrub options "
-                   "no-df, random-id, set-tos");
+                   "no-df, random-id");
                problems++;
        }

Reply via email to