Re: Layer-2 filtering in NPF

[Emmanuel Nyarko <emmankoko519%gmail.com@localhost>]

> On 5 Jul 2025, at 1:01 AM, Greg Troxel <gdt%lexort.com@localhost> wrote:
> 
> Apparently I'm having a different upgrade problem.
> 
> I had a rule in npf.conf that was accepted by my previous -current
> (early May?), and now it isn't.  That led to the default rules in
> npf_conf operating, and those did not allow dhcpcd to succeed.
> 
> The rule that is now objected to looks like
> 
>    pass in proto udp to any port 11000-11002
> 
> (but not those numbers).  Reading the man page, port-opts is
> 
>    port-opts       = "port" ( port-num | port-from "-" port-to | var-name )
> 
> which indeed my line did not match, so I changed to
> 
>    pass in proto udp to any port 11000 - 11002

i just removed the scanner rule for hyphen-sperated Mac addresses. And port 334-556 works as expected. 
for now, i will be taking that out of current. And then work to add port tests in our teting framework.
i just checked and realized there’s no port testing. so I’m adding it.
> 
> but I didn't see this in the announced changes.
> 

Emmanuel