Re: Layer-2 filtering in NPF

[Christoph Badura <bad%bsd.de@localhost>]

On Fri, Jul 04, 2025 at 09:01:56PM -0400, Greg Troxel wrote:
> The rule that is now objected to looks like
> 
>     pass in proto udp to any port 11000-11002
> 
> (but not those numbers).  Reading the man page, port-opts is
> 
>     port-opts       = "port" ( port-num | port-from "-" port-to | var-name )
> 
> which indeed my line did not match, so I changed to

The man page clearly states that it is a "non-formal BNF-like definition of
the grammar".  Looks to me like the non-formal part is ment to say that it
doesn't have to explicitly state where whitespace is necessary.  Obviously
whitespace is necessary where tokens could otherwise not be separated.

But a port range like 123-456 is easily tokenizable.  Especially because
negative port numbers don't exist. :-)

I was expecting that bit of "non-formal BNF-like grammar" to mean that no
whitespace is needed.  Any other interpretation violates common sense and
common usage.

Fortunately, this has been fixed already.  Altough I haven't seen a test
case when I looked at the npftest.conf file an hour or so ago.

--chris