Twice I've been burned by pfctl ignoring a line in pf.conf because it was preceded by a comment that happened to end in a backslash: # pass in on blah blah blah doesn't matter this is a comment \ pass in on blah blah doesn't matter because this is treated as part of the comment I try to keep my firewall rules less than 80 chars in case I need to edit them on a dumb terminal. Sometimes I end up duplicating a line to make changes to an alternate copy and comment out the original, but if the commented out line ends in a backslash, my intended replacement is ignored. It becomes really confusing why my firewall rule is ignored yet no errors from pfctl -f. Eventually I figure it out. But in my opinion, a system that treats lines starting with # as a comment ought to unconditionally treat them as a single line comment, and not "except if it ends in a \". I don't know if this happens in any other pf implementation, or if it is intentional, but it is troublesome. I think it would be better to parse and potentially accept lines following comments. If they are faulty, pfctl will throw an error. If they are valid, they should be honored. Fix: When a # is encountered in pf.conf, unconditionally ignore the rest of the line. Might be a problem with the order things are parsed? How-To-Repeat: # pass in on blah blah blah doesn't matter this is a comment \ pass in on blah blah doesn't matter because this is treated as part of the comment pfctl -f yourfilename, it will ignore the second line
Responsible Changed From-To: freebsd-bugs->freebsd-pf assign.
I checked upstream and OpenBSD has the same behavior. It is intentional and unlikely to change since the parser used is shared with a number of other utilities. The behavior in this regard is described better in more recent versions of the OpenBSD manpage, for example this commit is one of several: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/pf.conf.5#rev1.495 I'll change the metadata on this ticket to suggest it is a Doc issue.
MARKED AS SPAM
Sorry for the lack of activity. (In reply to Adam McDougall from comment #2) > http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/pf.conf.5#rev1.495 Unfortunately, no longer available. Re: <https://man.freebsd.org/cgi/man.cgi?query=pfctl&sektion=8&manpath=FreeBSD+15.0-CURRENT> please, can someone suggest improvements? This might be a candidate for a simple pull request; <https://github.com/freebsd/freebsd-src/blob/main/CONTRIBUTING.md>.