Bug 182819 - pfctl(8) interprets "# .... \" as multi-line comment
Summary: pfctl(8) interprets "# .... \" as multi-line comment
Status: In Progress
Alias: None
Product: Documentation
Classification: Unclassified
Component: Manual Pages (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-pf (Nobody)
Depends on:
Reported: 2013-10-08 02:10 UTC by Adam McDougall
Modified: 2018-05-17 10:38 UTC (History)
2 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Adam McDougall 2013-10-08 02:10:00 UTC
Twice I've been burned by pfctl ignoring a line in pf.conf because it
was preceded by a comment that happened to end in a backslash:

# pass in on blah blah blah doesn't matter this is a comment \
pass in on blah blah doesn't matter because this is treated as part of the comment

I try to keep my firewall rules less than 80 chars in case I need to edit
them on a dumb terminal.  Sometimes I end up duplicating a line to make
changes to an alternate copy and comment out the original, but if the
commented out line ends in a backslash, my intended replacement is ignored.
It becomes really confusing why my firewall rule is ignored yet no errors
from pfctl -f.  Eventually I figure it out.  But in my opinion, a system
that treats lines starting with # as a comment ought to unconditionally
treat them as a single line comment, and not "except if it ends in a \".
I don't know if this happens in any other pf implementation, or if it is
intentional, but it is troublesome.  I think it would be better to parse
and potentially accept lines following comments.  If they are faulty,
pfctl will throw an error.  If they are valid, they should be honored.


When a # is encountered in pf.conf, unconditionally ignore the rest of
the line.  Might be a problem with the order things are parsed?
How-To-Repeat: # pass in on blah blah blah doesn't matter this is a comment \
pass in on blah blah doesn't matter because this is treated as part of the comment

pfctl -f yourfilename, it will ignore the second line
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2014-04-16 01:40:48 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-pf

Comment 2 Adam McDougall 2016-01-16 15:48:39 UTC
I checked upstream and OpenBSD has the same behavior.  It is intentional and unlikely to change since the parser used is shared with a number of other utilities.  The behavior in this regard is described better in more recent versions of the OpenBSD manpage, for example this commit is one of several:


I'll change the metadata on this ticket to suggest it is a Doc issue.
Comment 3 Thanos 2018-05-17 10:38:10 UTC