Date: Wed, 23 Aug 2006 10:06:49 -0400 From: beno <zope@2012.vi> To: freebsd-pf@freebsd.org Subject: Re: Another Lists/Macros Question Message-ID: <44EC60F9.2080102@2012.vi> In-Reply-To: <1156318917.1543.11.camel@genius.i.cz> References: <44EB6B18.4030201@2012.vi> <8eea04080608221517rd487cf1v35f5372c1a5bb157@mail.gmail.com> <1156318917.1543.11.camel@genius.i.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
Michal Mertl wrote:
> Note that no quoting is necessary here and the parser doesn't care much
> about whitespace. If you run pfctl with "-v" you shall see the macro
> expansion which should help in understanding the parser and finding out
> errors.
>
That does help! Thanks! Now, throwing that flag with the others (-f and
-n) I now get the following errors:
set fingerprints /etc/pf.os
pfctl: /etc/pf.os : No such file or directory
In fact, there *is* such a file, and it's the default! I haven't edited
it, changed perms, etc. Now, if I recall correctly, I don't need to
actually cite that file, since the parser will include it automatically;
however, there is certainly nothing wrong with doing so, therefore it
should not throw an error! Wazzup?
server167# ls -al /etc/|grep pf.os
-rw-r--r-- 1 root wheel 26591 Aug 17 18:32 pf.os
(I'm in as root.)
/etc/pf.conf:24: syntax error
Here's that line, which the parser doesn't parse, preceded by other
lines in question:
shinjiru_ip_addresses="202.71.102.114 202.71.100.126 202.71.106.30
202.71.106.118 202.71.106.188 203.142.1.8"
directv_ip_addresses="{ 69.19.0.0/17 }"
shadday_ip_addresses=""
ssh_ip_addresses= $shinjiru_ip_addresses $directv_ip_addresses
$shadday_ip_addresses
Now, we've been here before, and I was instructed to write the
directv_ip_address line just so, but now the parser is throwing another
error based on that very variable yet again! (I have singled it out
through experimentation.) What doesn't it like this time?
/etc/pf.conf:68: syntax error
pass in quick proto tcp from any to any port = ssh flags S/SA keep state
(source-track rule, max-src-conn 15, max-src-conn-rate 5/3, overload
<bruteforce> flush global, if-bound, src.track 3)
when the actual lines I wrote are these:
web_server="202.71.106.119"
http_ports="80 8080 7080"
ssh_ports="22"
ftp_ports="21 8021 7021"
https_ports="443"
imap_ssl_ports="993 143"
all_http_ports= $http_ports $https_ports
tcp_ports= $ssh_ports $ftp_ports $all_http_ports $imap_ssl_ports
pass in quick inet proto tcp from any to $web_server port $tcp_ports
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, overload <bruteforce>
flush global)
Here are my questions concerning this much:
* Why does the parser render "from any to $web_server" as "from any to
any"? That's not what I specified!
* Why does the parser render "port $tcp_ports" as "port = ssh"? That's
not what I specified, either!
* Why does the parser automatically reduce my variables max-src-conn and
max-src-conn-rate (okay because the proportion is the same?)
TIA,
beno
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44EC60F9.2080102>