Thursday, December 30, 2021

Limitations of nested pf macros

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP.js v4.10.10
Comment: https://openpgpjs.org

xjMEXgC2YBYJKwYBBAHaRw8BAQdAQA+KKw+Qq8h9No9fFimv30ceksavGXuE
HUx1LojmTXvNJ2xpc3RzQG9saXZhcmltLmNvbSA8bGlzdHNAb2xpdmFyaW0u
Y29tPsJ3BBAWCgAfBQJeA2TyBgsJBwgDAgQVCAoCAxYCAQIZAQIbAwIeAQAK
CRASK0Q/JJNIqEVBAP4vVK7DIKLx8SpF5QWMN4B7+5syU2+uTyuz4UVrVplk
ugEAsyBgGYShlmdxidP3zR3FvnVj+goJJiT0mcaMU9p27wnOOAReALZgEgor
BgEEAZdVAQUBAQdA4/nWbMve668QGeAJeO2se1o/hvoXnGcUGybVOj4amy8D
AQgHwmEEGBYIAAkFAl4DZPICGwwACgkQEitEPySTSKgEsgEAzZdmnhXzhy9B
jjdedS96c3uM8duXycYhnqDMd3GqcowBANL9PxauWYT4MSB6ULfwGgTFWiQ1
VDFo/h6lYo+f/10E
=op6K
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: ProtonMail

wnUEARYKAAYFAmHNhTcAIQkQEitEPySTSKgWIQT9XZzyQT9owB/V7XYSK0Q/
JJNIqHIhAP496xikPk0vJN6OBJTGIxHG4gW/3gLAk6ijgGvudGg/fgEAoIB5
aZmh5LqTUwBjwNE8s9qst29/QYPRaKNnYZGNDww=
=Q8gV
-----END PGP SIGNATURE-----

Hi,

I'm using OpenBSD 7.0.

While building a pf ruleset, I found out that trying to nest macros
results in syntax errors, unless the original macros were defined
with double (nested) quoting (e.g.: "'0.0.0.0/0'" or "\"0.0.0.0/0\"").

I've read the man pages and the OpenBSD FAQ, but could not find any
internal reference to this. I was able to fix my ruleset thanks to a
post on serverfault [1]. Yet, I was not able to nest macros more
than one level deep, since triple quoting the macro value also
triggers syntax errors.

Is this limitation expected ? If so, how can I help to have it
documented somewhere ?

Thank you,

[1]: https://serverfault.com/questions/575876/expanding-a-macro-containing-a-subnet-ip-address-with-prefix-cidr-in-a-list-us

No comments:

Post a Comment