🚀 go-pugleaf

"Sioux C. Queue" <kant@have.it> writes:

> The FAQ at OpenSUSE is a fine document.  On the page 
> www.openbsd.org/faq/pf/tables.html I found this "or the self keyword".  On the 
> page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const { 
> self }".  And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this 
> "The word self will appear if the state is floating".  All of which are nice. 
> What exactly is "self"?  The computer has two NICs, which one is "self"?  Is it 
> context dependent?  Along that same line, where can I find a list, with a 
> definition, of "keywords" for IP Filter?  They're mentioned a lot.
>
> Any and all help would be appreciated.

Your references to OpenSUSE and IP Filter had me a bit confused. 

In PF configuration, the keyword 'self' expands to all addresses
assigned to all interfaces on the host (as a man pf.conf and search for
self would have told you).

- Peter

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

The <kant@have.it> address bounces (domain exists, user does not), which
brings back the less fond memories of the 1990s when such asshattery was
to some extent tolerated and even condoned in some circles due to the
then-emerging (oh, so intolerable) spam problem. 

But even without the bouncing address, the messate is a textbook example
of how *not* to ask questions. 

> The FAQ at OpenSUSE is a fine document.

That's possible, but OpenSUSE is a Linux distribution, irrelevant here,
so the reader is likely to stop reading after the first sentence

But then you do manage to dig up some relevancy, unfortunately too
jubled to actually make much sense:

> On the page www.openbsd.org/faq/pf/tables.html I found this "or the
> self keyword".  On the page www.openbsd.org/faq/pf/filter.html I found
> this "table <firewall> const { self }".  And finally, I think, at
> www.openbsd.org/faq/pf/nat.html there's this "The word self will
> appear if the state is floating".  All of which are nice.  What
> exactly is "self"?  The computer has two NICs, which one is "self"?
> Is it context dependent?  Along that same line, where can I find a
> list, with a definition, of "keywords" for IP Filter?  They're
> mentioned a lot.

For good measure, here you end up with asking for documentation on "IP
Filter", which is one of the several names for Darren Reed's ipf (which
lives on in among others Oracle's Solaris, NetBSD, and FreeBSD), the
subsystem that PF was specifically created to replace in OpenBSD, mainly
for licensing reasons.

But that's enough for now, and I suppose some level of ignorance is
excusable. Read on for the helpful part.

> Any and all help would be appreciated.

First, in contast to at least some Unix-like systems, you can expect
OpenBSD's man pages to be up to date, correct and relevant. The list of
keywords for *PF* (not "IP Filter"), is most easily accessible by typing
man pf.conf on a PF-equipped system or if you're still in a web-only
exploring phase, go to http://www.openbsd.org, click the "Manuals" link,
and then type pf.conf into the search field and click the "Submit" button.

That will land you on http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html

All OpenBSD man pages are accessible in this way.

If you find the man pages too terse or you want more examples, the PF
FAQ which you've already found is a useful resource. It's also likely
you can find useful material via the mailing list archives (both for
this one and openbsd-misc, or for that matter openbsd-newbies). 

And finally, for PF examples there is one more oft-cited resource, my
own The Book of PF (http://nostarch.com/pf2.htm) or the PF tutorial that
it grew out of (http://home.nuug.no/~peter/pf/, which links to full text
versions plus recent slides from conferences that cover more than the
BSD-licensed tutorial text).

- Peter

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

On Sat, 04 May 2013 13:08:39 -0800, Sioux C. Queue wrote:

>The FAQ at OpenSUSE is a fine document.  On the page 
>www.openbsd.org/faq/pf/tables.html I found this "or the self keyword".  On the 
>page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const { 
>self }".  And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this 
>"The word self will appear if the state is floating".  All of which are nice. 
>What exactly is "self"?  The computer has two NICs, which one is "self"?  Is it 
>context dependent?  Along that same line, where can I find a list, with a 
>definition, of "keywords" for IP Filter?  They're mentioned a lot.
>
>Any and all help would be appreciated.

<quote>The FAQ at OpenSUSE is a fine document.</quote> - huh?

As usual the man page is the place to go. In pf.conf's man page there
is even a definition of "self" as it is used in pf.conf.

Unusually (for man pages) man 5 pf.conf has a BNF statement of the
syntax. You should learn about BNF if you don't know it.

R/


*** NOTE *** Please DO NOT CC me. I <am> subscribed to the list.
Mail to the sender address that does not originate at the list server is tarpitted. The reply-to: address is provided for those who feel compelled to reply off list. Thankyou.

Rod/
---
This life is not the real thing.
It is not even in Beta.
If it was, then OpenBSD would already have a man page for it.

On Sat, May 4, 2013 at 5:08 PM, Sioux C. Queue <kant@have.it> wrote:
> The FAQ at OpenSUSE is a fine document.  On the page
> www.openbsd.org/faq/pf/tables.html I found this "or the self keyword".  On the
> page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const {
> self }".  And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this
> "The word self will appear if the state is floating".  All of which are nice.
> What exactly is "self"?  The computer has two NICs, which one is "self"?  Is it
> context dependent?  Along that same line, where can I find a list, with a
> definition, of "keywords" for IP Filter?  They're mentioned a lot.
>
> Any and all help would be appreciated.

>From the manual (http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf):

self            Expands to all addresses assigned to all
                             interfaces.

Hope that helps.
-ME

On 2013/05/05 13:29, Peter N. M. Hansteen wrote:
> But even without the bouncing address, the messate is a textbook example
> of how *not* to ask questions. 

I think the textbook in question here is "introduction to trolling, an
entry-level guide" :)

On 05/05/2013 10:03 AM, Peter N. M. Hansteen wrote:

> Your references to OpenSUSE and IP Filter had me a bit confused.

And obviously me too.  In my defense, in addition to the OpenBSD 5.3 install, I 
haven't done much with BSD since the 90's so my memory is fuzzy, I just finished 
(well mostly finished) upgrading two computers to OpenSUSE 12.3 and there's overlap.

> In PF configuration, the keyword 'self' expands to all addresses
> assigned to all interfaces on the host (as a man pf.conf and search for
> self would have told you).

Thanks, I'll look at that also.  Again in my defense, I've always looked at the 
INSTALL file, README file, any FAQ's I can find, and lastly whatever 
documentation I can find.  I've always considered man pages as something you 
refer back to after you've figured out how a command works, but need a refresher 
on a specific option.