Where'd you submit them to exactly? Do you have a freebsd review / pull request?
-a On Thu, 8 Oct 2026 at 14:03, Robert Austen < [email protected]> wrote: > I've been working with PF under freebsd for a few months, and have noticed > a recurring theme in the forums, > that the macros in PF could be improved. > > I notice that it is often difficult to define one macro in terms of > another, and just addressing that item alone would help > write cleaner simpler rules. > > here are two possible changes to parse.y of pfctl. > change 1: > > @@ -872,6 +872,16 @@ > numberstring : NUMBER { > char *s; > if (asprintf(&s, "%lld", (long long)$1) == -1) { > yyerror("string: asprintf"); > YYERROR; > } > $$ = s; > } > + | '@' STRING { > + char s = symget($2); > + if (s == NULL) { > + yyerror("macro '%s' not defined", $2); > + YYERROR; > + } > + if (($$ = strdup(s)) == NULL) { > + err(1, "numberstring: strdup"); > + } > + } > | STRING > ; > > this change allows a macro to be defined in terms of an existing macro, > using the '@' to refer to that existing macro by name, > rather than expanding the macro out and causing the eventual 'syntax > error' response that often results. > > this allows using one macro within another > set_ext_tag = "tag \"from_outside\"" > is_int_tag = "tagged \"from_inside\"" > > combined_tags = @set_ext_tag @is_int_tag > > this results in $combined_tags expanding to: > tag "from_outside" tagged "from_inside" > > > change 2: > @@ -861,6 +861,12 @@ > varstring : numberstring varstring { > if (asprintf(&$$, "%s %s", $1, $2) == -1) > err(1, "string: asprintf"); > free($1); > free($2); > } > + | numberstring '+' varstring { > + if (asprintf(&$$, "%s%s", $1, $3) == -1) > + err(1, "string: asprintf"); > + free($1); > + free($3); > + } > | numberstring > ; > > the existing grammar for varstring inserts a space, which is not always > helpful, so the second change. > this change adds the '+' operator to explicitly concat two strings > together (either or both could be a macro), > which allows the following > > subnet = "192.168.0." > client = @subnet + "206" > > > this results in $client expanding to: > 192.168.0.206 > > > I've been working with one external interface and four mostly isolated > LANs, two of which have common > rules, and rather than copy-paste everything, I've been fighting with the > limitations of PF's macros. > These two changes make it ever so much easier to maintain readable, > maintainable rules, so I figured > I would toss them into the ring. > > > Robert > > > ps: I've already submitted my corrections to PFIL (the shared layer > beneath PF, IPFW, IPTABLES) that block > by default traffic that goes through the firewall before whatever the > chosen firewall layer (PF, IPFW, IPTABLES) > comes alive and loads its ruleset, but I haven't seen them applied. > Communication wrt them has gone cold. > But if anyone is interested in blocking unwanted traffic that gets thru > during a delayed filesystem check etc., > I can send them again. > > > > > > > > > > >
