pf: Update documentation regarding matching, scrubbing and reassembly

[vegeta_tuxpowered.net]

Summary

Update pf documentation:

• default behaviour of fragment reassembly
• introduction of scrub option for filter rules
• disadvantages of using the old scrub ruleset
• options supported for match rules
• fix missing list block end
• remove duplicate description of match filter rule
• update example to modern syntax

Sponsored by: InnoGames GmbH
Fragments obtained from: OpenBSD

[vegeta_tuxpowered.net]

Update man page's date.

[kp]

Yay, documentation! The best kind, written by someone else :)

share/man/man5/pf.conf.5

491

We say that 'yes' is default twice. Once should be enough.

I'm also not entirely clear on where we set this default. I can't find it in pfctl or the kernel.

785

spoof*ed* traffic?

958

That's probably better as two separate sentences. (I.e. "This means excessive usage of them will cause performance a penalty. scrub reassemble tcp rules must not have the direction (in/out) specified."

3049

Normalize or reassemble?

[vegeta_tuxpowered.net]

share/man/man5/pf.conf.5

491

You are right, I thought I've imported it from OpenBSD with the same defaults, but I did not:

pf_ioctl.c:

	/*
	 * XXX This is different than in OpenBSD where reassembly is enabled by
	 * defult. In FreeBSD we expect people to still use scrub rules and
	 * switch to the new syntax later. Only when they switch they must
	 * explicitly enable reassemle. We could change the default once the
	 * scrub rule functionality is hopefully removed some day in future.
	 */
	V_pf_status.reass = 0;

I'll update the documentation.

785

That is the part imported from OpenBSD, I'll fix it nevertheless.

[jlduran]

Thank you! I think the project insists that the documentation be in American English:

🇬🇧	🇺🇸
normalisation	normalization
sanitising	sanitizing
behaviour	behavior

[kp]

In D42270#964457, @jlduran_gmail.com wrote:

Thank you! I think the project insists that the documentation be in American English:

🇬🇧	🇺🇸
normalisation	normalization
sanitising	sanitizing
behaviour	behavior

That does not appear to be the case for this man page. There are 7 instances of 'behaviour' already in the man page. On the other hand, there is also 'NORMALIZATION', so I'll fix that one before I commit this.

I'm a little torn on the others. For this commit I'm not going to change them, but it might be good to do a consistency pass on the entire man page. On the other hand, sticking closer to upstream is also not a bad thing. (Upstream appears to prefer UK English spelling for the man page, but then uses 'optimization' in the actual pf keyword.)