>Number:         5467
>Category:       bin
>Synopsis:       ipf rule parsing inconsistent (at least with manpage)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 19 14:50:01 1998
>Last-Modified:
>Originator:     Heiko W.Rupp
>Organization:
private
>Release:        NetBSD 1.3.1
>Environment:
	
System: NetBSD snert 1.3.1 NetBSD 1.3.1 (SNERT) #11: Tue May 19 22:30:46 MEST 1998 hwr@snert:/homes/hwr/sys/arch/i386/compile/SNERT i386


>Description:

	ipf(5) says:

[...]
       protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
[...]
              The special protocol keyword tcp/udp may be used to
              match either a TCP or a UDP packet,  and  has  been
              added  as a convenience to save duplication of oth-
              erwise-identical rules.
[...]
       If a port match is included, for either or both of  source
       and  destination,  then  it is only applied to TCP and UDP
       packets. If there is no  proto  match  parameter,  packets
       from  both  protocols  are compared. This is equivalent to
       "proto tcp/udp".  When composing port comparisons,  either

But reality is different.

>How-To-Repeat:
Assume the folowing input file:

--------
pass in on ppp0 all head 100
# no good
block in log quick proto tcp/udp from any to any port = netbios-ns group 100
# good
block in log quick proto tcp from any to any port = netbios-ns group 100
block in log quick proto udp from any to any port = netbios-ns group 100
#no good
block in log quick from any to any port = netbios-ssn group 100
--------

and run ipftest -d -r<filename> on it. You will get:

parse [pass in on ppp0 all head 100]
iplioctl(SIOCADDFR,0xe8f4,1) = 0
parse [block in log quick proto tcp/udp from any to any port = netbios-ns group 100]
no protocol given for TCP/UDP comparisons
^^^^^^!!!
parse [block in log quick proto tcp from any to any port = netbios-ns group 100]
iplioctl(SIOCADDFR,0xe8f4,1) = 0
parse [block in log quick proto udp from any to any port = netbios-ns group 100]
iplioctl(SIOCADDFR,0xe8f4,1) = 0
parse [block in log quick from any to any port = netbios-ssn group 100]
no protocol given for TCP/UDP comparisons
^^^^^^!!!

>Fix:
	
>Audit-Trail:
>Unformatted: