make it clearer where ifgroups can be used

From: Stuart Henderson <stu@spacehopper.org>

1 files changed, 16 insertions, 13 deletions

diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index dc38f5f1a8b..45f4627adb0 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: pf.conf.5,v 1.380 2007/05/31 19:19:58 jmc Exp $
+.\"	$OpenBSD: pf.conf.5,v 1.381 2007/06/08 14:16:37 henning Exp $
 .\"
 .\" Copyright (c) 2002, Daniel Hartmeier
 .\" All rights reserved.
@@ -27,7 +27,7 @@
 .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd $Mdocdate: June 8 2007 $
 .Dt PF.CONF 5
 .Os
 .Sh NAME
@@ -1419,7 +1419,8 @@ This rule applies only to packets with the specified source and destination
 addresses and ports.
 .Pp
 Addresses can be specified in CIDR notation (matching netblocks), as
-symbolic host names or interface names, or as any of the following keywords:
+symbolic host names, interface names or interface group names, or as any
+of the following keywords:
 .Pp
 .Bl -tag -width xxxxxxxxxxxxxx -compact
 .It Ar any
@@ -1441,7 +1442,7 @@ the route back to the packet's source address.
 Any address that matches the given table.
 .El
 .Pp
-Interface names can have modifiers appended:
+Interface names and interface group names can have modifiers appended:
 .Pp
 .Bl -tag -width xxxxxxxxxxxx -compact
 .It Ar :network
@@ -2761,7 +2762,7 @@ option         = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] |
                  [ "state-policy" ( "if-bound" | "floating" ) ]
                  [ "require-order" ( "yes" | "no" ) ]
                  [ "fingerprints" filename ] |
-                 [ "skip on" ( interface-name | "{" interface-list "}" ) ] |
+                 [ "skip on" ifspec ] |
                  [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] )
 
 pf-rule        = action [ ( "in" | "out" ) ]
@@ -2803,8 +2804,7 @@ rdr-rule       = [ "no" ] "rdr" [ "pass" [ "log" [ "(" logopts ")" ] ] ]
                  [ portspec ] [ pooltype ] ]
 
 antispoof-rule = "antispoof" [ "log" ] [ "quick" ]
-                 "for" ( interface-name | "{" interface-list "}" )
-                 [ af ] [ "label" string ]
+                 "for" ifspec [ af ] [ "label" string ]
 
 table-rule     = "table" "\*(Lt" string "\*(Gt" [ tableopts-list ]
 tableopts-list = tableopts-list tableopts | tableopts
@@ -2812,8 +2812,8 @@ tableopts      = "persist" | "const" | "file" string |
                  "{" [ tableaddr-list ] "}"
 tableaddr-list = tableaddr-list [ "," ] tableaddr-spec | tableaddr-spec
 tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ]
-tableaddr      = hostname | ipv4-dotted-quad | ipv6-coloned-hex |
-                 interface-name | "self"
+tableaddr      = hostname | ifspec | "self" |
+                 ipv4-dotted-quad | ipv6-coloned-hex
 
 altq-rule      = "altq on" interface-name queueopts-list
                  "queue" subqueue
@@ -2844,8 +2844,10 @@ return         = "drop" | "return" | "return-rst" [ "( ttl" number ")" ] |
 icmpcode       = ( icmp-code-name | icmp-code-number )
 icmp6code      = ( icmp6-code-name | icmp6-code-number )
 
-ifspec         = ( [ "!" ] interface-name ) | "{" interface-list "}"
-interface-list = [ "!" ] interface-name [ [ "," ] interface-list ]
+ifspec         = ( [ "!" ] ( interface-name | interface-group ) ) |
+                 "{" interface-list "}"
+interface-list = [ "!" ] ( interface-name | interface-group )
+                 [ [ "," ] interface-list ]
 route          = ( "route-to" | "reply-to" | "dup-to" )
                  ( routehost | "{" routehost-list "}" )
                  [ pooltype ]
@@ -2865,8 +2867,9 @@ ipspec         = "any" | host | "{" host-list "}"
 host           = [ "!" ] ( address [ "/" mask-bits ] | "\*(Lt" string "\*(Gt" )
 redirhost      = address [ "/" mask-bits ]
 routehost      = "(" interface-name [ address [ "/" mask-bits ] ] ")"
-address        = ( interface-name | "(" interface-name ")" | hostname |
-                 ipv4-dotted-quad | ipv6-coloned-hex )
+address        = ( interface-name | interface-group |
+                 "(" ( interface-name | interface-group ) ")" |
+                 hostname | ipv4-dotted-quad | ipv6-coloned-hex )
 host-list      = host [ [ "," ] host-list ]
 redirhost-list = redirhost [ [ "," ] redirhost-list ]
 routehost-list = routehost [ [ "," ] routehost-list ]