title: PF packet filter: How do anchors with asterisk work?
body: <p>I'm currently learning the <code>pf</code> packet filter installed on my Macbook (OS X Mountain Lion).</p>
  <p>One thing I cannot get my head around are anchors or, more specifically, a certain feature concerning anchors. You can write anchors in the form of <code>anchor &quot;foo/*&quot;</code>. Note the asterisk at the end of the anchor name. My question is: What does this do?</p>
  <p>This is what the documentation (<a href="http://www.openbsd.org/faq/pf/anchors.html" rel="noreferrer">http://www.openbsd.org/faq/pf/anchors.html</a>) says about this topic:</p>
  <blockquote>
  <p>Since anchors can be nested, it's possible to specify that all child anchors within a specified anchor be evaluated:</p>
  <pre><code>anchor &quot;spam/*&quot;
  </code></pre>
  <p>This syntax causes each rule within each anchor attached to the spam anchor to be evaluated. The child anchors will be evaluated in alphabetical order but are not descended into recursively. Anchors are always evaluated relative to the anchor in which they're defined.</p>
  </blockquote>
  <p>As I read this, it means that this anchor definition is replaced with all sub-anchors of <code>spam</code>, in alphabetical order. So, if <code>spam/foo1</code> and <code>spam/foo2</code> would exist, <code>anchor &quot;spam/*&quot;</code> would be replaced by <code>anchor &quot;spam/foo1&quot;</code> and <code>anchor &quot;spam/foo2&quot;</code>. The other rules inside the <code>spam</code> anchor would be ignored. But looking at the default OS X configuration I must be wrong:</p>
  <pre><code>$ pfctl -sr
  scrub-anchor &quot;com.apple/*&quot; all fragment reassemble
  anchor &quot;com.apple/*&quot; all
  
  $ pfctl -a com.apple -sr
  anchor &quot;100.InternetSharing/*&quot; all
  anchor &quot;200.AirDrop/*&quot; all
  anchor &quot;250.ApplicationFirewall/*&quot; all
  anchor &quot;300.NetworkLinkConditioner/*&quot; all
  </code></pre>
  <p>So, according to my understanding, the output of <code>pfctl -sr</code> could also read:</p>
  <pre><code>$ pfctl -sr
  scrub-anchor &quot;com.apple/*&quot; all fragment reassemble
  anchor &quot;100.InternetSharing/*&quot; all
  anchor &quot;200.AirDrop/*&quot; all
  anchor &quot;250.ApplicationFirewall/*&quot; all
  anchor &quot;300.NetworkLinkConditioner/*&quot; all
  </code></pre>
  <p>But if I now look inside the ApplicationFirewall rules:</p>
  <pre><code>$ pfctl -a com.apple/250.ApplicationFirewall -sr
  block drop in inet proto icmp all icmp-type echoreq
  block drop in inet6 proto ipv6-icmp all icmp6-type echoreq
  </code></pre>
  <p>This anchor contains only filter rules, no sub-anchors. These would not loaded by the asterisk syntax if my interpretation was true. But obviously they are, since I cannot ping my Macbook with this anchor enabled.</p>
  <p>I hope you get what my problem understanding this syntax is. Could anyone explain it to me more clearly? Examples would be helpful.</p>
  <p>Thanks in advance!</p>