11622 clean up rarer mandoc lint warnings

*** 1,30 ****
  '\" te
  .\" To view license terms, attribution, and copyright for IP Filter, the
! .\" default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Illumos operating
  .\" environment has been installed anywhere other than the default, modify the
  .\" given path to access the file at the installed location.
  .\" Portions Copyright (c) 2015, Joyent, Inc.
  .TH IPF 4 "Mar 18, 2015"
  .SH NAME
  ipf, ipf.conf, ipf6.conf \- IP packet filter rule syntax
  .SH DESCRIPTION
- .PP
  A rule file for \fBipf\fP may have any name or even be stdin.  As
  \fBipfstat\fP produces parsable rules as output when displaying the internal
  kernel filter lists, it is quite plausible to use its output to feed back
  into \fBipf\fP.  Thus, to remove all filters on input packets, the following
  could be done:
  .nf
  
! \fC# ipfstat \-i | ipf \-rf \-\fP
  .fi
  .SH GRAMMAR
- .PP
  The format used by \fBipf\fP for construction of filtering rules can be
  described using the following grammar in BNF:
- \fC
  .nf
  filter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ]
                [ proto ] ip [ group ].
  
  insert  = "@" decnumber .
--- 1,27 ----
  '\" te
  .\" To view license terms, attribution, and copyright for IP Filter, the
! .\" default path is /usr/lib/ipf/IPFILTER.LICENCE. If the illumos operating
  .\" environment has been installed anywhere other than the default, modify the
  .\" given path to access the file at the installed location.
  .\" Portions Copyright (c) 2015, Joyent, Inc.
  .TH IPF 4 "Mar 18, 2015"
  .SH NAME
  ipf, ipf.conf, ipf6.conf \- IP packet filter rule syntax
  .SH DESCRIPTION
  A rule file for \fBipf\fP may have any name or even be stdin.  As
  \fBipfstat\fP produces parsable rules as output when displaying the internal
  kernel filter lists, it is quite plausible to use its output to feed back
  into \fBipf\fP.  Thus, to remove all filters on input packets, the following
  could be done:
  .nf
  
! # ipfstat \-i | ipf \-rf \-\fP
  .fi
  .SH GRAMMAR
  The format used by \fBipf\fP for construction of filtering rules can be
  described using the following grammar in BNF:
  .nf
  filter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ]
                [ proto ] ip [ group ].
  
  insert  = "@" decnumber .
*** 113,123 ****
  .PP
  This syntax is somewhat simplified for readability, some combinations
  that match this grammar are disallowed by the software because they do
  not make sense (such as tcp \fBflags\fP for non-TCP packets).
  .SH FILTER RULES
- .PP
  The "briefest" valid rules are (currently) no-ops and are of the form:
  .nf
         block in all
         pass in all
         log out all
--- 110,119 ----
*** 132,142 ****
  lists, prepending the rule with \fB@n\fP will cause it to be inserted
  as the n'th entry in the current list. This is especially useful when
  modifying and testing active filter rulesets. See \fBipf\fP(1M) for more
  information.
  .SH ACTIONS
- .PP
  The action indicates what to do with the packet if it matches the rest
  of the filter rule. Each rule MUST have an action. The following
  actions are recognised:
  .TP
  .B block
--- 128,137 ----
*** 208,218 ****
  interface, and moving towards the kernel's protocol processing) or
  outbound (transmitted or forwarded by the stack, and on its way to an
  interface). There is a requirement that each filter rule explicitly
  state which side of the I/O it is to be used on.
  .SH OPTIONS
- .PP
  The list of options is brief, and all are indeed optional. Where
  options are used, they must be present in the order shown here. These
  are the currently supported options:
  .TP
  .B log
--- 203,212 ----
*** 267,277 ****
  packet (if applied to an inbound rule). It is thus possible to
  construct a firewall that behaves transparently, like a filtering hub
  or switch, rather than a router. The \fBfastroute\fP keyword is a
  synonym for this option.
  .SH MATCHING PARAMETERS
- .PP
  The keywords described in this section are used to describe attributes
  of the packet to be used when determining whether rules match or don't
  match. The following general-purpose attributes are provided for
  matching, and must be used in this order:
  .TP
--- 261,270 ----
*** 411,421 ****
  in conjunction with \fBflags\fP.  There are a number of types, which can be
  referred to by an abbreviation recognised by this language, or the numbers
  with which they are associated can be used.  The most important from
  a security point of view is the ICMP redirect.
  .SH KEEP HISTORY
- .PP
  The second last parameter which can be set for a filter rule is whether or not
  to record historical information for that packet, and what sort to keep. The
  following information can be kept:
  .TP
  .B state
--- 404,413 ----
*** 444,454 ****
  indicates that a new group (number n) should be created.
  .TP
  .B "group <n>"
  indicates that the rule should be put in group (number n) rather than group 0.
  .SH LOGGING
- .PP
  When a packet is logged, with either the \fBlog\fP action or option,
  the headers of the packet are written to the \fBipl\fP packet logging
  pseudo-device. Immediately following the \fBlog\fP keyword, the
  following qualifiers may be used (in order):
  .TP
--- 436,445 ----
*** 473,485 ****
  .PP
  See ipl(4) for the format of records written
  to this device. The ipmon(1M) program can be used to read and format
  this log.
  .SH EXAMPLES
- .PP
  The \fBquick\fP option is good for rules such as:
- \fC
  .nf
  block in quick from any to any with ipopts
  .fi
  .PP
  which will match any packet with a non-standard header length (IP
--- 464,474 ----
*** 521,531 ****
         block in quick on le0 all head 100
         block in quick on le1 all head 200
         block in quick on lo0 all head 300
  .fi
  .PP
- 
  and to then allow ICMP packets in on le0, only, we would do:
  .LP
  .nf
         pass in proto icmp all group 100
  .fi
--- 510,519 ----