pf misfeature

[Dag-Erling Smørgrav]

Max Laier <max at love2party.net> writes:
> On Thursday 08 November 2007, Dag-Erling Smørgrav wrote:
> > With "pass on $eth from $lan to $lan", NFS doesn't work.  With "pass on
> > $eth inet proto { tcp, udp } from $lan to $lan", it does.
> thinking about it, this could be a strange interaction with skip
> steps.  Could you provide "pfctl -gvsr" with either rule(s)?  In
> private mail if you prefer.

With (NFS works):

@0 block return quick inet6 all
  [ Skip steps: i=3 d=3 p=2 sa=4 sp=end da=3 dp=3 ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 0         Bytes: 0           States: 0     ]
@1 block return log all
  [ Skip steps: i=3 d=3 sa=4 sp=end da=3 dp=3 ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 0         Bytes: 0           States: 0     ]
@2 pass inet proto icmp all icmp-type echoreq keep state
  [ Skip steps: f=end sa=4 sp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 0         Bytes: 0           States: 0     ]
@3 pass in on sk0 inet proto tcp from any to (sk0:1) port = ssh flags S/SA keep state
  [ Skip steps: i=end f=end p=5 sp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 0         Bytes: 0           States: 0     ]
@4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) flags S/SA keep state
  [ Skip steps: i=end d=6 f=end sa=6 sp=end da=6 dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 61        Packets: 1386      Bytes: 158934      States: 2     ]
@5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) keep state
  [ Skip steps: i=end f=end sp=end dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 267       Bytes: 47931       States: 3     ]
@6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
  [ Skip steps: i=end d=end f=end sa=end sp=end da=end dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 143       Packets: 0         Bytes: 0           States: 0     ]
@7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep state
  [ Skip steps: i=end d=end f=end p=end sa=end sp=end da=end dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 52        Packets: 0         Bytes: 0           States: 0     ]

Without (NFS doesn't work):

@0 block return quick inet6 all
  [ Skip steps: i=3 d=3 p=2 sa=4 sp=end da=3 dp=3 ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 0         Bytes: 0           States: 0     ]
@1 block return log all
  [ Skip steps: i=3 d=3 sa=4 sp=end da=3 dp=3 ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 4         Bytes: 5784        States: 0     ]
@2 pass inet proto icmp all icmp-type echoreq keep state
  [ Skip steps: f=4 sa=4 sp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 0         Bytes: 0           States: 0     ]
@3 pass in on sk0 inet proto tcp from any to (sk0:1) port = ssh flags S/SA keep state
  [ Skip steps: i=end sp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 69        Bytes: 9760        States: 1     ]
@4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep state
  [ Skip steps: i=end f=end p=end sp=end dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 30        Bytes: 3443        States: 13    ]
@5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
  [ Skip steps: i=end d=end f=end p=end sa=end sp=end da=end dp=end ]
  [ queue: qname= qid=0 pqname= pqid=0 ]
  [ Evaluations: 18        Packets: 0         Bytes: 0           States: 0     ]

DES
-- 
Dag-Erling Smørgrav - des at des.no