pf misfeature
Max Laier
max at love2party.net
Thu Nov 8 16:00:16 PST 2007
On Thursday 08 November 2007, Dag-Erling Smørgrav wrote:
> Max Laier <max at love2party.net> writes:
> > On Thursday 08 November 2007, Dag-Erling Smørgrav wrote:
> > > With "pass on $eth from $lan to $lan", NFS doesn't work. With "pass on
> > > $eth inet proto { tcp, udp } from $lan to $lan", it does.
> > thinking about it, this could be a strange interaction with skip
> > steps. Could you provide "pfctl -gvsr" with either rule(s)? In
> > private mail if you prefer.
>
> With (NFS works):
>
> @0 block return quick inet6 all
> [ Skip steps: i=3 d=3 p=2 sa=4 sp=end da=3 dp=3 ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 ]
> @1 block return log all
> [ Skip steps: i=3 d=3 sa=4 sp=end da=3 dp=3 ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 ]
> @2 pass inet proto icmp all icmp-type echoreq keep state
> [ Skip steps: f=end sa=4 sp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 ]
> @3 pass in on sk0 inet proto tcp from any to (sk0:1) port = ssh flags S/SA keep state
> [ Skip steps: i=end f=end p=5 sp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 ]
> @4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) flags S/SA keep state
> [ Skip steps: i=end d=6 f=end sa=6 sp=end da=6 dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 61 Packets: 1386 Bytes: 158934 States: 2 ]
> @5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) keep state
> [ Skip steps: i=end f=end sp=end dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 267 Bytes: 47931 States: 3 ]
> @6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
> [ Skip steps: i=end d=end f=end sa=end sp=end da=end dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 ]
> @7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep state
> [ Skip steps: i=end d=end f=end p=end sa=end sp=end da=end dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 52 Packets: 0 Bytes: 0 States: 0 ]
>
> Without (NFS doesn't work):
>
> @0 block return quick inet6 all
> [ Skip steps: i=3 d=3 p=2 sa=4 sp=end da=3 dp=3 ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
> @1 block return log all
> [ Skip steps: i=3 d=3 sa=4 sp=end da=3 dp=3 ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 4 Bytes: 5784 States: 0 ]
> @2 pass inet proto icmp all icmp-type echoreq keep state
> [ Skip steps: f=4 sa=4 sp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
> @3 pass in on sk0 inet proto tcp from any to (sk0:1) port = ssh flags S/SA keep state
> [ Skip steps: i=end sp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 69 Bytes: 9760 States: 1 ]
> @4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep state
> [ Skip steps: i=end f=end p=end sp=end dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 30 Bytes: 3443 States: 13 ]
> @5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
> [ Skip steps: i=end d=end f=end p=end sa=end sp=end da=end dp=end ]
> [ queue: qname= qid=0 pqname= pqid=0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
No, I don't see why these two should behave differently, but you should
add a "scrub in on sk0" in any case.
Daniel, do you spot anything strange with these skip steps (or otherwise)?
--
/"\ Best regards, | mlaier at freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier at EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part.
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20071109/f2f97af5/attachment.pgp
More information about the freebsd-net
mailing list