Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 16 Jul 2010 17:22:04 +0000
From:      Mario Lobo <mlobo@digiart.art.br>
To:        "freebsd-questions" <freebsd-questions@freebsd.org>
Subject:   pf behavior question
Message-ID:  <201007161722.04902.mlobo@digiart.art.br>

next in thread | raw e-mail | index | archive | help
Hi;

System: 8.1-PRERELEASE FreeBSD 8.1-PRERELEASE #1: Fri Jun 11 09:41:37 BRT 2010 
i386

The question is about how pf acts on an specific situation.

Supose I have the following rules:


pass in log inet proto tcp from $int_if to any port 8021  
flags S/SA keep state tag test

rule 2 ....
rule 3 .....
.
rule n ....

pass in log quick on $int_if inet proto tcp tagged test keep state queue (ftp)


Suppose the packet matches the first rule.

According to what I red about pf, it will keep parsing the rules (no "quick" 
on the first rule). When it reaches the last rule, the tag will match and the 
packet will pass.

I don't believe I'll have 2 state table entries for the same packet after the 
last rule matches. or will I? 

What is the proper way to use the tag created on the first rule, as far as the   
state table is concerned?


Thanks,

-- 
Mario Lobo
http://www.mallavoodoo.com.br
FreeBSD since 2.2.8 [not Pro-Audio.... YET!!] (99% winfoes FREE)



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201007161722.04902.mlobo>