Date: Fri, 9 Nov 2007 00:59:46 +0100 From: Max Laier <max@love2party.net> To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no> Cc: freebsd-net@freebsd.org, dhartmei@freebsd.org Subject: Re: pf misfeature Message-ID: <200711090059.54990.max@love2party.net> In-Reply-To: <86fxzgl63d.fsf@ds4.des.no> References: <86zlxoblmj.fsf@ds4.des.no> <200711082259.46222.max@love2party.net> <86fxzgl63d.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart2660290.oMDQ0VjJXA
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote:
> Max Laier <max@love2party.net> writes:
> > On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote:
> > > With "pass on $eth from $lan to $lan", NFS doesn't work. With "pass =
on
> > > $eth inet proto { tcp, udp } from $lan to $lan", it does.
> > thinking about it, this could be a strange interaction with skip
> > steps. Could you provide "pfctl -gvsr" with either rule(s)? In
> > private mail if you prefer.
>=20
> With (NFS works):
>=20
> @0 block return quick inet6 all
> [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: =
0 ]
> @1 block return log all
> [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: =
0 ]
> @2 pass inet proto icmp all icmp-type echoreq keep state
> [ Skip steps: f=3Dend sa=3D4 sp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: =
0 ]
> @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S=
/SA keep state
> [ Skip steps: i=3Dend f=3Dend p=3D5 sp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: =
0 ]
> @4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) fla=
gs S/SA keep state
> [ Skip steps: i=3Dend d=3D6 f=3Dend sa=3D6 sp=3Dend da=3D6 dp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 61 Packets: 1386 Bytes: 158934 States: =
2 ]
> @5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) kee=
p state
> [ Skip steps: i=3Dend f=3Dend sp=3Dend dp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 267 Bytes: 47931 States: =
3 ]
> @6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags=
S/SA keep state
> [ Skip steps: i=3Dend d=3Dend f=3Dend sa=3Dend sp=3Dend da=3Dend dp=3De=
nd ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 143 Packets: 0 Bytes: 0 States: =
0 ]
> @7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep =
state
> [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Den=
d dp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 52 Packets: 0 Bytes: 0 States: =
0 ]
>=20
> Without (NFS doesn't work):
>=20
> @0 block return quick inet6 all
> [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: =
0 ]
> @1 block return log all
> [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 4 Bytes: 5784 States: =
0 ]
> @2 pass inet proto icmp all icmp-type echoreq keep state
> [ Skip steps: f=3D4 sa=3D4 sp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: =
0 ]
> @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S=
/SA keep state
> [ Skip steps: i=3Dend sp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 69 Bytes: 9760 States: =
1 ]
> @4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep st=
ate
> [ Skip steps: i=3Dend f=3Dend p=3Dend sp=3Dend dp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 30 Bytes: 3443 States: =
13 ]
> @5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
> [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Den=
d dp=3Dend ]
> [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
> [ Evaluations: 18 Packets: 0 Bytes: 0 States: =
0 ]
No, I don't see why these two should behave differently, but you should
add a "scrub in on sk0" in any case.
Daniel, do you spot anything strange with these skip steps (or otherwise)?
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart2660290.oMDQ0VjJXA
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (FreeBSD)
iD8DBQBHM6L6XyyEoT62BG0RAr0wAJ9a0i3IkHtUln8gRr4rvnUA5R9V6wCfQO7f
85T5XWEDnMK5fbO/eg/2H4A=
=egnl
-----END PGP SIGNATURE-----
--nextPart2660290.oMDQ0VjJXA--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200711090059.54990.max>