Date: Fri, 7 Oct 2005 15:55:32 GMT From: Vladimir Kotal <vlada@devnull.cz> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/87074: pf does not log dropped packets when max-* stateful tracking options watermark are reached Message-ID: <200510071555.j97FtW2V087143@www.freebsd.org> Resent-Message-ID: <200510071600.j97G0Ugk082760@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 87074
>Category: kern
>Synopsis: pf does not log dropped packets when max-* stateful tracking options watermark are reached
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri Oct 07 16:00:30 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Vladimir Kotal
>Release: 5.4-RELEASE-p7
>Organization:
>Environment:
Oct 4 16:35:12 CEST 2005 lada@ipfw2.XXX:/usr/home/lada/FreeBSD-src/FreeBSD-5-pfmaxst/src/sys/i386/compile/PFMAXST i386
>Description:
pf does not log events when it drops packets because max-* stateful options were reached. In some enviroments it is desirable that administrators are informed about all state overflows per particular rule.
>How-To-Repeat:
1. compile FreeBSD 5.x system with pf module
2. load pf module
3. set ruleset containing stateful rules such as
pass out quick on fxp0 proto tcp from any to any port = 53 \
flags S/S \
keep state \
( max-src-states 2, max 6, max-src-nodes 4 )
4. generate traffic so that one of the stateful options causes packet drops
5. observe pf-related logs
Expected behavior:
packet drops caused by stateful options should be logged somehow.
>Fix:
more than one fix is possible:
1. add special logging terminal to pf grammar definition (per stateful option) which would log packets dropped because of this particular option to pflog
- too much changes
2. log via kernel printf for misc pf debug level. This can be accomplished by following patch:
http://techie.devnull.cz/public/patches/pf.c-logmax.patch
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510071555.j97FtW2V087143>