From owner-freebsd-bugs@FreeBSD.ORG Thu Aug 23 14:40:11 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F242316A420 for ; Thu, 23 Aug 2007 14:40:11 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id B5EDF13C494 for ; Thu, 23 Aug 2007 14:40:11 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id l7NEeBw2092762 for ; Thu, 23 Aug 2007 14:40:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id l7NEeBk5092761; Thu, 23 Aug 2007 14:40:11 GMT (envelope-from gnats) Resent-Date: Thu, 23 Aug 2007 14:40:11 GMT Resent-Message-Id: <200708231440.l7NEeBk5092761@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Sergey Matveychuk Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BCC9016A420 for ; Thu, 23 Aug 2007 14:35:17 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id AA47413C458 for ; Thu, 23 Aug 2007 14:35:17 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.1/8.14.1) with ESMTP id l7NEZHKw075157 for ; Thu, 23 Aug 2007 14:35:17 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.1/8.14.1/Submit) id l7NEZHhL075144; Thu, 23 Aug 2007 14:35:17 GMT (envelope-from nobody) Message-Id: <200708231435.l7NEZHhL075144@www.freebsd.org> Date: Thu, 23 Aug 2007 14:35:17 GMT From: Sergey Matveychuk To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/115755: [ipfw][patch] unify message and add a rule number where limit was reached X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2007 14:40:12 -0000 >Number: 115755 >Category: kern >Synopsis: [ipfw][patch] unify message and add a rule number where limit was reached >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Aug 23 14:40:11 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Sergey Matveychuk >Release: 6.2-STABLE >Organization: Yandex >Environment: FreeBSD orange.yandex.net 6.2-STABLE FreeBSD 6.2-STABLE #6: Thu Aug 23 14:14:05 UTC 2007 root@orange.yandex.net:/usr/obj/usr/src/sys/ORANGE i386 >Description: When you have a few rules with a limit you can't see which of them has been reached. Moreover all log entries starts from "ipfw: ", so stick to this form in the limit message. >How-To-Repeat: add a few rules with a limit. when limit will be reached, you'll see in log a line like this: kernel: drop session 111.111.111.111:65373 -> 222.222.222.222:22, too many entries You don't know what rule has been matched. With the patch the line will look like this: kernel: ipfw: 1500 drop session 111.111.111.111:65373 -> 222.222.222.222:22, too many entries >Fix: Patch attached with submission follows: --- sys/netinet/ip_fw2.c.orig Thu Aug 23 13:19:37 2007 +++ sys/netinet/ip_fw2.c Thu Aug 23 14:12:49 2007 @@ -1591,7 +1591,8 @@ inet_ntoa_r(da, dst); } log(LOG_SECURITY | LOG_DEBUG, - "%s %s:%u -> %s:%u, %s\n", + "ipfw: %d %s %s:%u -> %s:%u, %s\n", + parent->rule->rulenum, "drop session", src, (args->f_id.src_port), dst, (args->f_id.dst_port), >Release-Note: >Audit-Trail: >Unformatted: