From owner-freebsd-pf@FreeBSD.ORG  Wed May 14 22:46:47 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 482E01065674
	for <freebsd-pf@freebsd.org>; Wed, 14 May 2008 22:46:47 +0000 (UTC)
	(envelope-from m.pagulayan@auckland.ac.nz)
Received: from mailhost.auckland.ac.nz (curly.its.auckland.ac.nz
	[130.216.12.33])
	by mx1.freebsd.org (Postfix) with ESMTP id DB93A8FC15
	for <freebsd-pf@freebsd.org>; Wed, 14 May 2008 22:46:46 +0000 (UTC)
	(envelope-from m.pagulayan@auckland.ac.nz)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by mailhost.auckland.ac.nz (Postfix) with ESMTP id 4024F9C3D3
	for <freebsd-pf@freebsd.org>; Thu, 15 May 2008 10:46:43 +1200 (NZST)
X-Virus-Scanned: by amavisd-new at mailhost.auckland.ac.nz
Received: from mailhost.auckland.ac.nz ([127.0.0.1])
	by localhost (curly.its.auckland.ac.nz [127.0.0.1]) (amavisd-new,
	port 10024) with ESMTP id ALum8ib7r1qS for <freebsd-pf@freebsd.org>;
	Thu, 15 May 2008 10:46:42 +1200 (NZST)
Received: from UXCHANGE2.UoA.auckland.ac.nz (uxcn2.itss.auckland.ac.nz
	[130.216.190.119])
	by mailhost.auckland.ac.nz (Postfix) with ESMTP id AF0BA9C3B5
	for <freebsd-pf@freebsd.org>; Thu, 15 May 2008 10:46:42 +1200 (NZST)
Received: from UXCHANGE1.UoA.auckland.ac.nz ([130.216.190.118]) by
	UXCHANGE2.UoA.auckland.ac.nz with Microsoft SMTPSVC(6.0.3790.1830); 
	Thu, 15 May 2008 10:45:27 +1200
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Thu, 15 May 2008 10:45:26 +1200
Message-ID: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules
Thread-Index: Aci2FDQaucOI6eAJSEitvE2dxMhsAA==
From: "Mark Pagulayan" <m.pagulayan@auckland.ac.nz>
To: <freebsd-pf@freebsd.org>
X-OriginalArrivalTime: 14 May 2008 22:45:27.0990 (UTC)
	FILETIME=[34B46D60:01C8B614]
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.5
Subject: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 May 2008 22:46:47 -0000

Hi Guys,=20

=20

OS: FreeBSD 7.0-RELEASE=20

=20

Please correct me if I am wrong that PF 4.1 in FreeBSD 7.0 automatically
inserts 'Flags S/SA' to rules?=20

=20

The problem is that when it comes to this rule:=20

=20

pass in quick on $int_if

=20

after loading to pf

=20

pass in quick on em0 flags S/SA keep state

=20

The way I see this is that this rule would be applied to udp traffic as
well which will be dropped/blocked because flags only work for tcp and
this might be the cause of state-mismatches that I see in the table - =20

state-mismatch                  11577272           48.7/s

=20

=20

 How can we prevent pf from loading the flags S/SA in the rules
automatically?

=20

Also what is the effect of this on the block rule?

=20

'block in log on $ext_if all'

'block return out log on $ext_if all'

=20

=20

Cheers,=20

=20

Mark

=20