pfctl 'indicates' states created for 'match' rules or some other stat is being shown?
"S. Donaldson" <[email protected]> Mon, 15 Jan 2018 17:02:21 -0600
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_7AED8FC2-A781-4514-87BD-B0A9F3087EAD
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=us-ascii
The output (somewhat redacted) below is from pfctl (OpenBSD 61, amd64, =
GENERIC.MP kernel).=20
The rules in question deal with NATing and forwarding packets for =
sessions that are very short monitoring 'is this service alive' type =
sessions. So we've tried to limit the number of states, and shorten =
state life to match the type of traffic. =20
Internal traffic (and monitoring host) --> FW_em0 pf --> FW_em1 --> =
monitored systems in DMZ
Curiously the pfctl command shows states for a 'match' rule as per:
pass in quick on em0 inet from 172.a.b.c to <other_dmz_monitoring> flags =
S/SA keep state (max 200, source-track rule, tcp.established 15, =
tcp.closing 3, adaptive.start 120, adaptive.end 240)
[ Evaluations: 10766662 Packets: 327374 Bytes: 19532619 States: =
200 ]
[ Inserted: uid 0 pid 24982 State Creations: 29979 ]
match out on em1 inet from 172.a.b.c to <other_dmz_monitoring> =
received-on em0 tag monother nat-to ext.net.add.xxx
[ Evaluations: 5693609 Packets: 566240 Bytes: 34069203 States: =
347 ]
[ Inserted: uid 0 pid 24982 State Creations: 0 ]
However 'keep state' and per rule session tracking are not allowed on =
match 'actions'.
The above rules are rule 10 and rule 11 in the ruleset. So when I ask to =
see states by rule
pfctl -s state -R 10
shows states as expected
pfctl -s state -R 11
shows nothing=20
So is that State count on a 'match' action actually some other =
statistic?=20
I tried following the grammar in the pf.conf man page and to me it seems =
like the match action is allowed both 'keep state' =20
and I just got confused trying to parse the 'filteropt' definition. See =
below....
Scott Donaldson
Manager of MIS Special Projects
SED Systems a division of Calian Ltd.
Saskatoon, SK
Canada
Office Phone: 306-933-1577
pf-rule =3D action [ ( "in" | "out" ) ]=20
[ "log" [ "(" logopts ")"] ] [ "quick" ]=20
[ "on" ( ifspec | "rdomain" number ) ] [ af ]=20
[ protospec ] [ hosts ] [ filteropts ]=20
action =3D "pass" | "match" | "block" [ return ]=20
filteropts =3D filteropt [ [ "," ] filteropts ]=20
filteropt =3D user | group | flags | icmp-type | icmp6-type |=20
"tos" tos |=20
( "no" | "keep" | "modulate" | "synproxy" ) "state"=20
[ "(" state-opts ")" ] | "scrub" "(" scrubopts ")" |=20
"fragment" | "allow-opts" | "once" |=20
"divert-packet" "port" port | "divert-reply" |=20
"divert-to" host "port" port |=20
"label" string | "tag" string | [ "!" ] "tagged" string =
|=20
"max-pkt-rate" number "/" seconds |=20
"set prio" ( number | "(" number [ [ "," ] number ] ")" =
) |=20
"set queue" ( string | "(" string [ [ "," ] string ] =
")" ) |=20
"rtable" number | "probability" number"%" | "prio" =
number |=20
"af-to" af "from" ( redirhost | "{" redirhost-list "}" =
)=20
[ "to" ( redirhost | "{" redirhost-list "}" ) ] |=20
"binat-to" ( redirhost | "{" redirhost-list "}" )=20
[ portspec ] [ pooltype ] |=20
"rdr-to" ( redirhost | "{" redirhost-list "}" )=20
[ portspec ] [ pooltype ] |=20
"nat-to" ( redirhost | "{" redirhost-list "}" )=20
[ portspec ] [ pooltype ] [ "static-port" ] |=20
[ route ] | [ "set tos" tos ] |=20
[ [ "!" ] "received-on" ( interface-name | =
interface-group ) ]=20
--Apple-Mail=_7AED8FC2-A781-4514-87BD-B0A9F3087EAD
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=us-ascii
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div class=3D"">The output (somewhat redacted) below is from =
pfctl (OpenBSD 61, amd64, GENERIC.MP kernel). </div><div =
class=3D""><br class=3D""></div><div class=3D"">The rules in question =
deal with NATing and forwarding packets for sessions that are very short =
monitoring 'is this service alive' type sessions. So we've tried to =
limit the number of states, and shorten state life to match the type of =
traffic. </div><div class=3D""><br class=3D""></div><div =
class=3D""><br class=3D""></div><div class=3D"">Internal traffic (and =
monitoring host) --> FW_em0 pf --> FW_em1 =
--> monitored systems in DMZ</div><div class=3D""><br =
class=3D""></div><div class=3D""><br class=3D""></div><div =
class=3D"">Curiously the pfctl command shows states for a 'match' rule =
as per:</div><div class=3D""><br class=3D""></div><div class=3D""><br =
class=3D""></div>pass in quick on em0 inet from 172.a.b.c to =
<other_dmz_monitoring> flags S/SA keep state (max 200, =
source-track rule, tcp.established 15, tcp.closing 3, =
adaptive.start 120, adaptive.end 240)<br class=3D""> [ =
Evaluations: 10766662 Packets: 327374 Bytes: 19532619 =
States: 200 ]<br class=3D""> [ Inserted: uid 0 =
pid 24982 State Creations: 29979 ]<br class=3D"">match out on em1 inet =
from 172.a.b.c to <other_dmz_monitoring> received-on em0 tag =
monother nat-to ext.net.add.xxx<br class=3D""> [ Evaluations: =
5693609 Packets: 566240 Bytes: 34069203 =
States: 347 ]<br class=3D""> [ Inserted: uid 0 pid =
24982 State Creations: 0 ]<br class=3D""><br class=3D""><div=
class=3D"">However 'keep state' and per rule session tracking are not =
allowed on match 'actions'.</div><div class=3D""><br class=3D""></div><div=
class=3D"">The above rules are rule 10 and rule 11 in the ruleset. So =
when I ask to see states by rule</div><div class=3D""><br =
class=3D""></div><div class=3D"">pfctl <span style=3D"font-family: =
Monaco; background-color: rgb(140, 253, 248);" class=3D"">-s state -R =
10</span></div><div class=3D""><span style=3D"font-family: Monaco; =
background-color: rgb(140, 253, 248);" class=3D""><br =
class=3D""></span></div><div class=3D"">shows states as =
expected</div><div class=3D""><span style=3D"font-family: Monaco; =
background-color: rgb(140, 253, 248);" class=3D""><br =
class=3D""></span></div><div class=3D""><div style=3D"margin: 0px; =
line-height: normal; font-family: Monaco; background-color: rgb(140, =
253, 248);" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">pfctl -s state -R =
11</span></div></div><div class=3D""><br class=3D""></div><div =
class=3D"">shows nothing </div><div class=3D""><br =
class=3D""></div><div class=3D"">So is that State count on a 'match' =
action actually some other statistic? </div><div class=3D""><br =
class=3D""></div><div class=3D""><br class=3D""></div><div class=3D"">I =
tried following the grammar in the pf.conf man page and to me <font =
face=3D"Monaco" class=3D""><strike class=3D"">it seems like the match =
action is allowed both 'keep state' </strike></font></div><div =
class=3D""><br class=3D""></div><div class=3D"">and I just got confused =
trying to parse the 'filteropt' definition. See below....</div><div =
class=3D""><br class=3D""><div class=3D"">Scott Donaldson<br =
class=3D"">Manager of MIS Special Projects<br class=3D"">SED Systems a =
division of Calian Ltd.<br class=3D"">Saskatoon, SK<br =
class=3D"">Canada<br class=3D""><br class=3D"">Office Phone: =
306-933-1577</div><br class=3D""></div><div class=3D""><br =
class=3D""></div><div class=3D""><br class=3D""></div><div class=3D""><br =
class=3D""></div><div class=3D""><br class=3D""></div><div class=3D""><div=
class=3D"">pf-rule =3D action [ ( "in" | =
"out" ) ] </div><div class=3D""> =
[ "log" [ "(" logopts ")"] ] [ "quick" =
] </div><div class=3D""> =
[ "on" ( ifspec | "rdomain" number ) ] [ af =
] </div><div class=3D""> =
[ protospec ] [ hosts ] [ filteropts =
] </div></div><div class=3D""><br class=3D""></div><div =
class=3D"">action =3D "pass" | "match" | =
"block" [ return ] </div><div class=3D""><br class=3D""></div><div =
class=3D""><div class=3D"">filteropts =3D filteropt [ [ =
"," ] filteropts ] </div><div class=3D"">filteropt =
=3D user | group | flags | icmp-type | icmp6-type =
| </div><div class=3D""> =
"tos" tos | </div><div class=3D""> =
( "no" | "keep" | =
"modulate" | "synproxy" ) "state" </div><div class=3D""> =
[ "(" state-opts =
")" ] | "scrub" "(" scrubopts ")" | </div><div class=3D""> =
"fragment" | =
"allow-opts" | "once" | </div><div class=3D""> =
"divert-packet" "port" port | =
"divert-reply" | </div><div class=3D""> =
"divert-to" host "port" port =
| </div><div class=3D""> =
"label" string | "tag" string | [ "!" ] "tagged" =
string | </div><div class=3D""> =
"max-pkt-rate" number "/" seconds =
| </div><div class=3D""> =
"set prio" ( number | "(" number [ [ "," ] number ] =
")" ) | </div><div class=3D""> =
"set queue" ( string | "(" string [ [ "," ] =
string ] ")" ) | </div><div class=3D""> =
"rtable" number | "probability" =
number"%" | "prio" number | </div><div class=3D""> =
"af-to" af "from" ( =
redirhost | "{" redirhost-list "}" ) </div><div class=3D""> =
[ "to" ( =
redirhost | "{" redirhost-list "}" ) ] | </div><div class=3D""> =
"binat-to" ( =
redirhost | "{" redirhost-list "}" ) </div><div class=3D""> =
[ portspec ] [ =
pooltype ] | </div><div class=3D""> =
"rdr-to" ( redirhost | "{" =
redirhost-list "}" ) </div><div class=3D""> =
[ portspec ] [ pooltype ] =
| </div><div class=3D""> =
"nat-to" ( redirhost | "{" redirhost-list "}" =
) </div><div class=3D""> =
[ portspec ] [ pooltype ] [ "static-port" ] =
| </div><div class=3D""> =
[ route ] | [ "set tos" tos ] | </div><div =
class=3D""> =
[ [ "!" ] "received-on" ( interface-name | interface-group ) =
] </div></div><div class=3D""><br class=3D""></div><div =
class=3D""><br class=3D""></div></body></html>=
--Apple-Mail=_7AED8FC2-A781-4514-87BD-B0A9F3087EAD--