Bug #1635
closed
timeout setting on firewall rules does not work for UDP
Added by Adam Gundy over 13 years ago.
Updated almost 4 years ago.
Description
the 'state timeout' firewall rule setting (under 'advanced options') has no effect on UDP connections. that's because it only applies the 'tcp.established' setting to the firewall rule. it should also apply 'udp.multiple'.
the code in question is /etc/inc/filter.inc, line 1959. instead of 'tcp.established NNN' is should add 'tcp.established NNN, udp.multiple NNN'
Now if I configure this option through gui for different types of traffic I get this:
pass in quick on em0 inet from 1.1.1.1 to any flags S/SA keep state (tcp.established 10) label "USER_RULE"
pass in quick on em0 inet proto udp from 1.1.1.1 to any keep state (tcp.established 10) label "USER_RULE"
pass in quick on em0 inet proto tcp from 1.1.1.1 to any flags S/SA keep state (tcp.established 10) label "USER_RULE"
Are we sure that the next would be better (I am not sure about syntax):
pass in quick on em0 inet from 1.1.1.1 to any flags S/SA keep state (tcp.established 10, udp.multiple 10) label "USER_RULE"
pass in quick on em0 inet proto udp from 1.1.1.1 to any keep state (udp.multiple 10) label "USER_RULE"
pass in quick on em0 inet proto tcp from 1.1.1.1 to any flags S/SA keep state (tcp.established 10) label "USER_RULE"
I'd assume that the 'udp' timeout is ignored for non-UDP traffic, in the same way as the 'tcp' timeout is ignored for non-TCP traffic, so it should be safe to simply apply both. no need to get clever in the rule writing code..
- Affected Version changed from 2.0 to 2.5.0
- Status changed from New to Feedback
- Assignee set to Viktor Gurov
- Target version set to 2.5.0
PR has been merged. Thanks!
- % Done changed from 0 to 100
- Assignee changed from Viktor Gurov to Adam Gundy
- Status changed from Feedback to Resolved
works as expected on 2.5.0.a.20210113.0250 -
pfctl successfully loads rules with `udp.multiple` and `other.multiple` options,
timeout works fine, see https://www.freebsd.org/cgi/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=FreeBSD+12.2-RELEASE+and+Ports&arch=default&format=html:
ICMP and UDP are handled in a fashion similar to TCP, but with a
much more limited set of states:
udp.first
The state after the first packet.
udp.single
The state if the source host sends more than one packet but
the destination host has never sent one back.
udp.multiple
The state if both hosts have sent packets.
icmp.first
The state after the first packet.
icmp.error
The state after an ICMP error came back in response to an
ICMP packet.
Other protocols are handled similarly to UDP:
other.first
other.single
other.multiple
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by Viktor Gurov 
Updated by 
Updated by Anonymous