Project

General

Profile

Actions
Copy link

Bug #3921

closed
SS EL

max-packets option missing from pfctl

Bug #3921: max-packets option missing from pfctl

Added by Steven Selph almost 12 years ago. Updated almost 12 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Ermal Luçi
Category:
Rules / NAT
Target version:
2.2
Start date:
10/09/2014
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:

Description

using "divert port (max-packets 8)"

This causes pf to throw a syntax error since divert and max-packets don't appear to be valid in this version of pf.

Files

config.xml (26.2 KB) config.xml Steven Selph, 10/09/2014 05:08 PM

SS Updated by Steven Selph almost 12 years ago Actions
Copy link
 #1

Sorry copy and paste issues meant to say

Rules are generated using "divert port (max-packets 8)"

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #2

Could you share your config.xml sanitized?

SS Updated by Steven Selph almost 12 years ago Actions
Copy link
 #3

Attached my config.xml. The l7 portion results in the following /tmp/rules.debug line:
pass in log quick on $GUEST inet proto { tcp udp } from 192.168.2.1/24 to any divert 45164 tracker 1412311190 keep state ( max-packets 8 ) label "USER_RULE"

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #4

  • Subject changed from Layer 7 (L7) rules have syntax errors to max-packets option missing from pfctl
  • Assignee set to Renato Botelho
  • Target version set to 2.2

max-packets option is missing from pfctl parser. I'm working on a fix

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #5

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:1f237bb460b8ae7a8803adfb3a8b21b485131ab4.

SS Updated by Steven Selph almost 12 years ago Actions
Copy link
 #6

This change seems to only address half the issue. The max-packets option still seems to be missing or is that something that isn't done in the pfsense source? If so I can test it when the next snapshot is built.

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #7

Steven Selph wrote:

This change seems to only address half the issue. The max-packets option still seems to be missing or is that something that isn't done in the pfsense source? If so I can test it when the next snapshot is built.

I already added max-packets to the parser, please try new snapshots that are already available.

SS Updated by Steven Selph almost 12 years ago Actions
Copy link
 #8

This seems to have corrected the syntax issues. There appears to be some performance issues now. I understand some performance hit is to be expected but this pegs my 1GHz CPU to 100% with a single machine loading web pages or requesting DNS. I also noticed that the rules created from the rules.debug don't have the max-packets in them which might explain it.
@92(1412311190) pass in log quick on em2 inet proto tcp from 192.168.2.0/24 to any flags S/SA keep state label "USER_RULE" divert-to 45164
@93(1412311190) pass in log quick on em2 inet proto udp from 192.168.2.0/24 to any keep state label "USER_RULE" divert-to 45164

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #9

  • Status changed from Feedback to New

RB Updated by Renato Botelho almost 12 years ago Actions
Copy link
 #10

  • Assignee changed from Renato Botelho to Ermal Luçi

@ermal, Are you aware of these performance issues?

EL Updated by Ermal Luçi almost 12 years ago Actions
Copy link
 #11

  • Status changed from New to Feedback

Its expected and resolving this is not in plan for 2.2.

Also that is not what this ticket is about.

CB Updated by Chris Buechler almost 12 years ago Actions
Copy link
 #12

  • Status changed from Feedback to Resolved

issue here is resolved

Actions
Copy link

Also available in: Atom