Project

General

Profile

Actions
Copy link

Bug #4383

closed
PD EL

Firewall log contains IGMP for rules that do not have logging on

Bug #4383: Firewall log contains IGMP for rules that do not have logging on

Added by Phillip Davis over 11 years ago. Updated over 11 years ago.

Status:
Resolved
Priority:
High
Assignee:
Ermal Luçi
Category:
Logging
Target version:
2.2.3
Start date:
02/06/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:

Description

CB Updated by Chris Buechler over 11 years ago Actions
Copy link
 #1

  • Status changed from New to Confirmed
  • Target version set to 2.2.2

I suspect the root issue here is logging of passed traffic with IP options regardless of whether logging is enabled on the matching rule.

PD Updated by Phillip Davis over 11 years ago Actions
Copy link
 #2

Target for 2.2.2 looks good. This does not effect actual firewall functions from a security point of view - packet passing and blocking happen as per the rules. It is just nuisance noise in the firewall log with some rule combinations and traffic.

CB Updated by Chris Buechler over 11 years ago Actions
Copy link
 #3

  • Target version changed from 2.2.2 to 2.2.3

BC Updated by Bill Crowder over 11 years ago Actions
Copy link
 #4

I too have ran into this. Very irritating. :)

AL Updated by Arion Lawrence over 11 years ago Actions
Copy link
 #5

Just adding a "me too". I have default rule logging turned off, but still seeing lots of entries in firewall log of "Pass" traffic destined to 224.0.0.22 with Proto IGMP.

EL Updated by Ermal Luçi over 11 years ago Actions
Copy link
 #7

This needs a patching on pf(4) that forces logging on packets with ip options dropped if not allowed and does not check the rule settings.

Line 6332 on pf.c.

CB Updated by Chris Buechler over 11 years ago Actions
Copy link
 #8

  • Assignee set to Ermal Luçi
  • Priority changed from Normal to High

this makes the firewall logs basically completely useless in some networks. Sounds like it shouldn't be too difficult to fix.

EL Updated by Ermal Luçi over 11 years ago Actions
Copy link
 #9

  • Status changed from Confirmed to Feedback

Patched.

PD Updated by Phillip Davis over 11 years ago Actions
Copy link
 #10

2.2.3-DEVELOPMENT (i386)
built on Wed Jun 10 19:49:59 CDT 2015
FreeBSD 10.1-RELEASE-p11

No more flood of unasked-for IGMP messages in the firewall log. I also tried purposely passing and logging IGMP and that shows up correctly in the Firewall log with the correct associated rule number/description.

Fixed for me.

KB Updated by Kill Bill over 11 years ago Actions
Copy link
 #11

Hooray! I finally can see something useful in firewall logs on the previously affected site once again! Sanity restored. :-)

CB Updated by Chris Buechler over 11 years ago Actions
Copy link
 #12

  • Status changed from Feedback to Resolved

fixed

Actions
Copy link

Also available in: Atom