Bug #8445


creating an alias named "log" breaks rule processing

Added by lists b over 6 years ago. Updated about 6 years ago.

Rules / NAT
Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
Affected Architecture:


i created an ip alias, and named it "log". upon the rules reloading, an error occurred:

There were error(s) loading the rules: /tmp/rules.debug:45: syntax error - The line in question reads [45]: table <log> persist

here is some context from rules.debug:

44: irc_server = "<irc_server>"
45: ircs_u = "{ 6697 }"
46: table <log> persist
47: log = "<log>"
48: managesieve = "{ 4190 }"
49: table <mda> persist
50: mda = "<mda>"

it's pretty clear why it broke. although i would like to be able to use whatever string i'd like for the name of an alias, if this constraint persists, it would probably be wise to disallow the user from using this string.

Actions #1

Updated by Jim Pingle over 6 years ago

  • Category set to Rules / NAT
  • Status changed from New to Confirmed
  • Assignee set to Jim Pingle
  • Target version set to 2.4.4
  • Affected Version set to 2.4.3
  • Affected Architecture All added
  • Affected Architecture deleted ()

It's a reserved keyword in pf but isn't in the list.

Actions #2

Updated by Jim Pingle over 6 years ago

The list of pf keywords was a lot shorter than it should be, but there isn't a documented list that I could see.

I found a more complete token list in the pfctl source:

I tried a few random keywords from the list and they all generated similar pf errors, so it should be a better starting point.

As for using these names in aliases, pf is case sensitive. If you want to call an alias "log", too bad, but you can call it "Log" or "LOG" and be fine. Or prefix with another valid character such as "_" for "_log" if you must have lowercase.

Actions #3

Updated by Jim Pingle over 6 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
Actions #4

Updated by Anonymous over 6 years ago

Tested on latest 2.4.4 CE snapshot gitsync'd to master, works as expected.

Actions #5

Updated by Jim Pingle over 6 years ago

  • Status changed from Feedback to Resolved
Actions #6

Updated by Jim Pingle about 6 years ago

  • Target version changed from 2.4.4 to 2.4.3-p1

Also available in: Atom PDF