Project

General

Profile

Actions

Bug #8554

closed

/etc/rc.kill_states code not correctly parsing pfctl output

Added by Steven Brown almost 6 years ago. Updated about 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Rules / NAT
Target version:
Start date:
06/06/2018
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.x
Affected Architecture:
All

Description

The patches added in Bug #2887 no longer works as expected because the output of pfctl -ss no longer matches the format expected.

The previous output was like:

pppoe0 tcp lan_subnet_ip:port -> pppoe_IP:port -> target_ip:port
lan_if tcp lan_subnet_ip:port <- target_ip:port

Where the new output (from at least pfsense 2.3) looks like:

pppoe0 tcp pppoe_IP:port (lan_subnet_ip:port) -> target_ip:port       ESTABLISHED:ESTABLISHED
lan_if tcp target_ip:port <- lan_subnet_ip:port       ESTABLISHED:ESTABLISHED

I believe this patch fixes the code:

@@ -63,11 +63,11 @@

         $cleared_states = array();
         foreach (explode("\n", $nat_states) as $nat_state) {
-            if (preg_match_all('/([\d\.]+):[\d]+[\s->]+/i', $nat_state, $matches, PREG_SET_ORDER) != 3) {
+            if (preg_match_all('/([\d\.]+):[\d]+[\s->)]+/i', $nat_state, $matches, PREG_SET_ORDER) != 3) {
                 continue;
             }

-            $src = $matches[0][1];
+            $src = $matches[1][1];
             $dst = $matches[2][1];

             if (empty($src) || empty($dst) || in_array("{$src},{$dst}", $cleared_states)) {

Actions

Also available in: Atom PDF