diff options
| author | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2023-10-12 19:15:22 +0000 |
|---|---|---|
| committer | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2023-10-12 19:15:22 +0000 |
| commit | 6d8a4d406786b960d71a4930d3e98119f2187df7 (patch) | |
| tree | 5707b18b83afa711819614bc2a6be44b3235bacf /sys/net | |
| parent | cf57414cdd3adc160c4f4e8e4d26a2f702bbf10d (diff) | |
pflog(4) logs packet dropped by default rule with block.
If a packet is malformed, it is dropped by pf(4). The rule referenced
in pflog(4) is the default rule. As the default rule is a pass
rule, tcpdump printed "pass" although the packet was actually
dropped. To avoid confusion, change the action to drop. Then
tcpdump prints "block".
OK sashan@ kn@
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/if_pflog.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/net/if_pflog.c b/sys/net/if_pflog.c index a5bf67ac002..c69333148c0 100644 --- a/sys/net/if_pflog.c +++ b/sys/net/if_pflog.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_pflog.c,v 1.97 2021/01/20 23:25:19 bluhm Exp $ */ +/* $OpenBSD: if_pflog.c,v 1.98 2023/10/12 19:15:21 bluhm Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr) and @@ -204,7 +204,9 @@ pflog_packet(struct pf_pdesc *pd, u_int8_t reason, struct pf_rule *rm, bzero(&hdr, sizeof(hdr)); hdr.length = PFLOG_REAL_HDRLEN; - hdr.action = rm->action; + /* Default rule does not pass packets dropped for other reasons. */ + hdr.action = (rm->nr == (u_int32_t)-1 && reason != PFRES_MATCH) ? + PF_DROP : rm->action; hdr.reason = reason; memcpy(hdr.ifname, pd->kif->pfik_name, sizeof(hdr.ifname)); |