From nobody@FreeBSD.org  Fri Apr 12 15:30:58 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1])
	by hub.freebsd.org (Postfix) with ESMTP id 9F937B9
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 12 Apr 2013 15:30:58 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id 916E2DFE
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 12 Apr 2013 15:30:58 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.5/8.14.5) with ESMTP id r3CFUuLq078470
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 12 Apr 2013 15:30:56 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.5/8.14.5/Submit) id r3CFUuhR078469;
	Fri, 12 Apr 2013 15:30:56 GMT
	(envelope-from nobody)
Message-Id: <201304121530.r3CFUuhR078469@red.freebsd.org>
Date: Fri, 12 Apr 2013 15:30:56 GMT
From: Kajetan Staszkiewicz <vegeta@tuxpowered.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: traffic dropped by accepting rules is not counted
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         177810
>Category:       kern
>Synopsis:       [pf] traffic dropped by accepting rules is not counted
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-pf
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 12 15:40:00 UTC 2013
>Closed-Date:    
>Last-Modified:  Fri Apr 12 23:57:31 UTC 2013
>Originator:     Kajetan Staszkiewicz
>Release:        9.1-RELEASE
>Organization:
InnoGames GmbH
>Environment:
FreeBSD xxxxxxx 9.1-RELEASE FreeBSD 9.1-RELEASE #10 r247265M: Mon Feb 25 14:58:39 CET 2013     root@xxxxxxx:/usr/obj/usr/src/sys/IGLB3  amd64
>Description:
Currently per-rule counting is performed only for packets that are
accepted by any rule or any packets matched by a droping rule. Counting
on per-interface basis is perfomed properly.

There are some possibilities for a packet do be dropped by an accepting
rule and therefore not counted:

1. SYN/SYN+ACK/ACK packets going through synproxy are dropped with
   PF_SYNPROXY_DROP action. This generates new packets sent to client
   and server that are legitimate traffic and should be counted.

2. Creation of a state or a src-node might fail due to memory or per-
   rule state limits. This traffic is dropped (or at least should be,
   have a look on kern/177808), but still matched some rule. I believe
   it also should be counted, but this is open for discussion.
>How-To-Repeat:
SYN-flood your FreeBSD based machine with synproxy rules or rules with
state limit, observe no increase of counters of `pfctl -sl`
>Fix:
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-pf 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Fri Apr 12 23:56:30 UTC 2013 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=177810 
>Unformatted:
