From nobody@FreeBSD.org  Fri Oct  7 15:55:33 2005
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5C16316A41F
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  7 Oct 2005 15:55:33 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2751A43D46
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  7 Oct 2005 15:55:33 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j97FtW49087144
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 7 Oct 2005 15:55:32 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id j97FtW2V087143;
	Fri, 7 Oct 2005 15:55:32 GMT
	(envelope-from nobody)
Message-Id: <200510071555.j97FtW2V087143@www.freebsd.org>
Date: Fri, 7 Oct 2005 15:55:32 GMT
From: Vladimir Kotal <vlada@devnull.cz>
To: freebsd-gnats-submit@FreeBSD.org
Subject: pf does not log dropped packets when max-* stateful tracking options watermark are reached
X-Send-Pr-Version: www-2.3

>Number:         87074
>Category:       kern
>Synopsis:       [pf] pf does not log dropped packets when max-* stateful tracking options watermark are reached
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-pf
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Oct 07 16:00:30 GMT 2005
>Closed-Date:    
>Last-Modified:  Wed Jul 03 01:33:15 UTC 2013
>Originator:     Vladimir Kotal
>Release:        5.4-RELEASE-p7
>Organization:
>Environment:
Oct  4 16:35:12 CEST 2005 lada@ipfw2.XXX:/usr/home/lada/FreeBSD-src/FreeBSD-5-pfmaxst/src/sys/i386/compile/PFMAXST i386
>Description:
      pf does not log events when it drops packets because max-* stateful options were reached. In some enviroments it is desirable that administrators are informed about all state overflows per particular rule.
>How-To-Repeat:
1. compile FreeBSD 5.x system with pf module
2. load pf module
3. set ruleset containing stateful rules such as

pass out quick on fxp0 proto tcp from any to any port = 53 \
        flags S/S \
        keep state \
        ( max-src-states 2, max 6, max-src-nodes 4 )

4. generate traffic so that one of the stateful options causes packet drops
5. observe pf-related logs


Expected behavior:
packet drops caused by stateful options should be logged somehow.
>Fix:
more than one fix is possible:

1. add special logging terminal to pf grammar definition (per stateful option) which would log packets dropped because of this particular option to pflog
  - too much changes
2. log via kernel printf for misc pf debug level. This can be accomplished by following patch:
  http://techie.devnull.cz/public/patches/pf.c-logmax.patch
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->mlaier 
Responsible-Changed-By: glebius 
Responsible-Changed-When: Sun Oct 23 09:20:59 GMT 2005 
Responsible-Changed-Why:  
To pf maintainer. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=87074 
State-Changed-From-To: open->open 
State-Changed-By: linimon 
State-Changed-When: Wed Jul 3 00:50:32 UTC 2013 
State-Changed-Why:  
commit bit has been taken in for safekeeping. 


Responsible-Changed-From-To: mlaier->freebsd-pf 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Jul 3 00:50:32 UTC 2013 
Responsible-Changed-Why:  

http://www.freebsd.org/cgi/query-pr.cgi?pr=87074 
>Unformatted:
