Rule ordering changes

2013-03-11 Thread Andrew Siegel

I've been scratching my head over this one.  Here is my pf.conf:

int_if = em0
dmz_if = em1
block log all
set skip on lo0
block log quick inet6
block in  log quick on $int_if from ! rfc1918 to any
block out log quick on $int_if from any to ! rfc1918
pass  out log on $int_if inet proto tcp from $int_if:0 to 10.1.1.1 port ldap
pass  in  log on $dmz_if inet proto tcp from $dmz_if:network to $dmz_if:0 port 
ldap
pass  in  log on $dmz_if inet proto icmp from $dmz_if:network  to $dmz_if:0
pass  out log on $dmz_if inet proto icmp from $dmz_if:0 to $dmz_if:network
pass  in  log on $int_if inet proto icmp from rfc1918 to $int_if:0
pass  out log on $int_if inet proto icmp from $int_if:0 to rfc1918
pass  in  log on $int_if inet proto icmp from rfc1918 to $dmz_if:network
pass  out log on $dmz_if inet proto icmp from rfc1918 to $dmz_if:network
pass  in  log on $dmz_if inet proto udp from $dmz_if:network to $dmz_if:0 port 
ntp
pass  in  log on $int_if inet proto tcp from rfc1918 to { $int_if:0 
$dmz_if:network } port ssh
pass  out log on $dmz_if inet proto tcp from rfc1918 to $dmz_if:network port 
ssh
pass  out log on $dmz_if inet proto tcp from $int_if:0 to $dmz_if:network port 
ssh
pass  out log on $int_if inet proto udp from $int_if:0 to dns port domain
pass  out log on $int_if inet proto udp from $int_if:0 to ntp port ntp


The problem is that some rules end up out of order in the pfctl -s rules 
output (note the icmp rules in particular):

0   block drop log all
1   block drop in log quick on em0 from ! rfc1918 to any
2   block drop out log quick on em0 from any to ! rfc1918
3   block drop log quick inet6 all
4   pass in log on em0 inet proto icmp from rfc1918 to 192.168.7.2
5   pass in log on em0 inet proto icmp from rfc1918 to 192.168.8.0/24
6   pass in log on em0 inet proto tcp from rfc1918 to 192.168.7.2 port = 
22 flags S/SA
7   pass in log on em0 inet proto tcp from rfc1918 to 192.168.8.0/24 port 
= 22 flags S/SA
8   pass out log on em0 inet proto udp from 192.168.7.2 to dns port = 53
9   pass out log on em0 inet proto udp from 192.168.7.2 to ntp port = 123
   10   pass out log on em0 inet proto tcp from 192.168.7.2 to 10.1.1.1 port = 
389 flags S/SA
   11   pass out log on em0 inet proto icmp from 192.168.7.2 to rfc1918
   12   pass out log on em1 inet proto icmp from 192.168.8.1 to 192.168.8.0/24
   13   pass out log on em1 inet proto icmp from rfc1918 to 192.168.8.0/24
   14   pass out log on em1 inet proto tcp from rfc1918 to 192.168.8.0/24 
port = 22 flags S/SA
   15   pass out log on em1 inet proto tcp from 192.168.7.2 to 192.168.8.0/24 
port = 22 flags S/SA
   16   pass in log on em1 inet proto tcp from 192.168.8.0/24 to 192.168.8.1 
port = 389 flags S/SA
   17   pass in log on em1 inet proto icmp from 192.168.8.0/24 to 192.168.8.1
   18   pass in log on em1 inet proto udp from 192.168.8.0/24 to 192.168.8.1 
port = 123

This is under OpenBSD 5.1.  Am I misunderstanding something?  Is some kind of 
optimization taking place behind the scenes?

Andy


Re: Rule ordering changes

2013-03-11 Thread Andrew Siegel

On 3/11/13 3:45 PM, Stuart Henderson wrote:

On 2013/03/11 12:06, Andrew Siegel wrote:

..

I've been scratching my head over this one.  Here is my pf.conf:



This is under OpenBSD 5.1.  Am I misunderstanding something?  Is some kind of 
optimization taking place behind the scenes?

Andy



Thank you, Stuart and Hrvoje.


Re: Rule ordering changes

2013-03-11 Thread Stuart Henderson
On 2013/03/11 12:06, Andrew Siegel wrote:
 I've been scratching my head over this one.  Here is my pf.conf:
 
 int_if = em0
 dmz_if = em1
 block log all
 set skip on lo0
 block log quick inet6
 block in  log quick on $int_if from ! rfc1918 to any
 block out log quick on $int_if from any to ! rfc1918
 pass  out log on $int_if inet proto tcp from $int_if:0 to 10.1.1.1 port ldap
 pass  in  log on $dmz_if inet proto tcp from $dmz_if:network to $dmz_if:0 
 port ldap
 pass  in  log on $dmz_if inet proto icmp from $dmz_if:network  to $dmz_if:0
 pass  out log on $dmz_if inet proto icmp from $dmz_if:0 to $dmz_if:network
 pass  in  log on $int_if inet proto icmp from rfc1918 to $int_if:0
 pass  out log on $int_if inet proto icmp from $int_if:0 to rfc1918
 pass  in  log on $int_if inet proto icmp from rfc1918 to $dmz_if:network
 pass  out log on $dmz_if inet proto icmp from rfc1918 to $dmz_if:network
 pass  in  log on $dmz_if inet proto udp from $dmz_if:network to $dmz_if:0 
 port ntp
 pass  in  log on $int_if inet proto tcp from rfc1918 to { $int_if:0 
 $dmz_if:network } port ssh
 pass  out log on $dmz_if inet proto tcp from rfc1918 to $dmz_if:network 
 port ssh
 pass  out log on $dmz_if inet proto tcp from $int_if:0 to $dmz_if:network 
 port ssh
 pass  out log on $int_if inet proto udp from $int_if:0 to dns port domain
 pass  out log on $int_if inet proto udp from $int_if:0 to ntp port ntp
 
 
 The problem is that some rules end up out of order in the pfctl -s rules 
 output (note the icmp rules in particular):
 
 0   block drop log all
 1   block drop in log quick on em0 from ! rfc1918 to any
 2   block drop out log quick on em0 from any to ! rfc1918
 3   block drop log quick inet6 all
 4   pass in log on em0 inet proto icmp from rfc1918 to 192.168.7.2
 5   pass in log on em0 inet proto icmp from rfc1918 to 192.168.8.0/24
 6   pass in log on em0 inet proto tcp from rfc1918 to 192.168.7.2 port 
 = 22 flags S/SA
 7   pass in log on em0 inet proto tcp from rfc1918 to 192.168.8.0/24 
 port = 22 flags S/SA
 8   pass out log on em0 inet proto udp from 192.168.7.2 to dns port = 53
 9   pass out log on em0 inet proto udp from 192.168.7.2 to ntp port = 
 123
10   pass out log on em0 inet proto tcp from 192.168.7.2 to 10.1.1.1 port 
 = 389 flags S/SA
11   pass out log on em0 inet proto icmp from 192.168.7.2 to rfc1918
12   pass out log on em1 inet proto icmp from 192.168.8.1 to 192.168.8.0/24
13   pass out log on em1 inet proto icmp from rfc1918 to 192.168.8.0/24
14   pass out log on em1 inet proto tcp from rfc1918 to 192.168.8.0/24 
 port = 22 flags S/SA
15   pass out log on em1 inet proto tcp from 192.168.7.2 to 192.168.8.0/24 
 port = 22 flags S/SA
16   pass in log on em1 inet proto tcp from 192.168.8.0/24 to 192.168.8.1 
 port = 389 flags S/SA
17   pass in log on em1 inet proto icmp from 192.168.8.0/24 to 192.168.8.1
18   pass in log on em1 inet proto udp from 192.168.8.0/24 to 192.168.8.1 
 port = 123
 
 This is under OpenBSD 5.1.  Am I misunderstanding something?  Is some kind of 
 optimization taking place behind the scenes?
 
 Andy

Yes. From man pfctl:

 -o level
 Control the ruleset optimizer, overriding any rule file settings.

 -o none   Disable the ruleset optimizer.
 -o basic  Enable basic ruleset optimizations.  This is the
   default behaviour.
 -o profileEnable basic ruleset optimizations with profiling.
 For further information on the ruleset optimizer, see pf.conf(5).