From: bluhm <bluhm@openbsd.org>
Date: Thu, 12 Oct 2023 19:15:21 +0000 (+0000)
Subject: pflog(4) logs packet dropped by default rule with block.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=7b8683a1743e78bdd4f30591dd445c2455b3cf38;p=openbsd

pflog(4) logs packet dropped by default rule with block.

If a packet is malformed, it is dropped by pf(4).  The rule referenced
in pflog(4) is the default rule.  As the default rule is a pass
rule, tcpdump printed "pass" although the packet was actually
dropped.  To avoid confusion, change the action to drop.  Then
tcpdump prints "block".

OK sashan@ kn@
---

diff --git a/sys/net/if_pflog.c b/sys/net/if_pflog.c
index a5bf67ac002..c69333148c0 100644
--- a/sys/net/if_pflog.c
+++ b/sys/net/if_pflog.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_pflog.c,v 1.97 2021/01/20 23:25:19 bluhm Exp $	*/
+/*	$OpenBSD: if_pflog.c,v 1.98 2023/10/12 19:15:21 bluhm Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -204,7 +204,9 @@ pflog_packet(struct pf_pdesc *pd, u_int8_t reason, struct pf_rule *rm,
 
 	bzero(&hdr, sizeof(hdr));
 	hdr.length = PFLOG_REAL_HDRLEN;
-	hdr.action = rm->action;
+	/* Default rule does not pass packets dropped for other reasons. */
+	hdr.action = (rm->nr == (u_int32_t)-1 && reason != PFRES_MATCH) ?
+	    PF_DROP : rm->action;
 	hdr.reason = reason;
 	memcpy(hdr.ifname, pd->kif->pfik_name, sizeof(hdr.ifname));