Debian Bug report logs - #566773
kfreebsd-image-7.2-1-486: pf ignores any and all rules

version graph

Package: kfreebsd-image-7.2-1-486; Maintainer for kfreebsd-image-7.2-1-486 is (unknown);

Reported by: will@worrbase.com

Date: Mon, 25 Jan 2010 01:57:01 UTC

Severity: grave

Tags: unreproducible

Found in version kfreebsd-7/7.2-11

Done: Aurelien Jarno <aurelien@aurel32.net>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>:
Bug#566773; Package kfreebsd-image-7.2-1-486. (Mon, 25 Jan 2010 01:57:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to will@worrbase.com:
New Bug report received and forwarded. Copy sent to GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>. (Mon, 25 Jan 2010 01:57:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: will@worrbase.com
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: kfreebsd-image-7.2-1-486: pf ignores any and all rules
Date: Sun, 24 Jan 2010 15:46:07 -0500
Package: kfreebsd-image-7.2-1-486
Version: 7.2-11
Severity: grave
Justification: renders package unusable

pf ignores any and all rules configured in /etc/pf.conf, even after being 
told to reload the ruleset with pfctl -f /etc/pf.conf.

I've tested this by blocking all traffic with the pf rule:
block all
and sshing in and out of the system, as well as running iperf.

I've tested this by explicitly blocking ssh traffic
block in quick on em0 inet proto tcp from any to any port 22
and sshing in

I've tested this by explicitly blocking iperf traffic (tcp port 5001 by default)
block out quick on em0 inet proto tcp from any to any port 5001
and running iperf as a client on this system

The pf module is loaded, and I did in fact reload the rules with pfctl -f /etc/pf.con
prior to each test. I even did a pfctl -s rules and the running config aligned
with the rules I set each time.

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: kfreebsd-i386 (i686)

Kernel: kFreeBSD 7.2-1-486
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages kfreebsd-image-7.2-1-486 depends on:
ii  freebsd-utils                 8.0-6      FreeBSD utilities needed for GNU/k
ii  kldutils                      8.0-6      tools for managing kFreeBSD module

kfreebsd-image-7.2-1-486 recommends no packages.

kfreebsd-image-7.2-1-486 suggests no packages.

-- no debconf information




Information forwarded to debian-bugs-dist@lists.debian.org, GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>:
Bug#566773; Package kfreebsd-image-7.2-1-486. (Mon, 25 Jan 2010 12:15:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Aurelien Jarno <aurelien@aurel32.net>:
Extra info received and forwarded to list. Copy sent to GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>. (Mon, 25 Jan 2010 12:15:03 GMT) Full text and rfc822 format available.

Message #10 received at submit@bugs.debian.org (full text, mbox):

From: Aurelien Jarno <aurelien@aurel32.net>
To: will@worrbase.com, 566773@bugs.debian.org
Cc: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Re: Bug#566773: kfreebsd-image-7.2-1-486: pf ignores any and all rules
Date: Mon, 25 Jan 2010 13:12:37 +0100
will@worrbase.com a écrit :
> Package: kfreebsd-image-7.2-1-486
> Version: 7.2-11
> Severity: grave
> Justification: renders package unusable
> 
> pf ignores any and all rules configured in /etc/pf.conf, even after being 
> told to reload the ruleset with pfctl -f /etc/pf.conf.
> 
> I've tested this by blocking all traffic with the pf rule:
> block all
> and sshing in and out of the system, as well as running iperf.
> 
> I've tested this by explicitly blocking ssh traffic
> block in quick on em0 inet proto tcp from any to any port 22
> and sshing in
> 
> I've tested this by explicitly blocking iperf traffic (tcp port 5001 by default)
> block out quick on em0 inet proto tcp from any to any port 5001
> and running iperf as a client on this system
> 
> The pf module is loaded, and I did in fact reload the rules with pfctl -f /etc/pf.con
> prior to each test. I even did a pfctl -s rules and the running config aligned
> with the rules I set each time.
> 

This is not something I am able to reproduce here. Have you enable pf
with "pfctl -e"?

-- 
Aurelien Jarno                          GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net




Information forwarded to debian-bugs-dist@lists.debian.org, GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>:
Bug#566773; Package kfreebsd-image-7.2-1-486. (Mon, 25 Jan 2010 12:15:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Aurelien Jarno <aurelien@aurel32.net>:
Extra info received and forwarded to list. Copy sent to GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>. (Mon, 25 Jan 2010 12:15:04 GMT) Full text and rfc822 format available.

Added tag(s) unreproducible. Request was from Aurelien Jarno <aurel32@debian.org> to control@bugs.debian.org. (Mon, 25 Jan 2010 14:33:04 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>:
Bug#566773; Package kfreebsd-image-7.2-1-486. (Tue, 26 Jan 2010 20:51:07 GMT) Full text and rfc822 format available.

Acknowledgement sent to William Orr <will@worrbase.com>:
Extra info received and forwarded to list. Copy sent to GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>. (Tue, 26 Jan 2010 20:51:07 GMT) Full text and rfc822 format available.

Message #22 received at submit@bugs.debian.org (full text, mbox):

From: William Orr <will@worrbase.com>
To: Aurelien Jarno <aurelien@aurel32.net>
Cc: 566773@bugs.debian.org, Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Re: Bug#566773: kfreebsd-image-7.2-1-486: pf ignores any and all rules
Date: Tue, 26 Jan 2010 15:48:06 -0500
On Mon, Jan 25, 2010 at 7:12 AM, Aurelien Jarno <aurelien@aurel32.net> wrote:
> will@worrbase.com a écrit :
>> Package: kfreebsd-image-7.2-1-486
>> Version: 7.2-11
>> Severity: grave
>> Justification: renders package unusable
>>
>> pf ignores any and all rules configured in /etc/pf.conf, even after being
>> told to reload the ruleset with pfctl -f /etc/pf.conf.
>>
>> I've tested this by blocking all traffic with the pf rule:
>> block all
>> and sshing in and out of the system, as well as running iperf.
>>
>> I've tested this by explicitly blocking ssh traffic
>> block in quick on em0 inet proto tcp from any to any port 22
>> and sshing in
>>
>> I've tested this by explicitly blocking iperf traffic (tcp port 5001 by default)
>> block out quick on em0 inet proto tcp from any to any port 5001
>> and running iperf as a client on this system
>>
>> The pf module is loaded, and I did in fact reload the rules with pfctl -f /etc/pf.con
>> prior to each test. I even did a pfctl -s rules and the running config aligned
>> with the rules I set each time.
>>
>
> This is not something I am able to reproduce here. Have you enable pf
> with "pfctl -e"?
>
> --
> Aurelien Jarno                          GPG: 1024D/F1BCDB73
> aurelien@aurel32.net                 http://www.aurel32.net
>

Looks like that was the issue. I'm sorry about the false bug report.

-- 
-Will Orr




Information forwarded to debian-bugs-dist@lists.debian.org, GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>:
Bug#566773; Package kfreebsd-image-7.2-1-486. (Tue, 26 Jan 2010 20:57:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to William Orr <will@worrbase.com>:
Extra info received and forwarded to list. Copy sent to GNU/kFreeBSD Maintainers <debian-bsd@lists.debian.org>. (Tue, 26 Jan 2010 20:57:05 GMT) Full text and rfc822 format available.

Reply sent to Aurelien Jarno <aurelien@aurel32.net>:
You have taken responsibility. (Tue, 26 Jan 2010 21:48:20 GMT) Full text and rfc822 format available.

Notification sent to will@worrbase.com:
Bug acknowledged by developer. (Tue, 26 Jan 2010 21:48:20 GMT) Full text and rfc822 format available.

Message #32 received at 566773-done@bugs.debian.org (full text, mbox):

From: Aurelien Jarno <aurelien@aurel32.net>
To: William Orr <will@worrbase.com>
Cc: 566773-done@bugs.debian.org
Subject: Re: Bug#566773: kfreebsd-image-7.2-1-486: pf ignores any and all rules
Date: Tue, 26 Jan 2010 22:45:13 +0100
On Tue, Jan 26, 2010 at 03:48:06PM -0500, William Orr wrote:
> On Mon, Jan 25, 2010 at 7:12 AM, Aurelien Jarno <aurelien@aurel32.net> wrote:
> > will@worrbase.com a écrit :
> >> Package: kfreebsd-image-7.2-1-486
> >> Version: 7.2-11
> >> Severity: grave
> >> Justification: renders package unusable
> >>
> >> pf ignores any and all rules configured in /etc/pf.conf, even after being
> >> told to reload the ruleset with pfctl -f /etc/pf.conf.
> >>
> >> I've tested this by blocking all traffic with the pf rule:
> >> block all
> >> and sshing in and out of the system, as well as running iperf.
> >>
> >> I've tested this by explicitly blocking ssh traffic
> >> block in quick on em0 inet proto tcp from any to any port 22
> >> and sshing in
> >>
> >> I've tested this by explicitly blocking iperf traffic (tcp port 5001 by default)
> >> block out quick on em0 inet proto tcp from any to any port 5001
> >> and running iperf as a client on this system
> >>
> >> The pf module is loaded, and I did in fact reload the rules with pfctl -f /etc/pf.con
> >> prior to each test. I even did a pfctl -s rules and the running config aligned
> >> with the rules I set each time.
> >>
> >
> > This is not something I am able to reproduce here. Have you enable pf
> > with "pfctl -e"?
> >
> > --
> > Aurelien Jarno                          GPG: 1024D/F1BCDB73
> > aurelien@aurel32.net                 http://www.aurel32.net
> >
> 
> Looks like that was the issue. I'm sorry about the false bug report.
> 

Ok, closing the bug.

-- 
Aurelien Jarno	                        GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Wed, 24 Feb 2010 07:34:53 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 12:34:32 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.