As of recent updates to -current, the latest of which was today
(04/10/09), my pf rules are not loading due to a "syntax error" in my
scrub line. I have not touched my pf.conf in a while, so the
difference must be from recent source. I don't remember exactly when
this started to happen, but it's been within the last week.
The original line that was causing the problem was: scrub in all
no-df random-id fragment reassemble
But *scrub in* also initiates a syntax error.
I'm not sure if you need more info., but I've pasted my pf.conf and dmesg below.
10 eth_monty="em0"
11 wifi_monty="ath0"
12
13 icmp_types="{echoreq unreach}"
14
15 lambda="192.168.2.1"
16 frege="192.168.2.33"
17 aristotle="192.168.2.32"
18
19 #########################################################################
20 ########################## tables ####################################
21 #########################################################################
22
23 table <bad_ssh> persist file "/var/log/bad_ssh.pf"
24 table <bad_www> persist file "/var/log/bad_www.pf"
25 table <bad_wifi> persist file "/var/log/bad_wifi.pf"
26
27 #########################################################################
28 ########################### runtime options #############################
29 #########################################################################
30
31 set block-policy drop
32 set optimization normal
33 set ruleset-optimization basic
34 #set loginterface $ext_if # log all on ext_if
35 set state-policy floating
36 set skip on { lo }
37
38 ## traffic normalization
39 scrub in all no-df random-id fragment reassemble
40
41 ######################################
42 # Options: *no-df* clears the *don't fragment* bit that
43 # some packets have attached to them. Without
44 # this option those packets will be dropped.
45 # *random-id* works with the above option to
46 # assign *no-df pakcets* with a random id.
47 # *fragment reassemble* assembles packet fragments
48 # before being filtered.
49 #######################################
50
51 #########################################################################
52 ############################ NAT rules ##################################
53 #########################################################################
54
55 nat pass on $eth_monty from !($eth_monty) to any -> ($eth_monty)
56 nat pass on $wifi_monty from !($wifi_monty) to any -> ($wifi_monty)
57
58 #########################################################################
59 ############################ filter rules ###############################
60 #########################################################################
61 block in all # default block all
62 pass out all keep state # allow all stuff out
63
64 antispoof log quick for {lo $wifi_monty $eth_monty} # get rid of bad stuff
65
66 ## Block bad guys
67 block in log quick from <bad_ssh>
68 block in log quick from <bad_www>
69 block in log quick from <bad_wifi>
70
71 ## Monty's ethernet
72 pass in on $eth_monty inet proto tcp from any to ($eth_monty) \
73 port ssh synproxy state \
74 (max-src-conn-rate 3/20, overload <bad_ssh> flush global)
75
76 pass in on $eth_monty inet proto tcp from any to ($eth_monty) \
77 port {http, https} synproxy state \
78 (max-src-conn 100, max-src-conn-rate 15/5, overload <bad_www> flush global)
79
80 pass in on $eth_monty inet proto icmp from any to ($eth_monty) \
81 icmp-type $icmp_types keep state
82
83 pass in on $eth_monty inet proto tcp from {$frege, $aristotle, $lambda} \
84 to ($eth_monty) \
85 port {ssh, 79} synproxy state
200 OpenBSD 4.5-current (GENERIC.MP) #2: Fri Apr 10 08:07:58 CDT 2009
201
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
202 real mem = 2070614016 (1974MB)
203 avail mem = 1998381056 (1905MB)
204 mainbus0 at root
205 bios0 at mainbus0: SMBIOS rev. 2.4 @ 0xe0010 (74 entries)
206 bios0: vendor LENOVO version "7UET43WW (1.13 )" date 08/19/2008
207 bios0: LENOVO 7417CTO
208 acpi0 at bios0: rev 2
209 acpi0: tables DSDT FACP SSDT ECDT APIC MCFG HPET SLIC BOOT ASF!
SSDT TCPA SSDT SSDT SSDT
210 acpi0: wakeup devices LID_(S3) SLPB(S3) UART(S3) IGBE(S4) EXP0(S4)
EXP1(S4) EXP2(S4) EXP3(S4) EXP4(S4) PCI1(S4) USB0(S 3) USB1(S3)
USB2(S3) USB3(S3) USB4(S3) USB5(S3) EHC0(S3) EHC1(S3) HDEF(S4)
211 acpitimer0 at acpi0: 3579545 Hz, 24 bits
212 acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
213 cpu0 at mainbus0: apid 0 (boot processor)
214 cpu0: Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz, 2394.35 MHz
215 cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,
TM,SBF,SSE3,MWAIT,DS-CPL,VMX,SMX,EST,TM2,CX16,xTPR,NXE,LONG
216 cpu0: 3MB 64b/line 8-way L2 cache
217 cpu0: apic clock running at 265MHz
218 cpu1 at mainbus0: apid 1 (application processor)
219 cpu1: Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz, 2394.00 MHz
220 cpu1:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,
TM,SBF,SSE3,MWAIT,DS-CPL,VMX,SMX,EST,TM2,CX16,xTPR,NXE,LONG
221 cpu1: 3MB 64b/line 8-way L2 cache
222 ioapic0 at mainbus0 apid 1 pa 0xfec00000, version 20, 24 pins
223 ioapic0: misconfigured as apic 2, remapped to apid 1
224 acpihpet0 at acpi0: 14318179 Hz
225 acpiprt0 at acpi0: bus 0 (PCI0)
226 acpiprt1 at acpi0: bus -1 (AGP_)
227 acpiprt2 at acpi0: bus 2 (EXP0)
228 acpiprt3 at acpi0: bus 3 (EXP1)
229 acpiprt4 at acpi0: bus -1 (EXP2)
230 acpiprt5 at acpi0: bus 5 (EXP3)
231 acpiprt6 at acpi0: bus 13 (EXP4)
232 acpiprt7 at acpi0: bus 21 (PCI1)
233 acpiec0 at acpi0
234 acpicpu0 at acpi0: C3, C2
235 acpicpu1 at acpi0: C3, C2
236 acpitz0 at acpi0: critical temperature 127 degC
237 acpitz1 at acpi0: critical temperature 100 degC
238 acpibtn0 at acpi0: LID_
239 acpibtn1 at acpi0: SLPB
240 acpibat0 at acpi0: BAT0 model "42T5225" serial 3388 type LION oem
"Panasonic"
241 acpibat1 at acpi0: BAT1 not present
242 acpiac0 at acpi0: AC unit online
243 acpithinkpad0 at acpi0
244 acpidock at acpi0 not configured
245 acpivideo at acpi0 not configured
246 acpivideo at acpi0 not configured
247 cpu0: unknown Enhanced SpeedStep CPU, msr 0x0617092106000921
248 cpu0: using only highest and lowest power states
249 cpu0: Enhanced SpeedStep 2400 MHz (1228 mV): speeds: 2400, 1600 MHz
250 pci0 at mainbus0 bus 0: configuration mode 1
251 pchb0 at pci0 dev 0 function 0 "Intel GM45 Host" rev 0x07
252 vga1 at pci0 dev 2 function 0 "Intel GM45 Video" rev 0x07
253 wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
254 wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
255 intagp0 at vga1
256 agp0 at intagp0: aperture at 0xd0000000, size 0x10000000
257 inteldrm0 at vga1: apic 1 int 16 (irq 11)
258 drm0 at inteldrm0
259 "Intel GM45 Video" rev 0x07 at pci0 dev 2 function 1 not configured
260 "Intel GM45 HECI" rev 0x07 at pci0 dev 3 function 0 not configured
261 em0 at pci0 dev 25 function 0 "Intel ICH9 IGP M AMT" rev 0x03:
apic 1 int 20 (irq 11), address 00:1e:37:d9:cc:ed
262 uhci0 at pci0 dev 26 function 0 "Intel 82801I USB" rev 0x03: apic
1 int 20 (irq 11)
263 uhci1 at pci0 dev 26 function 1 "Intel 82801I USB" rev 0x03: apic
1 int 21 (irq 11)
264 uhci2 at pci0 dev 26 function 2 "Intel 82801I USB" rev 0x03: apic
1 int 22 (irq 11)
265 ehci0 at pci0 dev 26 function 7 "Intel 82801I USB" rev 0x03: apic
1 int 23 (irq 11)
266 usb0 at ehci0: USB revision 2.0
267 uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
268 azalia0 at pci0 dev 27 function 0 "Intel 82801I HD Audio" rev
0x03: apic 1 int 17 (irq 11)
269 azalia0: codecs: Conexant CX20561
270 audio0 at azalia0
271 ppb0 at pci0 dev 28 function 0 "Intel 82801I PCIE" rev 0x03: apic
1 int 20 (irq 11)
272 pci1 at ppb0 bus 2
273 ppb1 at pci0 dev 28 function 1 "Intel 82801I PCIE" rev 0x03: apic
1 int 21 (irq 11)
274 pci2 at ppb1 bus 3
275 ath0 at pci2 dev 0 function 0 "Atheros AR5424" rev 0x01: apic 1
int 17 (irq 11)
276 ath0: AR5424 14.2 phy 7.0 rf 0.0, WOR02W, address 00:22:69:86:96:77
277 ppb2 at pci0 dev 28 function 3 "Intel 82801I PCIE" rev 0x03: apic
1 int 23 (irq 11)
278 pci3 at ppb2 bus 5
279 ppb3 at pci0 dev 28 function 4 "Intel 82801I PCIE" rev 0x03: apic
1 int 20 (irq 11)
280 pci4 at ppb3 bus 13
281 uhci3 at pci0 dev 29 function 0 "Intel 82801I USB" rev 0x03: apic
1 int 16 (irq 11)
282 uhci4 at pci0 dev 29 function 1 "Intel 82801I USB" rev 0x03: apic
1 int 17 (irq 11)
283 uhci5 at pci0 dev 29 function 2 "Intel 82801I USB" rev 0x03: apic
1 int 18 (irq 11)
284 ehci1 at pci0 dev 29 function 7 "Intel 82801I USB" rev 0x03: apic
1 int 19 (irq 11)
285 usb1 at ehci1: USB revision 2.0
286 uhub1 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
287 ppb4 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0x93
288 pci5 at ppb4 bus 21
289 cbb0 at pci5 dev 0 function 0 "Ricoh 5C476 CardBus" rev 0xba: apic
1 int 16 (irq 11)
290 "Ricoh 5C832 Firewire" rev 0x04 at pci5 dev 0 function 1 not configured
291 cardslot0 at cbb0 slot 0 flags 0
292 cardbus0 at cardslot0: bus 22 device 0 cacheline 0x0, lattimer 0xb0
293 pcmcia0 at cardslot0
294 pcib0 at pci0 dev 31 function 0 "Intel 82801IEM LPC" rev 0x03
295 ahci0 at pci0 dev 31 function 2 "Intel 82801I AHCI" rev 0x03: apic
1 int 16 (irq 11), AHCI 1.2
296 scsibus0 at ahci0: 32 targets
297 sd0 at scsibus0 targ 0 lun 0: <ATA, HITACHI HTS72201, DCDZ> SCSI3
0/direct fixed
298 sd0: 152627MB, 512 bytes/sec, 312581808 sec total
299 cd0 at scsibus0 targ 1 lun 0: <HL-DT-ST, RW/DVD MU10N, 1.05> ATAPI
5/cdrom removable
300 ichiic0 at pci0 dev 31 function 3 "Intel 82801I SMBus" rev 0x03:
apic 1 int 23 (irq 11)
301 iic0 at ichiic0
302 usb2 at uhci0: USB revision 1.0
303 uhub2 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
304 usb3 at uhci1: USB revision 1.0
305 uhub3 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
306 usb4 at uhci2: USB revision 1.0
307 uhub4 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
308 usb5 at uhci3: USB revision 1.0
309 uhub5 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
310 usb6 at uhci4: USB revision 1.0
311 uhub6 at usb6 "Intel UHCI root hub" rev 1.00/1.00 addr 1
312 usb7 at uhci5: USB revision 1.0
313 uhub7 at usb7 "Intel UHCI root hub" rev 1.00/1.00 addr 1
314 isa0 at pcib0
315 isadma0 at isa0
316 pckbc0 at isa0 port 0x60/5
317 pckbd0 at pckbc0 (kbd slot)
318 pckbc0: using irq 1 for kbd slot
319 wskbd0 at pckbd0: console keyboard, using wsdisplay0
320 pms0 at pckbc0 (aux slot)
321 pckbc0: using irq 12 for aux slot
322 wsmouse0 at pms0 mux 0
323 pcppi0 at isa0 port 0x61
324 midi0 at pcppi0: <PC speaker>
325 spkr0 at pcppi0
326 aps0 at isa0 port 0x1600/31
327 mtrr: Pentium Pro MTRR support
328 softraid0 at root
329 root on sd0a swap on sd0b dump on sd0b
--
www.nealhogan.net www.lambdaserver.com
