`option log '0'` doesn't seem to work
Nobody has claimed this yet.
- Dominant language
- ucode
- Stars
- 27
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
If I want to have a rule that simply suppresses the logging for some noisy (i.e. broadcast) traffic when logging is enabled for the zone, it seems that creating such a rule with option log '0' doesn't actually suppress the logging on it. I.e.:
config rule
option name 'Dont-LOG-Misc-Broadcast'
option target 'DROP'
option src 'lan'
option family 'ipv4'
list proto 'all'
list dest_ip '10.75.22.255'
list dest_ip '255.255.255.255'
option log '0'
This results in the nft rule:
chain input_lan { #
…
ip daddr { 10.75.22.255, 255.255.255.255 } counter jump drop_from_lan comment "!fw4: Dont-LOG-Misc-Broadcast"
and with logging enabled for the lan zone:
chain drop_from_lan { #
iifname "eth0.1" counter log prefix "drop lan in: " drop comment "!fw4: drop lan IPv4/IPv6 traffic" #
}
which is the cause of the logging.
But what is really interesting is that if I disable logging on the lan zone, the drop_from_lan chain becomes:
chain drop_from_lan { #
}
to disable the logging for the zone, but also, the rule added to the input_lan chain is changed to:
chain input_lan { #
…
ip daddr { 10.75.22.255, 255.255.255.255 } counter drop comment "!fw4: Dont-LOG-Misc-Broadcast" #
What is so interesting about this is that when zone logging is disabled, in addition to removing the logging from the drop_from_lan, the disposition of the rule changes from a jump drop_from_lan to a more simple drop.
I'm not sure what is triggering the change from jump drop_from_lan to a more simple drop, but that is actually what we want to happen for a rule that has option log '0' even when logging is enabled for the zone. That would achieve the expected results of option log '0'.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how a rule with option log '0' is rendered into the input_lan and drop_from_lan nft chains when zone logging is enabled. Done means the rule bypasses the zone logging jump and produces a direct drop, while other rules retain the zone's logging behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100