openwrt / openwrt/firewall4

`option log '0'` doesn't seem to work

Open
#47 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
ucode
Stars
27
Forks
37
PR merge metrics
No merged PRs in 30d

Description

If I want to have a rule that simply suppresses the logging for some noisy (i.e. broadcast) traffic when logging is enabled for the zone, it seems that creating such a rule with option log '0' doesn't actually suppress the logging on it. I.e.:

config rule
	option name 'Dont-LOG-Misc-Broadcast'
	option target 'DROP'
	option src 'lan'
	option family 'ipv4'
	list proto 'all'
	list dest_ip '10.75.22.255'
	list dest_ip '255.255.255.255'
	option log '0'

This results in the nft rule:

	chain input_lan { # 
…
		ip daddr { 10.75.22.255, 255.255.255.255 } counter jump drop_from_lan comment "!fw4: Dont-LOG-Misc-Broadcast" 

and with logging enabled for the lan zone:

	chain drop_from_lan { # 
		iifname "eth0.1" counter log prefix "drop lan in: " drop comment "!fw4: drop lan IPv4/IPv6 traffic" # 
	}

which is the cause of the logging.

But what is really interesting is that if I disable logging on the lan zone, the drop_from_lan chain becomes:

	chain drop_from_lan { # 
	}

to disable the logging for the zone, but also, the rule added to the input_lan chain is changed to:

	chain input_lan { # 
…
		ip daddr { 10.75.22.255, 255.255.255.255 } counter drop comment "!fw4: Dont-LOG-Misc-Broadcast" # 

What is so interesting about this is that when zone logging is disabled, in addition to removing the logging from the drop_from_lan, the disposition of the rule changes from a jump drop_from_lan to a more simple drop.

I'm not sure what is triggering the change from jump drop_from_lan to a more simple drop, but that is actually what we want to happen for a rule that has option log '0' even when logging is enabled for the zone. That would achieve the expected results of option log '0'.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how a rule with option log '0' is rendered into the input_lan and drop_from_lan nft chains when zone logging is enabled. Done means the rule bypasses the zone logging jump and produces a direct drop, while other rules retain the zone's logging behavior.

Written by the indexing model from the issue text.

Assessment

Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.