>Number:         27590
>Category:       kern
>Synopsis:       IPF 3.x allows a "state-age" clause that can no longer be used.
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 28 05:09:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Paul Shupak
>Release:        NetBSD 2.99.10
>Organization:
	
>Environment:
	
	
System: NetBSD svcs 2.99.10 NetBSD 2.99.10 (SVCS) #389: Fri Oct 15 10:01:37 PDT 2004 root@svcs:/sys/arch/i386/compile/SVCS i386
Architecture: i386
Machine: i386
>Description:
	As an example, to allow amanda through firewalls to (possibly) slow
machines, I use a rule like:

	pass  in  quick proto udp from any to any port = amanda keep state keep state-age 900/900 keep frags group 208

	On IPF 4.1.x, this simply leads to an error such as:

	syntax error error at "state-age", line 9

	For some purposes, there is no available alternative (except disabling
the firewall for those machine/port combinations).
	
>How-To-Repeat:
	When using IPF 4.1.x, try a rule which contains "keep state" and
"state-age" clauses as was allowed by IPF 3.x.
	
>Fix:
	Re-add "state-age" to the IPF grammar and reintroduce its semantics
to the state machine(s).  (Particularly needed for non-TCP protocols where
the "keep state" timeout is small compared to what many applications desire
or need - e.g. UDP.)
	
>Release-Note:
>Audit-Trail:
>Unformatted: