Unexpected filter behavior from flows-reader

[GoogleCodeExporter]

What steps will reproduce the problem?
Run the following filter using flowd-reader

accept dst any port 80 proto tcp

The only flows with destination port 80 should be display, however every flow 
is displayed.  Using the following filter will show the expected results.

discard quick dst any port ! 80 proto tcp


What is the expected output? What do you see instead?

Reviewing the source there is an implicit accept at the end of the filter so 
every flow will match unless the 'quick' keyword is used.  The attach diff 
changes the default filter behavior, clarifies the filter section of the man 
page.

What version of the product are you using? On what operating system?
flowd 0.9.1
OpenBSD 5.2 amd64
OpenBSD 5.3 amd64

Please provide any additional information below.


diff -r 85550dd9b2cc filter.c
--- a/filter.c  Thu Jun 21 10:30:34 2012 +1000
+++ b/filter.c  Fri Jun 21 11:54:32 2013 -0500
@@ -308,7 +308,7 @@
 u_int
 filter_flow(struct store_flow_complete *flow, struct filter_list *filter)
 {
-       u_int action = FF_ACTION_ACCEPT;
+       u_int action = FF_ACTION_DISCARD;
        struct filter_rule *fr, *last_rule;
        int i, m;

diff -r 85550dd9b2cc flowd.conf.5.in
--- a/flowd.conf.5.in   Thu Jun 21 10:30:34 2012 +1000
+++ b/flowd.conf.5.in   Fri Jun 21 11:54:32 2013 -0500
@@ -327,6 +327,11 @@
 or
 .Ar discard
 rule decides what action is taken.
+If no filters rules are speficied then an default behavior is to
+.Ar accept
+all flows.  If filter rules are used then there is an implicit
+.Ar discard
+at the end of the rules.
 .Pp
 The following actions can be used in the filter:
 .Bl -tag -width xxxxxxxx
diff -r 85550dd9b2cc parse.y
--- a/parse.y   Thu Jun 21 10:30:34 2012 +1000
+++ b/parse.y   Fri Jun 21 11:54:32 2013 -0500
@@ -1204,6 +1204,17 @@
                logit(LOG_ERR, "No listening addresses specified");
                return (-1);
        }
+       /* add explicit accept all filter if none specified to mimic previous
+        * filter behavior */
+       if (!filter_only && TAILQ_EMPTY(&conf->filter_list)) {
+               struct filter_rule      *r;
+
+               if ((r = calloc(1, sizeof(*r))) == NULL)
+                       logerrx("filterrule: calloc");
+
+               r->action.action_what = FF_ACTION_ACCEPT;
+               TAILQ_INSERT_TAIL(&conf->filter_list, r, entry);
+       }
        /* Free macros and check which have not been used. */
        for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
                next = TAILQ_NEXT(sym, entry);

Original issue reported on code.google.com by [email protected] on 21 Jun 2013 at 4:56