From owner-freebsd-security@FreeBSD.ORG  Thu Sep  2 03:57:39 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4CA0116A4CE
	for <freebsd-security@freebsd.org>;
	Thu,  2 Sep 2004 03:57:39 +0000 (GMT)
Received: from mproxy.gmail.com (mproxy.gmail.com [216.239.56.251])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3C44C43D39
	for <freebsd-security@freebsd.org>;
	Thu,  2 Sep 2004 03:57:39 +0000 (GMT)
	(envelope-from chip.gwyn@gmail.com)
Received: by mproxy.gmail.com with SMTP id w67so111733cwb
	for <freebsd-security@freebsd.org>;
	Wed, 01 Sep 2004 20:57:39 -0700 (PDT)
Received: by 10.11.119.50 with SMTP id r50mr139082cwc;
        Wed, 01 Sep 2004 20:57:38 -0700 (PDT)
Received: by 10.11.117.61 with HTTP; Wed, 1 Sep 2004 20:57:38 -0700 (PDT)
Message-ID: <64a8ad980409012057321aea0c@mail.gmail.com>
Date: Wed, 1 Sep 2004 23:57:38 -0400
From: chip <chip.gwyn@gmail.com>
To: freebsd-security@freebsd.org
In-Reply-To: <20040901203202.U31170@metafocus.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
References: <20040901203202.U31170@metafocus.net>
Subject: Re: IPFW and icmp
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: chip <chip.gwyn@gmail.com>
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Sep 2004 03:57:39 -0000

On Wed, 1 Sep 2004 20:37:52 -0700 (PDT), Dave <mudman@metafocus.net> wrote:
> 
> I'm not a master of the internet RFCs, but I do believe icmp messages have
> different types.
> 
> Now to enable traceroute for IPFW, I might put in a rule like this:
> 
> ipfw add pass icmp from any to me
> 
> However, how would I make a rule to limit icmp messages to just those used
> by traceroute?  Can the messages be distinguished as such?
> 
> A dynamic rule that exists only for the duration of a traceroute execution
> would be even better.  I take it 'setup' or 'check-state' would follow in
> that case?
> 

Dave,

  I can't comment much on how to build the exact rules you need, but
you should be made aware that different implementations of traceroute
achieve the results in different ways.  Cisco routers and most *nix
boxen use UDP packets while Microsoft stuff uses ICMP.  A good guide
to the difference:

http://www.cisco.com/warp/public/105/traceroute.shtml

>From a quick google search however, I find the following from: 
http://lists.freebsd.org/pipermail/freebsd-security/2004-February/001585.html

# TRACEROUTE - Allow outgoing
${fwcmd} add pass udp from any to any 33434-33523 out via ${oif}

Hope this helps!

--chip
-- 
Just my $.02, your mileage may vary,  batteries not included, etc....