Date: Wed, 21 Mar 2001 15:51:57 -0800 From: Kris Kennaway <kris@obsecurity.org> To: Bill Fumerola <billf@mu.org> Cc: Paul Richards <paul@FreeBSD.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw.c Message-ID: <20010321155157.A8502@xor.obsecurity.org> In-Reply-To: <20010321150244.F2567@elvis.mu.org>; from billf@mu.org on Wed, Mar 21, 2001 at 03:02:44PM -0600 References: <200103210819.f2L8JWm19214@freefall.freebsd.org> <20010321150244.F2567@elvis.mu.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--fdj2RfSjLxBAspz7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 21, 2001 at 03:02:44PM -0600, Bill Fumerola wrote: > On Wed, Mar 21, 2001 at 12:19:32AM -0800, Paul Richards wrote: >=20 > > Modified files: > > sys/netinet ip_fw.c=20 > > Log: > > Only flush rules that have a rule number above that set by a new > > sysctl, net.inet.ip.fw.permanent_rules. > > =20 > > This allows you to install rules that are persistent across flushes, > > which is very useful if you want a default set of rules that > > maintains your access to remote machines while you're reconfiguring > > the other rules. > > =20 > > Reviewed by: Mark Murray <markm@FreeBSD.org> >=20 > Ugh. >=20 > If you're configuring remote machines with a default deny rule instead > of explcitly adding a deny rule you might want to reconsider. Actually, a default deny rule is sensible to avoid the race condition at boot time when the interfaces are up but the ipfw rules not yet loaded, or after a flush during the reloading of rules. If this is a firewall protecting a network/server then attackers can sneak at least a few packets past (this is made much easier if you can exploit another bug to trigger a reboot of the firewall on demand, e.g. an IP stack bug leading to a ping of death). Kris --fdj2RfSjLxBAspz7 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE6uT6dWry0BWjoQKURAqKIAJwLXXYG9kJiwiCsD4XWmAZjFXktegCgot5W qnNOas7uHgwcEVDFO2Vbl98= =U/8O -----END PGP SIGNATURE----- --fdj2RfSjLxBAspz7-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010321155157.A8502>