Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 10 Mar 2014 20:53:39 -0700
From:      Julian Elischer <julian@freebsd.org>
To:        ipfw@FreeBSD.org
Subject:   ipfw stateful and ICMP
Message-ID:  <531E88C3.6030305@freebsd.org>

next in thread | raw e-mail | index | archive | help
It has annoyed me for some time that icmp packets refering ot an 
ongoing session can not be matched by a dynamic rule that goversn that 
session.

For example, if you have a dynamic rule for tcp 1.2.3.4 port
80 from 5.6.7.8 port 10000 then a returning icmp packet giving
"destination unreachable" and holding the appropriate header
in it's data segment should probably be allowed to go through
back to the originator.

Briefly looking at the code I see no sign of this and I haven't seen
any sign of it in action so I hope I'm not going to get a
"but it already does that" response.

My way of approaching it would be to change the dynamic rule code so that
it checks that the ICMP destination address matches the source address
of the packet fragment in the 'data' section, and then match the data 
segment
packet header with the dynamic rules instead of the icmp packet itself.

I would also add a sysctl to disable this behaviour, because there is 
always
someone who doesn't want any change you care to name.

The only way you can allow get icmp packets back to the originating sender
at the moment is to just allow them through without any major filtering.
That leaves you open to a large attack window.

anyone have violent objections?

(I'm currently rewriting the firewall rules at $DAYJOB and I think I'd 
like to have this,
but as we're on 8.0 I'll have to wait a while before I can use my own 
patch :-)

Julian




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?531E88C3.6030305>