From owner-cvs-all@FreeBSD.ORG Thu May 18 00:31:17 2006 Return-Path: X-Original-To: cvs-all@freebsd.org Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A097816ABB8 for ; Thu, 18 May 2006 00:31:17 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.188]) by mx1.FreeBSD.org (Postfix) with ESMTP id 95F5443D49 for ; Thu, 18 May 2006 00:31:16 +0000 (GMT) (envelope-from max@love2party.net) Received: from [88.64.187.87] (helo=vampire.homelinux.org) by mrelayeu.kundenserver.de (node=mrelayeu2) with ESMTP (Nemesis), id 0MKwtQ-1FgWQ701Ev-0001s9; Thu, 18 May 2006 02:31:15 +0200 Received: (qmail 14734 invoked from network); 18 May 2006 00:31:42 -0000 Received: from localhost (HELO mail.abi01.homeunix.org) (192.168.4.64) by localhost with SMTP; 18 May 2006 00:31:42 -0000 Received: from 192.168.4.1 (SquirrelMail authenticated user mlaier) by mail.abi01.homeunix.org with HTTP; Thu, 18 May 2006 02:31:14 +0200 (CEST) Message-ID: <49258.192.168.4.1.1147912274.squirrel@mail.abi01.homeunix.org> In-Reply-To: <200605160929.aa90920@salmon.maths.tcd.ie> References: Your message of "Tue, 16 May 2006 01:05:00 +0200." <52078.192.168.4.1.1147734300.squirrel@mail.abi01.homeunix.org> <200605160929.aa90920@salmon.maths.tcd.ie> Date: Thu, 18 May 2006 02:31:14 +0200 (CEST) From: "Max Laier" To: "David Malone" User-Agent: SquirrelMail/1.4.6 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Provags-ID: kundenserver.de abuse@kundenserver.de login:61c499deaeeba3ba5be80f48ecc83056 Cc: Max Laier , src-committers@freebsd.org, cvs-all@freebsd.org, cvs-src@freebsd.org Subject: Re: cvs commit: src/sys/netinet ip_fw2.c X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2006 00:31:18 -0000 On Tue, May 16, 2006 10:29 am, David Malone wrote: >> Interesting - thanks for the pointer. Unless every stack DTRT we can't >> use the flow_id, though - or we break otherwise legal connections. In >> the >> given case we would open a state with SYN+flow_id and got a reply >> SYNACK+0 >> which wouldn't hash the same as the SYN we sent out. No matching state, >> no connection. > > Indeed - we need to get into the position where almost all stacks > do the right thing before we can use the flow label as a key of any > sort in the firewalling process. If people have noticed problems > with this, I'd be interested in knowing which stacks are incriminated. The PR has www.sixxs.net:80 as example, which seems to be running "Linux Apache/2.0.55 (Debian)" (according to netcraft). nmap wasn't really able to tell in my testing, but it should be possible to approach somebody at sixxs.net about it - they are very helpful and worried about IPv6. -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News