From owner-freebsd-ipfw  Wed Jul 28  8:40:54 1999
Delivered-To: freebsd-ipfw@freebsd.org
Received: from ns.mt.sri.com (ns.mt.sri.com [206.127.79.91])
	by hub.freebsd.org (Postfix) with ESMTP
	id BAB00154D0; Wed, 28 Jul 1999 08:40:48 -0700 (PDT)
	(envelope-from nate@mt.sri.com)
Received: from mt.sri.com (rocky.mt.sri.com [206.127.76.100])
	by ns.mt.sri.com (8.8.8/8.8.8) with SMTP id JAA01548;
	Wed, 28 Jul 1999 09:39:45 -0600 (MDT)
	(envelope-from nate@rocky.mt.sri.com)
Received: by mt.sri.com (SMI-8.6/SMI-SVR4)
	id JAA01265; Wed, 28 Jul 1999 09:39:44 -0600
Date: Wed, 28 Jul 1999 09:39:44 -0600
Message-Id: <199907281539.JAA01265@mt.sri.com>
From: Nate Williams <nate@mt.sri.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To: "Brian F. Feldman" <green@FreeBSD.org>
Cc: Nate Williams <nate@mt.sri.com>, Joe Greco <jgreco@ns.sol.net>,
	hackers@FreeBSD.org, freebsd-ipfw@FreeBSD.org
Subject: Re: securelevel and ipfw zero
In-Reply-To: <Pine.BSF.4.10.9907280217180.71863-100000@janus.syracuse.net>
References: <199907280449.WAA29417@mt.sri.com>
	<Pine.BSF.4.10.9907280217180.71863-100000@janus.syracuse.net>
X-Mailer: VM 6.34 under 19.16 "Lille" XEmacs Lucid
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> > Implementing it is the easy part, making sure it's the right thing to do
> > is the hard part.
> 
> Well, the easy part is done, except for raising limits. Look:
> ipfw: 1 Deny ICMP:8.0 127.0.0.1 127.0.0.1 out via lo0
> ipfw: 1 Deny ICMP:8.0 127.0.0.1 127.0.0.1 out via lo0
> ipfw: limit 2 reached on rule #1
> ipfw: Entry 1 logging count reset.
> ipfw: 1 Deny ICMP:8.0 127.0.0.1 127.0.0.1 out via lo0
> ipfw: 1 Deny ICMP:8.0 127.0.0.1 127.0.0.1 out via lo0
> ipfw: limit 2 reached on rule #1
> 
> Nice? :)

Depends on how it effects the speed of the system and if it makes the
code too complex. :)


Nate


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message