Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 07 Mar 2017 08:45:22 -0600
From:      Mark Felder <feld@FreeBSD.org>
To:        Ian Smith <smithi@nimnet.asn.au>
Cc:        freebsd-ipfw@FreeBSD.org
Subject:   Re: [Bug 216867] IPFW workstation rules block DNSSEC resulting in DNS failure on freebsd.org domains
Message-ID:  <1488897922.884989.903291024.2023FFB6@webmail.messagingengine.com>
In-Reply-To: <20170308013059.I87835@sola.nimnet.asn.au>
References:  <bug-216867-7515@https.bugs.freebsd.org/bugzilla/> <bug-216867-7515-niEJ7KtnU7@https.bugs.freebsd.org/bugzilla/> <20170308013059.I87835@sola.nimnet.asn.au>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help


On Tue, Mar 7, 2017, at 08:43, Ian Smith wrote:
> On Tue, 7 Mar 2017 13:49:25 +0000, bugzilla-noreply@freebsd.org wrote:
>  > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216867
>  > 
>  > Mark Felder <feld@FreeBSD.org> changed:
>  > 
>  >            What    |Removed                     |Added
>  > ----------------------------------------------------------------------------
>  >                  CC|                            |feld@FreeBSD.org
>  > 
>  > --- Comment #1 from Mark Felder <feld@FreeBSD.org> ---
>  > Needs some testers, but this should fix it
>  > 
>  > https://reviews.freebsd.org/D9920
> 
> I've always used these rules from 'client' and 'simple' rulesets:
> 	${fwcmd} add pass all from any to any frag
> which I long ago found essential to pass frags from zen.spamhaus.org
> 
> I haven't used reass - nor DNSSEC - so can't really evaluate, nor test 
> currently, so I won't pollute the bug report with what may be musing.
> 
> However, looking at the review patch, I do wonder if the reass shouldn't
> precede, rather than follow, the check-state?
> 

My pre-coffee brain said "UDP isn't stateful; should be fine to put this
after check-state". I didn't evaluate it further than that.

-- 
  Mark Felder
  ports-secteam & portmgr member
  feld@FreeBSD.org



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?1488897922.884989.903291024.2023FFB6>