Date: Fri, 6 Nov 1998 00:46:52 +1300 (NZDT) From: Andrew McNaughton <andrew@squiz.co.nz> To: Open Systems Networking <opsys@mail.webspan.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Amazing wonder packet Part 2. Message-ID: <Pine.BSF.4.01.9811060031140.17028-100000@aniwa.sky> In-Reply-To: <Pine.BSF.4.02.9811050614460.26130-100000@orion.webspan.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 5 Nov 1998, Open Systems Networking wrote: > Date: Thu, 5 Nov 1998 06:24:43 -0500 (EST) > From: Open Systems Networking <opsys@mail.webspan.net> > To: Andrew McNaughton <andrew@squiz.co.nz> > Cc: freebsd-security@FreeBSD.ORG > Subject: Re: Amazing wonder packet Part 2. > > On Fri, 6 Nov 1998, Andrew McNaughton wrote: > > > > > > > There was an earlier post that covered this which I think you haven't read > > or haven't understood. > > > > Assuming that the default policy is to deny all and assuming that rules > > are added in numerical order, the result of any rule being missing can > > only be to deny the packet, which should be safe for most purposes. > > > > In most cases there's no problem for your solution. > > No my solution is solved as robert said by just having the default policy > to deny all, and having my rules numerically ordered as they are now. > The point of my post was a solution I was mailed that implemented what > robert said in the last part to have rule one deny everything and then > remove it when the rules have loaded. This is a fix for those with a > policy of default to open in the kernel. My solution is fine since I have > deny all as my default policy and a deny all as my last rule. Which should > guarantee that my policies are carried out and that nothing sneaks by. > I was merely asking if this persons solution is what robert was thinking > for those that have a default policy of open. And if it was implemented > right. Because most people are not aware of this race condition at all. > And I plan on adding this fix to my pages for those who have a default > policy to open. So they get the same warm fuzzy feeling as I do with a > closed default policy. I just wanted to make sure that the fix I just > posted was what robert was talking about and to make sure the > solution I posted was on par with what robert said. Thats all. > I'm pretty sure it is, but wanted to double check. If you have a default to open in the kernel then what you suggest does not solve the problem. There's a window between the interface being brought up and the execution of rc.firewall which is going to be vulnerable regardless of what's in rc.firewall. If you're using ipfw as a firewall then you shouldn't be defaulting to open. Defaulting to open is appropriate if you're just using it for traffic counting, or address translation without an assumption that security is provided. root@aniwa# ipfw add 54321 deny all from any to any via ep1 ipfw: warning: interface ``ep1'' does not exist 54321 deny ip from any to any via ep1 root@aniwa# ipfw show [...] 54321 0 0 deny ip from any to any via ep1 [...] Looks like rc.firewall could be run _before_ the interfaces are set up. The warnings could be annoying though. Andrew To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.01.9811060031140.17028-100000>