Date: Thu, 13 May 2004 06:48:56 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Eugene Grosbein <eugen@kuzbass.ru> Cc: net@freebsd.org Subject: Re: ipfw: reset tcp Message-ID: <20040513064856.B42908@xorpc.icir.org> In-Reply-To: <40A345F9.1460F5C4@kuzbass.ru>; from eugen@kuzbass.ru on Thu, May 13, 2004 at 05:55:05PM %2B0800 References: <40A3393F.1391943E@kuzbass.ru> <20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru> <20040513013717.A16394@xorpc.icir.org> <40A345F9.1460F5C4@kuzbass.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 13, 2004 at 05:55:05PM +0800, Eugene Grosbein wrote: ... > > removing the M_SKIP_FIREWALL would let ipfw process the > > packet too. HOWEVER: i think it is a bug in the general case > > to reprocess internally-generated packet, because you would rely > > on a correct ipfw configuration to avoid loops (which might not > > be the case). > > > > I have no idea how ipfw1 used to do (and i am not goin to check!) > > but i don't think the generated packet did reenter the firewall. > > I use ipfw2. > > Please make it possible (using sysctl or any other mean) to > disable M_SKIP_FIREWALL for such packets (I suppose 'unreach' rules > are affected too). I DO need to process ALL outgoing packets. > For exapmle, I must use 'ipfw fwd' (to implement policy routing) > for the packets with source IP like this. ok the situation is the following: 1.- unreach rules send packets through send_reject() which in turn calls icmp_error() which in turn goes through the firewall; This is safe because ipfw2 will not generate an ICMP reject in response to an ICMP packets so loops are avoided; 2.- all other firewall-generated TCP packets (rst and keepalives) go through send_pkt() and then bypass the firewall. The only way we could safely go through the firewall again is to make sure that we never send a RST in response to a RST (need to add an additional check in O_REJECT). Give me a few days (i.e. ping me again on monday!) to come up with a safe patch to do this, which does not rely on the programmer to DTRT and avoid loops. cheers luigi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040513064856.B42908>