Date: Thu, 13 May 2004 21:55:39 +0800 From: Eugene Grosbein <eugen@grosbein.pp.ru> To: Luigi Rizzo <rizzo@icir.org> Cc: net@freebsd.org Subject: Re: ipfw: reset tcp Message-ID: <20040513135539.GA13211@grosbein.pp.ru> In-Reply-To: <20040513064856.B42908@xorpc.icir.org> References: <40A3393F.1391943E@kuzbass.ru> <20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru> <20040513013717.A16394@xorpc.icir.org> <40A345F9.1460F5C4@kuzbass.ru> <20040513064856.B42908@xorpc.icir.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 13, 2004 at 06:48:56AM -0700, Luigi Rizzo wrote: > 2.- all other firewall-generated TCP packets (rst and keepalives) > go through send_pkt() and then bypass the firewall. > The only way we could safely go through the firewall again is > to make sure that we never send a RST in response to a RST (need > to add an additional check in O_REJECT). > > Give me a few days (i.e. ping me again on monday!) to come up with > a safe patch to do this, which does not rely on the programmer to > DTRT and avoid loops. Thanks a lot! Eugene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040513135539.GA13211>