Date: Sat, 22 Jan 2000 10:58:28 +1100 (Australia/NSW) From: Darren Reed <avalon@coombs.anu.edu.au> To: kraemer@u.washington.edu (Brian Kraemer) Cc: avalon@coombs.anu.edu.au (Darren Reed), freebsd-security@FreeBSD.ORG, freebsd-stable@FreeBSD.ORG Subject: Re: bugtraq posts: stream.c - new FreeBSD exploit? Message-ID: <200001212358.KAA15748@cairo.anu.edu.au> In-Reply-To: <Pine.A41.4.10.10001210852260.109950-100000@mead2.u.washington.edu> from "Brian Kraemer" at Jan 21, 2000 08:55:32 AM
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Brian Kraemer, sie said: > > On Fri, 21 Jan 2000, Darren Reed wrote: > > > btw, I think the better way to write the 3 rules is: > > > > block in quick proto tcp from any to any head 100 > > pass in quick proto tcp from any to any flags S keep state group 100 > > pass in all > > If I'm not mistaken, this ruleset (and no other rules) will also > effectively block any outgoing TCP sessions initiated from this machine. > The machine will send a SYN, and then get blocked because the input rules > never saw an incoming SYN to start keeping state. > > I assume a rule that keeps state on the outgoing would fix this? Yes. I forgot about that :-) pass out proto tcp from any to any flags S keep state would be required also. Darren To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001212358.KAA15748>