From owner-freebsd-bugs Mon Oct 8 3:30: 4 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 5ED0737B406 for ; Mon, 8 Oct 2001 03:30:02 -0700 (PDT) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f98AU2R51796; Mon, 8 Oct 2001 03:30:02 -0700 (PDT) (envelope-from gnats) Date: Mon, 8 Oct 2001 03:30:02 -0700 (PDT) Message-Id: <200110081030.f98AU2R51796@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: "Crist J. Clark" Subject: Re: kern/31130: ipfw tee functionality causes malfunction and security hole Reply-To: "Crist J. Clark" Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR kern/31130; it has been noted by GNATS. From: "Crist J. Clark" To: Tim Burgess Cc: freebsd-gnats-submit@FreeBSD.ORG Subject: Re: kern/31130: ipfw tee functionality causes malfunction and security hole Date: Mon, 8 Oct 2001 03:20:15 -0700 On Mon, Oct 08, 2001 at 02:14:18AM -0700, Tim Burgess wrote: [snip] > >Description: > It looks to me like using the ipfw 'tee' function on incoming packets actually accepts the packets as destined for the localhost. Hence a rule such as: > > 600 tee 8665 ip from any to any in > > Means that anyone browsing the web on the subnet behind the gateway sees the gateway machine's webserver no matter which url they enter. www.hotmail.com/wi actually goes to www.whitley.unimelb.edu.au/wi ! I am not sure what you are saying here. The fact that the original packet is accepted is clearly documented in ipfw(8). Not ideal behavior, but documented behavior. As for this issue where you believe that you have redirected packets, what is listening on 8665/divert? Can we see a tcpdump(8) of this behavior? -- Crist J. Clark cjclark@alum.mit.edu cjclark@jhu.edu cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message