From owner-freebsd-ipfw@FreeBSD.ORG  Fri Aug  1 12:10:11 2003
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2609437B401
	for <freebsd-ipfw@freebsd.org>; Fri,  1 Aug 2003 12:10:11 -0700 (PDT)
Received: from whizzo.transsys.com (whizzo.TransSys.COM [144.202.42.10])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5C7E843F3F
	for <freebsd-ipfw@freebsd.org>; Fri,  1 Aug 2003 12:10:10 -0700 (PDT)
	(envelope-from louie@whizzo.transsys.com)
Received: from whizzo.transsys.com (#6@localhost [127.0.0.1])
	by whizzo.transsys.com (8.12.9/8.12.9) with ESMTP id h71JA9RY033752;
	Fri, 1 Aug 2003 15:10:09 -0400 (EDT)
	(envelope-from louie@whizzo.transsys.com)
Message-Id: <200308011910.h71JA9RY033752@whizzo.transsys.com>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: =?iso-8859-1?Q?Sten_Daniel_S=F8rsdal?= <sten.daniel.sorsdal@wan.no>
X-Image-URL: http://www.transsys.com/louie/images/louie-mail.jpg
From: "Louis A. Mamakos" <louie@TransSys.COM>
References: <0AF1BBDF1218F14E9B4CCE414744E70F1F3E28@exchange.wanglobal.net> 
In-reply-to: Your message of "Fri, 01 Aug 2003 18:32:05 +0200."
             <0AF1BBDF1218F14E9B4CCE414744E70F1F3E28@exchange.wanglobal.net> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 01 Aug 2003 15:10:09 -0400
Sender: louie@TransSys.COM
cc: freebsd-ipfw@freebsd.org
Subject: Re: Suggestion regarding a new option for IPFW2 
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Aug 2003 19:10:11 -0000


TCP resets MUST already come with the source address rewritten 
otherwise it won't match up with the connection attempt on the
original host.  If you look in ip_fw2.c:

        /*
         * Assume we are sending a RST (or a keepalive in the reverse
         * direction), swap src and destination addresses and ports.
         */
        ip->ip_src.s_addr = htonl(id->dst_ip);
        ip->ip_dst.s_addr = htonl(id->src_ip);
        tcp->th_sport = htons(id->dst_port);
        tcp->th_dport = htons(id->src_port);

appears in the send_pkt() function which appears to be called to
send the reset segments.

louie