From owner-cvs-src@FreeBSD.ORG  Sun Aug  3 17:11:19 2008
Return-Path: <owner-cvs-src@FreeBSD.ORG>
Delivered-To: cvs-src@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6B5391065683;
	Sun,  3 Aug 2008 17:11:19 +0000 (UTC) (envelope-from das@FreeBSD.ORG)
Received: from zim.MIT.EDU (ZIM.MIT.EDU [18.95.3.101])
	by mx1.freebsd.org (Postfix) with ESMTP id 27ED48FC0C;
	Sun,  3 Aug 2008 17:11:19 +0000 (UTC) (envelope-from das@FreeBSD.ORG)
Received: from zim.MIT.EDU (localhost [127.0.0.1])
	by zim.MIT.EDU (8.14.2/8.14.2) with ESMTP id m73HBB6D069841;
	Sun, 3 Aug 2008 13:11:11 -0400 (EDT) (envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by zim.MIT.EDU (8.14.2/8.14.2/Submit) id m73HBB3F069840;
	Sun, 3 Aug 2008 13:11:11 -0400 (EDT) (envelope-from das@FreeBSD.ORG)
Date: Sun, 3 Aug 2008 13:11:11 -0400
From: David Schultz <das@FreeBSD.ORG>
To: Daniel Gerzo <danger@FreeBSD.ORG>, src-committers@FreeBSD.ORG,
	cvs-src@FreeBSD.ORG, cvs-all@FreeBSD.ORG
Message-ID: <20080803171111.GA69767@zim.MIT.EDU>
Mail-Followup-To: Daniel Gerzo <danger@FreeBSD.ORG>,
	src-committers@FreeBSD.ORG, cvs-src@FreeBSD.ORG,
	cvs-all@FreeBSD.ORG
References: <200807172000.m6HK0iIh018197@repoman.freebsd.org>
	<20080717202051.GA27450@zim.MIT.EDU>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20080717202051.GA27450@zim.MIT.EDU>
Cc: 
Subject: Re: cvs commit: src/etc rc.firewall
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Aug 2008 17:11:19 -0000

I don't think I ever heard anything back about this, and it still
doesn't look right. Do you agree?

On Thu, Jul 17, 2008, David Schultz wrote:
> On Thu, Jul 17, 2008, Daniel Gerzo wrote:
> > @@ -194,6 +194,7 @@
> >  	${fwcmd} add deny tcp from any to any setup
> >  
> >  	# Allow DNS queries out in the world
> > +	${fwcmd} add pass tcp from me to any 53 setup keep-state
> >  	${fwcmd} add pass udp from me to any 53 keep-state
> >  
> >  	# Allow NTP queries out in the world
> > @@ -294,6 +295,7 @@
> >  	${fwcmd} add pass tcp from any to any setup
> >  
> >  	# Allow DNS queries out in the world
> > +	${fwcmd} add pass tcp from ${oip} to any 53 setup keep-state
> >  	${fwcmd} add pass udp from ${oip} to any 53 keep-state
> >  
> >  	# Allow NTP queries out in the world
> 
> Hmm, it doesn't look like this could possibly work, unless I'm
> missing something. Did you test it?
> 
> In one case the rule you added comes after an 'add pass tcp from
> any to any setup', and in the other case it comes after an 'add
> deny tcp from any to any setup', so in both cases, the line you
> added should be ineffectual.
> 
> Furthermore, I don't believe there's any reason to use keep-state
> with TCP. The rule to allow packets for already-established
> connections suffices.