From owner-freebsd-security Sun Sep 3 1:44:58 2000 Delivered-To: freebsd-security@freebsd.org Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82]) by hub.freebsd.org (Postfix) with ESMTP id 8C9F037B424 for ; Sun, 3 Sep 2000 01:44:56 -0700 (PDT) Received: from 149.211.6.64.reflexcom.com ([64.6.211.149]) by mailhost01.reflexnet.net with Microsoft SMTPSVC(5.5.1877.197.19); Sun, 3 Sep 2000 01:43:51 -0700 Received: (from cjc@localhost) by 149.211.6.64.reflexcom.com (8.9.3/8.9.3) id BAA46286; Sun, 3 Sep 2000 01:44:53 -0700 (PDT) (envelope-from cjc) Date: Sun, 3 Sep 2000 01:44:53 -0700 From: "Crist J . Clark" To: Dragos Ruiu Cc: Bill Fumerola , Nicolas , freebsd-security@FreeBSD.ORG Subject: Re: ipfw and fragments Message-ID: <20000903014453.H62475@149.211.6.64.reflexcom.com> Reply-To: cjclark@alum.mit.edu References: <007a01c01457$3b9eff80$e4aa603e@gottt> <00090217534118.20066@smp.kyx.net> <20000903023759.O33771@jade.chc-chimes.com> <0009022351571F.20066@smp.kyx.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <0009022351571F.20066@smp.kyx.net>; from dr@kyx.net on Sat, Sep 02, 2000 at 11:47:29PM -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, Sep 02, 2000 at 11:47:29PM -0700, Dragos Ruiu wrote: > On Sat, 02 Sep 2000, Bill Fumerola wrote: > > On Sat, Sep 02, 2000 at 05:50:02PM -0700, Dragos Ruiu wrote: > > > > > > > Is there a way to make ipfw to reassemble fragmented ip packets before passing them through the rules? > > > > > > > > No. The relevant bits are only in the first packet. > > > > > > > It could be made to reassemble them, > > > but it would incurr a performance hit. > > > > What do you gain? Nothing that I can think that ipfw currently > > tests for is in the non-initial fragment. > > > > Correct me if I'm wrong because I havent looked at the ipfw source, > but fragment's dont get passed. There are some applications that > like to send big packets (I have a video streaming system for instance > that sends up to 64K UDP datagrams) that will always get fragmented. > If I wanted to send such packets unmolested through ipfw it > would have to "reassemble" them as it were so that once the first > fragment got through the subsequent ones could follow too. > > Or am I missing something here in what you're trying to do? To pass all fragments, # ipfw add pass ip from any to any frag Or you can add specific protocols, source, destination, interface, etc. If you do not add a rule like that, your fragments will generally fall through to the last rule which should be a default deny. Some points from ipfw(8) to remember, Fragmented packets which have a non-zero offset (i.e. not the first fragment) will never match a rule which has one or more port specifications. See the frag option for details on matching fragmented packets. frag Match if the packet is a fragment and this is not the first fragment of the datagram. frag may not be used in conjunction with either tcpflags or TCP/UDP port specifi- cations. There is one kind of packet that the firewall will always discard, that is an IP fragment with a fragment offset of one. This is a valid packet, but it only has one use, to try to circumvent firewalls. Incoming packet fragments diverted by divert or tee are reassembled be- fore delivery to the socket. Reassembling packets in general is only really needed for an application-layer level firewall, which ipfw is not. But as that last point eludes, that kind of blury once you NAT. -- Crist J. Clark cjclark@alum.mit.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message