From owner-freebsd-stable@FreeBSD.ORG Sat Mar 17 06:59:06 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 03FCD16A400 for ; Sat, 17 Mar 2007 06:59:05 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from mx.isc.org (mx.isc.org [204.152.184.167]) by mx1.freebsd.org (Postfix) with ESMTP id ACF8813C44C for ; Sat, 17 Mar 2007 06:59:05 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from farside.isc.org (farside.isc.org [IPv6:2001:4f8:3:bb::5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "farside.isc.org", Issuer "ISC CA" (verified OK)) by mx.isc.org (Postfix) with ESMTP id 8F6DF114028 for ; Sat, 17 Mar 2007 06:59:05 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from drugs.dv.isc.org (localhost.isc.org [IPv6:::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (verified OK)) by farside.isc.org (Postfix) with ESMTP id DD430E60D9 for ; Sat, 17 Mar 2007 06:59:04 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.13.8/8.13.8) with ESMTP id l2H6wjTD098761; Sat, 17 Mar 2007 17:58:51 +1100 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200703170658.l2H6wjTD098761@drugs.dv.isc.org> To: JoaoBR , freebsd-stable@freebsd.org From: Mark Andrews Mail-Followup-To: JoaoBR , freebsd-stable@freebsd.org In-reply-to: Your message of "Fri, 16 Mar 2007 17:28:16 PDT." <20070317002816.GA40565@icarus.home.lan> Date: Sat, 17 Mar 2007 17:58:45 +1100 Sender: Mark_Andrews@isc.org Cc: Subject: Re: rc.order wrong (ipfw) X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Mar 2007 06:59:06 -0000 > On Fri, Mar 16, 2007 at 08:33:01PM -0300, JoaoBR wrote: > > On Friday 16 March 2007 18:50, Jeremy Chadwick wrote: > > > Okay, imagine this order: > > > > > > 1) Kernel starts > > > 2) Network driver is loaded > > > 3) Link is brought up > > > 4) Interface is configured for IP (manually or via DHCP) > > > 5) Firewall rules (ipfw or pf) are applied > > > > > > Do you realise that between steps #4 and steps #5 there is a small > > > window of time where someone may be able to send packets to your machine > > > and get responses which would normally be blocked by ipfw/pf? > > > > nono that is not exactly how it works > > > > unless you change ipfw's default behaviour which is deny all from any to an > y, > > nothing goes to this machine because by default everything is blocked until > > > you permit it > > You're absolutely correct, however your original post seems to have > taken many of us by surprise, causing some of us (at least me!) to > assume that you've changed the default method to allow. I'm obviously > misunderstanding, so I apologise for that, but I hope you can see the > reasoning behind my comments with what I knew at the time. :) ipfw needs to be before networking or router discovery fails for IPv6. http://www.freebsd.org/cgi/query-pr.cgi?pr=conf/108589 > -- > | Jeremy Chadwick jdc at parodius.com | > | Parodius Networking http://www.parodius.com/ | > | UNIX Systems Administrator Mountain View, CA, USA | > | Making life hard for others since 1977. PGP: 4BD6C0CB | > > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org