From owner-freebsd-current@FreeBSD.ORG  Thu Aug 28 08:39:59 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id CE98C16A4BF; Thu, 28 Aug 2003 08:39:59 -0700 (PDT)
Received: from fw.kraglund.net (0x50c40527.boanxx10.adsl-dhcp.tele.dk
	[80.196.5.39])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 3859A43F93; Thu, 28 Aug 2003 08:39:58 -0700 (PDT)
	(envelope-from fk@kraglund.net)
Received: from kraglund.net (accolon [192.168.42.2])
	by fw.kraglund.net (8.11.6/8.11.6) with ESMTP id h7SFduD21279;
	Thu, 28 Aug 2003 17:39:56 +0200 (CEST)
	(envelope-from fk@kraglund.net)
Message-ID: <3F4E224D.7CFE4BA9@kraglund.net>
Date: Thu, 28 Aug 2003 17:39:57 +0200
From: Flemming Kraglund <fk@kraglund.net>
X-Mailer: Mozilla 4.8 [en] (Win98; U)
X-Accept-Language: en
MIME-Version: 1.0
To: freebsd-stable@freebsd.org, freebsd-current@freebsd.org
References: <3F4E1D3F.219BBC7A@kraglund.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: Re: natd fw punch rule leak found (and fix)
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Aug 2003 15:39:59 -0000


Ups, there you go when not testing your last optimization, it is
required that a fw rule number is allocated for partial connections
so the fix is just:
in libalias/alias_db.c in PunchFWHole add the following after the
initial packetAliasMode test:
	ClearFWHole(link);

/FK