Date: Tue, 6 May 1997 12:46:30 +1000 (EST) From: Darren Reed <avalon@coombs.anu.edu.au> To: archie@whistle.com (Archie Cobbs) Cc: avalon@coombs.anu.edu.au, archie@whistle.com, nnd@info.itfs.nsk.su, current@FreeBSD.ORG, hackers@FreeBSD.ORG Subject: Re: divert still broken? Message-ID: <199705060248.TAA08899@hub.freebsd.org> In-Reply-To: <199705060046.RAA10264@bubba.whistle.com> from "Archie Cobbs" at May 5, 97 05:46:38 pm
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Archie Cobbs, sie said: > > > > > - Allow rules to have the form: > > > > > > 1000 deny ip from any to any in via ed0 out via ed1 > > > > > > so you can filter routed packets by both incoming AND outgoing > > > interface. > > > > can you do this such that the route is only looked up once ? Can you > > be sure that the routing table won't change between the two lookups > > if you can't do it with one (es. on SMP systems) ? You could possibly > > solve this by only enabling this sort of filter on the outbound side > > of ed1. > > No routing table lookup necessary; the outbound interface is determined > already by the time ip_output() calls us. The inbound interface is kept > in the mbuf as m_rcvif. So what you're (including what you mentioned about changes in your other email) saying is that these packets can only be filtered out during the forwarding/outbound filtering ? > > > - When a reject rule applies to an incoming TCP packet, send > > > the appropriate TCP response packet (ie., RST) instead of an > > > ICMP port unreachable. > > > > I think you want to make this user configurable and perhaps on a per-rule > > basis. > > This is only with "reject" -- ie., right now it sends an ICMP unreachable. > There's still "deny" which silently drops. > > > This is otherwise a rather major change in the behaviour of ipfw and > > users may not agree with it (and they don't necessarily subscribe to > > any freebsd mailling list either). > > It will be backwards compatible... does that help? okay, i'm lost with the "backwards compatible". are you saying you'll use another word (instead of reject/deny), such as "reset" to indicate sending an RST rather than some other action ? Darren
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199705060248.TAA08899>