Date: Sun, 15 Mar 2009 11:02:06 +0100 From: Luigi Rizzo <rizzo@iet.unipi.it> To: Sergey Matveychuk <sem@freebsd.org> Cc: freebsd-ipfw@freebsd.org, Dmitriy Demidov <dima_bsd@inbox.lv> Subject: Re: keep-state rules inadequately handles big UDP packets or fragmented IP packets? Message-ID: <20090315100206.GA63505@onelab2.iet.unipi.it> In-Reply-To: <49BCCC9D.30109@FreeBSD.org> References: <200903132246.49159.dima_bsd@inbox.lv> <49BBB94A.7040208@FreeBSD.org> <200903142031.53326.dima_bsd@inbox.lv> <49BCCC9D.30109@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Mar 15, 2009 at 12:38:37PM +0300, Sergey Matveychuk wrote: > Dmitriy Demidov wrote: > >Hi Luigi. Thank you for answer. > >It is a big "surprise" for me that reassembling of IP datagrams is done > >not *before* they go into firewall, but *after* :( > > But what's wrong with it? A fragment got from net, pass firewall and > store. After all fragments we got, OS reassembly a packet and pass it > through firewall again. Currently we don't have a way to re-invoke the firewall after reassembly. In fact, we should probably provide hooks before and after reassembly, and use them in a configurable way. cheers luigi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090315100206.GA63505>