From owner-freebsd-stable  Mon Feb  4  6:34:59 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from smtp1.sentex.ca (smtp1.sentex.ca [199.212.134.4])
	by hub.freebsd.org (Postfix) with ESMTP
	id AB09037B427; Mon,  4 Feb 2002 06:34:47 -0800 (PST)
Received: from simoeon.sentex.net (pyroxene.sentex.ca [199.212.134.18])
	by smtp1.sentex.ca (8.11.6/8.11.6) with ESMTP id g14EYhV41002;
	Mon, 4 Feb 2002 09:34:43 -0500 (EST)
	(envelope-from mike@sentex.net)
Message-Id: <5.1.0.14.0.20020204092437.050e66e0@marble.sentex.ca>
X-Sender: mdtpop@marble.sentex.ca
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Mon, 04 Feb 2002 09:29:08 -0500
To: "Jacques A. Vidrine" <n@nectar.cc>,
	Ruslan Ermilov <ru@FreeBSD.ORG>
From: Mike Tancsa <mike@sentex.net>
Subject: Re: dropping 127.* on the floor
Cc: stable@FreeBSD.ORG, Warner Losh <imp@FreeBSD.ORG>
In-Reply-To: <20020204141227.GB23733@madman.nectar.cc>
References: <20020204152519.B58535@sunbay.com>
 <3C5DE578.4020409@gmx.net>
 <20020203152433.A5932-100000@voyager.straynet.com>
 <3C5DE578.4020409@gmx.net>
 <5.1.0.14.0.20020204080228.022ab9c0@192.168.0.12>
 <20020204152519.B58535@sunbay.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

At 08:12 AM 2/4/02 -0600, Jacques A. Vidrine wrote:

>See the Bugtraq archives for the thread starting with Message-ID:
><3AA3ECAB.EA826D28@thebunker.net>, subject ``Loopback and multi-homed
>routing flaw in TCP/IP stack.'' for the reasons behind this change.
>The following URL might work.
>
><URL:http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=3AA3ECAB.EA826D28@thebunker.net>

What if this were dealt as part of firewall rules ?  i.e. GENERIC was built 
by default with IPFIREWALL and firewall_enable="YES" and 
firewall_type="OPEN" were set. That way the behavior that people have come 
to rely on is still there for those that need it.

I have not tested this yet with my production transparent proxies but I 
will try so later today to see if the behavior is broken as a number of 
people have reported.

         ---Mike


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message