From owner-freebsd-arch Mon Nov 29 4:59:44 1999 Delivered-To: freebsd-arch@freebsd.org Received: from ns1.yes.no (ns1.yes.no [195.204.136.10]) by hub.freebsd.org (Postfix) with ESMTP id AB4F1154C1 for ; Mon, 29 Nov 1999 04:59:42 -0800 (PST) (envelope-from eivind@bitbox.follo.net) Received: from bitbox.follo.net (bitbox.follo.net [195.204.143.218]) by ns1.yes.no (8.9.3/8.9.3) with ESMTP id NAA17146 for ; Mon, 29 Nov 1999 13:59:39 +0100 (CET) Received: (from eivind@localhost) by bitbox.follo.net (8.8.8/8.8.6) id NAA63373 for freebsd-arch@freebsd.org; Mon, 29 Nov 1999 13:59:38 +0100 (MET) Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by hub.freebsd.org (Postfix) with ESMTP id 5E46114E40; Mon, 29 Nov 1999 04:59:29 -0800 (PST) (envelope-from des@flood.ping.uio.no) Received: (from des@localhost) by flood.ping.uio.no (8.9.3/8.9.3) id NAA95132; Mon, 29 Nov 1999 13:59:05 +0100 (CET) (envelope-from des) To: Tony Landells Cc: hackers@freebsd.org Subject: Re: new IPFW References: <199911242152.IAA26077@tungsten.austclear.com.au> From: Dag-Erling Smorgrav Date: 29 Nov 1999 13:59:05 +0100 In-Reply-To: Tony Landells's message of "Thu, 25 Nov 1999 08:52:28 +1100" Message-ID: Lines: 36 User-Agent: Gnus/5.070097 (Pterodactyl Gnus v0.97) Emacs/20.4 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG [moving from -ipfw and -arch to -hackers] Tony Landells writes: > One concern I would have with that is that there are a lot of tools > built on BPF that I would prefer to not be able to run on the firewall. Don't confuse BPF with promiscuous mode. BPF is simply a programmable packet filter and does not in and of itself represent a security risk. Promiscuous mode allows a host to capture packets not destined to itself, and may represent a security risk on shared media networks (e.g. 10Base2, unswitched 10BaseT). The attached patch prevents switching into promiscuous mode when running in "Network secure mode" (securelevel 3 or higher). DES -- Dag-Erling Smorgrav - des@flood.ping.uio.no Index: if.c =================================================================== RCS file: /home/ncvs/src/sys/net/if.c,v retrieving revision 1.77 diff -u -r1.77 if.c --- if.c 1999/11/22 02:44:51 1.77 +++ if.c 1999/11/29 12:52:07 @@ -908,6 +908,8 @@ int error; if (pswitch) { + if (securelevel >= 3) + return (EPERM); /* * If the device is not configured up, we cannot put it in * promiscuous mode. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message