From owner-freebsd-net@FreeBSD.ORG  Thu May 13 01:37:17 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id E144316A4CE; Thu, 13 May 2004 01:37:17 -0700 (PDT)
Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id B3FF443D45; Thu, 13 May 2004 01:37:17 -0700 (PDT)
	(envelope-from rizzo@icir.org)
Received: from xorpc.icir.org (localhost [127.0.0.1])
	by xorpc.icir.org (8.12.9p1/8.12.8) with ESMTP id i4D8bHgd016823;
	Thu, 13 May 2004 01:37:17 -0700 (PDT)
	(envelope-from rizzo@xorpc.icir.org)
Received: (from rizzo@localhost)
	by xorpc.icir.org (8.12.9p1/8.12.3/Submit) id i4D8bHqH016822;
	Thu, 13 May 2004 01:37:17 -0700 (PDT)
	(envelope-from rizzo)
Date: Thu, 13 May 2004 01:37:17 -0700
From: Luigi Rizzo <rizzo@icir.org>
To: Eugene Grosbein <eugen@kuzbass.ru>
Message-ID: <20040513013717.A16394@xorpc.icir.org>
References: <40A3393F.1391943E@kuzbass.ru>
	<20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <40A34082.F0182B31@kuzbass.ru>;
	from eugen@kuzbass.ru on Thu, May 13, 2004 at 05:31:46PM +0800
cc: ipfw@freebsd.org
cc: net@freebsd.org
Subject: Re: ipfw: reset tcp
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 May 2004 08:37:18 -0000

On Thu, May 13, 2004 at 05:31:46PM +0800, Eugene Grosbein wrote:
> Luigi Rizzo wrote:
> 
> > > When a rule 'reset tcp' matches, a kernel generates new TCP packet.
> > > Will it have to go through ipfw list (from the beginning or not)?
> > 
> > ipfw2 uses an mbuf flag to bypass the firewall - I am not sure if i
> > only used it for the keepalives or also for TCP reset packets
> 
> Please check. I suspect it does not enter ipfw itself,

yes it does skip the firewall, see ip_fw2.c:send_pkt() near the
end:

	ip_rtaddr(ip->ip_dst, &sro);
--->    m->m_flags |= M_SKIP_FIREWALL;
        ip_output(m, NULL, &sro, 0, NULL, NULL);

removing the M_SKIP_FIREWALL would let ipfw process the
packet too. HOWEVER: i think it is a bug in the general case
to reprocess internally-generated packet, because you would rely
on a correct ipfw configuration to avoid loops (which might not
be the case).

I have no idea how ipfw1 used to do (and i am not goin to check!)
but i don't think the generated packet did reenter the firewall.

cheers
luigi

> it is not processed by my natd and bad things happen here.
> 
> Eugene