From owner-freebsd-net@FreeBSD.ORG  Thu May 13 06:55:44 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 4667C16A4CE; Thu, 13 May 2004 06:55:44 -0700 (PDT)
Received: from grosbein.pp.ru (grgw.svzserv.kemerovo.su [213.184.64.130])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 5781643D55; Thu, 13 May 2004 06:55:42 -0700 (PDT)
	(envelope-from eugen@grosbein.pp.ru)
Received: from grosbein.pp.ru (eugen@localhost [127.0.0.1])
	by grosbein.pp.ru (8.12.11/8.12.11) with ESMTP id i4DDtdZh013245;
	Thu, 13 May 2004 21:55:39 +0800 (KRAST)
	(envelope-from eugen@grosbein.pp.ru)
Received: (from eugen@localhost)
	by grosbein.pp.ru (8.12.11/8.12.11/Submit) id i4DDtdsT013244;
	Thu, 13 May 2004 21:55:39 +0800 (KRAST)
	(envelope-from eugen)
Date: Thu, 13 May 2004 21:55:39 +0800
From: Eugene Grosbein <eugen@grosbein.pp.ru>
To: Luigi Rizzo <rizzo@icir.org>
Message-ID: <20040513135539.GA13211@grosbein.pp.ru>
References: <40A3393F.1391943E@kuzbass.ru>
	<20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
	<20040513013717.A16394@xorpc.icir.org> <40A345F9.1460F5C4@kuzbass.ru>
	<20040513064856.B42908@xorpc.icir.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20040513064856.B42908@xorpc.icir.org>
User-Agent: Mutt/1.4.1i
cc: ipfw@freebsd.org
cc: net@freebsd.org
Subject: Re: ipfw: reset tcp
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 May 2004 13:55:44 -0000

On Thu, May 13, 2004 at 06:48:56AM -0700, Luigi Rizzo wrote:

> 2.- all other firewall-generated TCP packets (rst and keepalives)
>   go through send_pkt() and then bypass the firewall.
>   The only way we could safely go through the firewall again is
>   to make sure that we never send a RST in response to a RST (need
>   to add an additional check in O_REJECT).
> 
> Give me a few days (i.e. ping me again on monday!) to come up with
> a safe patch to do this, which does not rely on the programmer to
> DTRT and avoid loops.

Thanks a lot!

Eugene