From owner-freebsd-ipfw Fri Apr 26 3:34:13 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from gs166.sp.cs.cmu.edu (GS166.SP.CS.CMU.EDU [128.2.205.169]) by hub.freebsd.org (Postfix) with SMTP id 523C137B416; Fri, 26 Apr 2002 03:34:09 -0700 (PDT) To: "Crist J. Clark" Cc: Gregory Neil Shapiro , "Rex A. Roof" , freebsd-ipfw@FreeBSD.ORG Subject: Re: Putting in place an incoming sendmail limit References: <200204252052.g3PKqrj0090391@gunjin.wccnet.org> <15560.29198.657946.738003@horsey.gshapiro.net> <20020425232444.B34367@blossom.cjclark.org> From: Dan Pelleg Date: 26 Apr 2002 06:33:28 -0400 In-Reply-To: <20020425232444.B34367@blossom.cjclark.org> Message-ID: Lines: 35 User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.1 (Cuyahoga Valley) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG "Crist J. Clark" writes: > On Thu, Apr 25, 2002 at 02:15:58PM -0700, Gregory Neil Shapiro wrote: > > rex> In order to prevent incoming DoS attacks via multiple sendmail > > rex> connections, I've tried adding the following ipfw rule: > > > > rex> allow tcp from any to any smtp limit src-addr 1 > > > > rex> This works great, except that when it's triggered I get A LOT > > rex> of messages like this: > > > > rex> OUCH! cannot remove rule, count 1 > > rex> drop session, too many entries > > > > Perhaps it is because that rule matches every packet into of just the TCP > > setup packet. You might try using the 'setup' keyword. (Just a guess). > > That's probably not the problem. Remember 'limit' rules are dynamic > rules. > > What version of FreeBSD are you running? I believe the 'OUCH!' is > luigi's way of saying that you shouldn't be seeing that error. It > indicates an internal error. It is, and it's been discussed on this mailing list before. I have a patch for this, which I've discussed with luigi in the past. For some reason, I never heard back from him after posting it. This way or the other, it's here if you want to apply it yourself: http://www.freebsd.org/cgi/query-pr.cgi?pr=32600 -- Dan Pelleg To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message