From owner-freebsd-questions Thu Feb 14 8:49:42 2002 Delivered-To: freebsd-questions@freebsd.org Received: from laptop.tenebras.com (laptop.tenebras.com [66.92.188.18]) by hub.freebsd.org (Postfix) with SMTP id 7097337B41B for ; Thu, 14 Feb 2002 08:49:30 -0800 (PST) Received: (qmail 27244 invoked from network); 14 Feb 2002 16:49:24 -0000 Received: from sapphire.tenebras.com (HELO tenebras.com) (66.92.188.241) by 0 with SMTP; 14 Feb 2002 16:49:24 -0000 Message-ID: <3C6BEA94.6090205@tenebras.com> Date: Thu, 14 Feb 2002 08:49:24 -0800 From: Michael Sierchio User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.7) Gecko/20020131 X-Accept-Language: en-us MIME-Version: 1.0 To: abuse@freebsd.org, questions@freebsd.org Subject: [Fwd: Re: Bug in stateful code?] Content-Type: multipart/mixed; boundary="------------090801060102070203000908" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG This is a multi-part message in MIME format. --------------090801060102070203000908 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit I got this from an autoresponder subscribed to one of the two lists I sent this to. Ack! From - Thu Feb 14 08:43:52 2002 X-UIDL: 1013705015.27188.laptop.tenebras.com X-Mozilla-Status: 0011 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: kudzu@tenebras.com Received: (qmail 27186 invoked from network); 14 Feb 2002 16:43:34 -0000 Received: from n170.usww.net (216.104.145.170) by 0 with SMTP; 14 Feb 2002 16:43:34 -0000 Received: (from daemon@localhost) by n170.usww.net (8.11.6/8.11.6) id g1EGlLJ18034 for kudzu@tenebras.com; Thu, 14 Feb 2002 11:47:21 -0500 (EST) (envelope-from daemon) X-info0: (Date:Thu, 14 Feb 2002 11:47:21 -0500 (EST))(Date:Thu, 14 Feb 2002 11:47:21 -0500 (EST))(unk:0) X-info1: (Date:Thu Feb 14 11:47:21 2002)(Unk:) X-info2: (Ret:daemon)(Ret:daemon)(DestHost:tenebras.com.)(CID:g1EGlLJ18034) X-info3: (Loc:n170.usww.net)(Loc:n170.usww.net)(Unk:)(FQDN:usww.net)(MAILDA:MAILER-DAEMON)(Unk:) X-info4: (PID:18034)(Unk:)(E-SMTP:)(FromH:)(Date:200202141647) X-info5: (To:kudzu@tenebras.com)(Ver:8.11.6)(Host:n170)(LclUser:Owner of many system processes)(Unk::) X-info6: (Unk:)(CD:--)(CD:-)(Unk:)(Unk:)(CD:,) X-info7: (CD:?)(Frm:daemon@localhost)(CD:')(CD:')(CD:") Date: Thu, 14 Feb 2002 11:47:21 -0500 (EST) Message-Id: <200202141647.g1EGlLJ18034@n170.usww.net> X-Accept-Language: en X-Responder: Auto response X-Responder: Autoresponder X-Responder: Do not reply MIME-Version: 1.0 From: freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG (freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Auto Responder) Reply-To: freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG To: kudzu@tenebras.com Subject: Re: Bug in stateful code? Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit
Thank you for your Email
kudzu@tenebras.com,
Your message concerning "Bug in stateful code?" was received. We will attend to it as soon as possible.

Thank you,
freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG

Looking for a low cost shopping cart with point of sale inventory control. We have it! Just added you can now accept all major Credit Cards and PayPal. Easy interfacing to your website. Check us out. Total shopping cart system http://dollar-saver.net

Tired of paying everyone else for a shopping cart? Start your own Shopping Mall with Mall City Your per store cost is less than $2.50. Accepts all major credit cards, PayPal and Ibill.

Be sure to visit the links below for free programs and information
Web sites, Racks Space, Colo Servers
Many things of interest
Search Engine. Add your URL Free
Free Banner Exchange 468x60.
Quick Business web site. 1 Minute setup
Quick Personal web site. 1 Minute setup
Free Classified Advertising
Another Free Banner Exchange 400x40.
Another Free Banner Exchange, classified and search.


If you are concerned about viruses click here
This system is protected by the USWW Server Side Virus scanner and auto responder. Protecting you before you know you need protection. 



---First 50 lines of original message included below----



  I've sent this to Luigi and a couple of other folks without reply,
  so here it is.

  I'm seeing what I believe to be a bug in the stateful filter code
  for ipfw/ip_fw.  Here's my original message:

  =============================================================================

  Running ipfw w/natd,  connections through the gateway are dying.  Two dynamic
  rules get instantiated for each connection through the gateway -- one
  with NAT'd addresses and one revealing the private addresses

  $on = external net = X.Y.Z/24
  $in = internal net = A.B.C/24  (192.168.1.0/24)

  the external IP is X.Y.Z.23
  the internal IP is A.B.C.1

  firewall rules:

  [some static rules...]

  $fw add divert natd ip from any to any via $external_interface

  $fw add check-state

  $fw add allow tcp from $in to any setup keep-state
  $fw add allow udp from $in to any keep-state

  $fw add allow tcp from $on to any setup keep-state
  $fw add allow udp from $on to any keep-state


  An ssh connection from A.B.C.4 to X.Y.Z.44 causes the following dynamic rules
  to appear:


  02400 15 3197 (T 16, slot 760) <-> tcp, X.Y.Z.23 1549<-> X.Y.Z.44 22
  02200 45 9151 (T 296, slot 913) <-> tcp, A.B.C.4 1549<-> X.Y.Z.44 22

  Note 02400 -- this connection timer seems to indicate that it is waiting for
  a completed 3-way handshake and hasn't seen the other SYN.  The connection dies
  because the time counts down.  The timer for 02200 doesn't count down because
  the keep-alives are resetting it.

  Any insight as to why this is happening?  Seems like a bug in the state machine.
  I could be convinced otherwise, but it seems that these two rules should
  see the connection as being in the same state -- they both see the same
--------------090801060102070203000908 Content-Type: message/rfc822; name="Re: Bug in stateful code?" Content-Transfer-Encoding: 8bit Content-Disposition: inline; filename="Re: Bug in stateful code?"