From - Thu Feb 14 08:43:52 2002 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: kudzu@tenebras.com Received: (qmail 27186 invoked from network); 14 Feb 2002 16:43:34 -0000 Received: from n170.usww.net (216.104.145.170) by 0 with SMTP; 14 Feb 2002 16:43:34 -0000 Received: (from daemon@localhost) by n170.usww.net (8.11.6/8.11.6) id g1EGlLJ18034 for kudzu@tenebras.com; Thu, 14 Feb 2002 11:47:21 -0500 (EST) (envelope-from daemon) X-info0: (Date:Thu, 14 Feb 2002 11:47:21 -0500 (EST))(Date:Thu, 14 Feb 2002 11:47:21 -0500 (EST))(unk:0) X-info1: (Date:Thu Feb 14 11:47:21 2002)(Unk:) X-info2: (Ret:daemon)(Ret:daemon)(DestHost:tenebras.com.)(CID:g1EGlLJ18034) X-info3: (Loc:n170.usww.net)(Loc:n170.usww.net)(Unk:)(FQDN:usww.net)(MAILDA:MAILER-DAEMON)(Unk:) X-info4: (PID:18034)(Unk:)(E-SMTP:)(FromH:)(Date:200202141647) X-info5: (To:kudzu@tenebras.com)(Ver:8.11.6)(Host:n170)(LclUser:Owner of many system processes)(Unk::) X-info6: (Unk:)(CD:)(CD:)(Unk:)(Unk:)(CD:) X-info7: (CD:)(Frm:daemon@localhost)(CD:)(CD:)(CD:) Date: Thu, 14 Feb 2002 11:47:21 -0500 (EST) Message-Id: <200202141647.g1EGlLJ18034@n170.usww.net> X-Accept-Language: en X-Responder: Auto response X-Responder: Autoresponder X-Responder: Do not reply MIME-Version: 1.0 From: freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG (freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Auto Responder) Reply-To: freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG To: kudzu@tenebras.com Subject: Re: Bug in stateful code? Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit
Thank you for your Email
kudzu@tenebras.com,
Your message concerning "Bug in stateful code?" was received. We will attend to it as soon as possible.

Thank you,
freebsd-ipfw@FreeBSD.ORG, freebsd-net@FreeBSD.ORG

Looking for a low cost shopping cart with point of sale inventory control. We have it! Just added you can now accept all major Credit Cards and PayPal. Easy interfacing to your website. Check us out. Total shopping cart system http://dollar-saver.net

Tired of paying everyone else for a shopping cart? Start your own Shopping Mall with Mall City Your per store cost is less than $2.50. Accepts all major credit cards, PayPal and Ibill.

Be sure to visit the links below for free programs and information
Web sites, Racks Space, Colo Servers
Many things of interest
Search Engine. Add your URL Free
Free Banner Exchange 468x60.
Quick Business web site. 1 Minute setup
Quick Personal web site. 1 Minute setup
Free Classified Advertising
Another Free Banner Exchange 400x40.
Another Free Banner Exchange, classified and search.


If you are concerned about viruses click here
This system is protected by the USWW Server Side Virus scanner and auto responder. Protecting you before you know you need protection. 



 ---First 50 lines of original message included below----


 
 I've sent this to Luigi and a couple of other folks without reply,
 so here it is.
 
 I'm seeing what I believe to be a bug in the stateful filter code
 for ipfw/ip_fw.  Here's my original message:
 
 =============================================================================
 
 Running ipfw w/natd,  connections through the gateway are dying.  Two dynamic
 rules get instantiated for each connection through the gateway -- one
 with NAT'd addresses and one revealing the private addresses
 
 $on = external net = X.Y.Z/24
 $in = internal net = A.B.C/24  (192.168.1.0/24)
 
 the external IP is X.Y.Z.23
 the internal IP is A.B.C.1
 
 firewall rules:
 
 [some static rules...]
 
 $fw add divert natd ip from any to any via $external_interface
 
 $fw add check-state
 
 $fw add allow tcp from $in to any setup keep-state
 $fw add allow udp from $in to any keep-state
 
 $fw add allow tcp from $on to any setup keep-state
 $fw add allow udp from $on to any keep-state
 
 
 An ssh connection from A.B.C.4 to X.Y.Z.44 causes the following dynamic rules
 to appear:
 
 
 02400 15 3197 (T 16, slot 760) <-> tcp, X.Y.Z.23 1549<-> X.Y.Z.44 22
 02200 45 9151 (T 296, slot 913) <-> tcp, A.B.C.4 1549<-> X.Y.Z.44 22
 
 Note 02400 -- this connection timer seems to indicate that it is waiting for
 a completed 3-way handshake and hasn't seen the other SYN.  The connection dies
 because the time counts down.  The timer for 02200 doesn't count down because
 the keep-alives are resetting it.
 
 Any insight as to why this is happening?  Seems like a bug in the state machine.
 I could be convinced otherwise, but it seems that these two rules should
 see the connection as being in the same state -- they both see the same
--------------090801060102070203000908-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message