Date: Wed, 29 Jul 2015 15:39:39 +0800 From: Julian Elischer <julian@freebsd.org> To: freebsd-ipfw@freebsd.org Subject: Re: keep-state and in-kernel NAT exposes local ip on external interface Message-ID: <55B8833B.3030205@freebsd.org> In-Reply-To: <55B7DB52.7010504@FreeBSD.org> References: <1435692039.18121.12.camel@yahoo.com> <5594395D.6050103@FreeBSD.org> <20150728150845.V17327@sola.nimnet.asn.au> <55B7DB52.7010504@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 7/29/15 3:43 AM, Lev Serebryakov wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 28.07.2015 08:30, Ian Smith wrote:
>
> I have global lack of any spare time (and all my FreeBSD activity is
> only a hobby) for last ~2 months. I see the end of this unfortunate
> state of affairs in near future and I remember about these examples.
>
>>
there are some simple examples of things this patch addresses..
For example in the current code, the following (extemely simplified)
set of
rules will not do what you would think when you are working with a tcp
session from A to B and another from C to D *which has previously been**
**accepted with a keep-state at some other point in the ruleset*
10 {any action} from A to B keep-state
20 {any action} tcp from C to D
because despite the fact that you are only triggering on a 'setup'
packet for A to B, any rule
that includes "keep-state" does a "check-state" implicitly.
so the packet from C to D never gets past rule 10.
the only way you can do this is to prefix rule 10 by something like
5 skipto 10 from A to B
6 skipto 11 from any to any
to make sure packets that are not A to B do not hit the hidden
'check-state' .
this is a very simple example and yes there are ways to get around it,
but it complicates the ruleset and increases errors
that reminds me I'd also like to be able to put a "not" at the
front of the rule matching to negate the whole test but it doesn't
seem to like that.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55B8833B.3030205>