Date: Thu, 5 Nov 1998 07:07:13 -0500 (EST) From: Open Systems Networking <opsys@mail.webspan.net> To: Andrew McNaughton <andrew@squiz.co.nz> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Amazing wonder packet Part 2. Message-ID: <Pine.BSF.4.02.9811050701390.26130-100000@orion.webspan.net> In-Reply-To: <Pine.BSF.4.01.9811060031140.17028-100000@aniwa.sky>
next in thread | previous in thread | raw e-mail | index | archive | help
Ok its late. I re-read the post about this and now I grawk the whole point
behind the comment:
"However, if you have your ipfw lines not in the rule order, then some
allows might be installed in the list of rules *before* the denies that
precede them. In this situation, the race condition would allow a packet
in that should not have been allowed in."
The fix was inteded for this. And thats exactly what it fixes.
I think I can goto bed now.
Chris
--
"You both seem to be ignoring the fact that the networking market is
driven by so-called 'IT professionals' these days, most of whom can't
tell the difference between an ARP and a carp." --Wes Peters
===================================| Open Systems FreeBSD Consulting.
FreeBSD 3.0 is available now! | Phone: (402)573-9124 / ICQ # 20016186
-----------------------------------| 3335 N. 103 Plaza, Omaha, NE 68134
FreeBSD: The power to serve! | E-Mail: opsys@open-systems.net
http://www.freebsd.org | Consulting, Network Engineering, Security
===================================| http://open-systems.net
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.02.9811050701390.26130-100000>