From owner-freebsd-questions Sat Feb 15 2:40:34 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C460D37B401 for ; Sat, 15 Feb 2003 02:40:32 -0800 (PST) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id BC69E43F93 for ; Sat, 15 Feb 2003 02:40:30 -0800 (PST) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) by smtp.infracaninophile.co.uk (8.12.6/8.12.6) with ESMTP id h1FAeOnh069487 for ; Sat, 15 Feb 2003 10:40:24 GMT (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost) by happy-idiot-talk.infracaninophile.co.uk (8.12.6/8.12.6/Submit) id h1FAeOsE069486 for freebsd-questions@FreeBSD.ORG; Sat, 15 Feb 2003 10:40:24 GMT Date: Sat, 15 Feb 2003 10:40:24 +0000 From: Matthew Seaman To: Freebsd-Questions Subject: Re: using Dummynet to rate limit ftp Message-ID: <20030215104024.GB68671@happy-idiot-talk.infracaninophi> Mail-Followup-To: Matthew Seaman , Freebsd-Questions References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.3i X-Spam-Status: No, hits=-2.5 required=5.0 tests=IN_REP_TO,REFERENCES,SPAM_PHRASE_02_03, TO_LOCALPART_EQ_REAL,USER_AGENT,USER_AGENT_MUTT version=2.44 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Feb 15, 2003 at 08:24:58AM +0800, Paul Hamilton wrote: > I have played around with dummynet a bit. Very nice! However, it would be > nice to be able to rate limit ftp. The control channel port 21 is easy, and > not really necessary to rate limit it, but as fas as I can see there would > be no way to rate limit the data channel, as it could be different every > time, even in passive mode. > > Am I missing something? No, you are entirely correct. In order to properly filter (or for that matter, rate limit) FTP and some other annoying protocols like IRC DCC or Microsoft Media Streaming, you need to have a firewall that understands at least part of the protocol, so that it can discover what ports are being used for supplementary channels. Or in other words, the firewall has to start parsing the payload of packets, rather than just the headers. Now, that sounds quite reasonable, but it's really quite a minefield. Consider that the TCP stream could be fragmented --- unlikely in normal usage, but something a potential attacker might try --- or that an attacker might be able to persuade your firewall to open up access to ports or addresses it really shouldn't by sending a cunningly modified FTP control exchange. Combine that with the requirement that the firewall works speedily and efficiently, and you can see that implementing such a system is by no means trivial. As far as I know, the only software available to do protocol aware filtering with the native FreeBSD firewalls is natd(8), with it's '-punch_fw' option. (That also appears as the 'nat punch_fw' command built into ppp(8), but it's the same code really). Unfortunately that doesn't help with your requirement to rate limit traffic on the punched connection. Now, there are some commercial firewalls that provide this sort of functionality: Checkpoint FW-1 does, and you could feed your FreeBSD habit by running it on one of those Nokia appliances based on FreeBSD 3.2... Having a natd-like process that can hang off a divert socket, interpret the FTP (or other) protocol traffic passed to it and open up dynamic rules in ipfw(8) to permit traffic through the data channel or push the data traffic through a dummynet rate limiter would be exceedingly cool. If only I had both the time and the talent to implement such a thing. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message