From owner-freebsd-security  Thu Jan 20 21:40:23 2000
Delivered-To: freebsd-security@freebsd.org
Received: from kot.ne.mediaone.net (kot.ne.mediaone.net [24.218.15.190])
	by hub.freebsd.org (Postfix) with ESMTP
	id C0F2F1547D; Thu, 20 Jan 2000 21:40:04 -0800 (PST)
	(envelope-from mi@kot.ne.mediaone.net)
Received: from rtfm.newton (mi@rtfm.newton [10.10.0.1])
	by kot.ne.mediaone.net (8.9.3/8.9.1) with ESMTP id AAA87473;
	Fri, 21 Jan 2000 00:31:11 -0500 (EST)
From: Mikhail Teterin <mi@kot.ne.mediaone.net>
X-Relay-IP: 10.10.0.1
Received: (from mi@localhost)
	by rtfm.newton (8.9.3/8.9.3) id AAA26807;
	Fri, 21 Jan 2000 00:31:11 -0500 (EST)
	(envelope-from mi@kot.ne.mediaone.net)
Message-Id: <200001210531.AAA26807@rtfm.newton>
Subject: Re: bugtraq posts: stream.c - new FreeBSD exploit?
In-Reply-To: <200001210421.PAA25285@cairo.anu.edu.au> from Darren Reed at "Jan
 21, 2000 03:21:35 pm"
To: Darren Reed <avalon@coombs.anu.edu.au>
Date: Fri, 21 Jan 2000 00:31:10 -0500 (EST)
Cc: Brett Glass <brett@lariat.org>, Warner Losh <imp@village.org>,
	jamiE rishaw - master e*tard <jamiE@arpa.com>,
	Tom <tom@uniserve.com>, Mike Tancsa <mike@sentex.net>,
	freebsd-security@FreeBSD.ORG, freebsd-stable@FreeBSD.ORG
X-Face: %UW#n0|w>ydeGt/b@1-.UFP=K^~-:0f#O:D7w<gv/&E-lL7twZCT8B~/PA4|\t$ti+22K">
	 hJ5G_<5143Bb3kOIs9XpX+"V+~$adGP:J|SLieM31VIhqXeLBli"<kcG^EOVih
	 y+z3/UR{6SCQ
X-Mailer: ELM [version 2.4ME+ PL60 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Darren Reed once stated:

=It isn't.  I said that for people who are using ipnat but not ipfilter.
=
=btw, I think the better way to write the 3 rules is:
=
=block in quick proto tcp from any to any head 100
=pass in quick proto tcp from any to any flags S keep state group 100
=pass in all

Can a similar rule be created for ipfw? Thanks!

	-mi


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message