From owner-freebsd-questions@FreeBSD.ORG Mon Oct 6 14:03:08 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 23C9E1065690 for ; Mon, 6 Oct 2008 14:03:08 +0000 (UTC) (envelope-from keramida@freebsd.org) Received: from igloo.linux.gr (igloo.linux.gr [62.1.205.36]) by mx1.freebsd.org (Postfix) with ESMTP id 8475E8FC1C for ; Mon, 6 Oct 2008 14:03:07 +0000 (UTC) (envelope-from keramida@freebsd.org) Received: from kobe.laptop (adsl57-177.kln.forthnet.gr [77.49.184.177]) (authenticated bits=128) by igloo.linux.gr (8.14.3/8.14.3/Debian-5) with ESMTP id m96E2jp9013049 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 6 Oct 2008 17:02:51 +0300 Received: from kobe.laptop (kobe.laptop [127.0.0.1]) by kobe.laptop (8.14.3/8.14.3) with ESMTP id m96E2jSl044156; Mon, 6 Oct 2008 17:02:45 +0300 (EEST) (envelope-from keramida@freebsd.org) Received: (from keramida@localhost) by kobe.laptop (8.14.3/8.14.3/Submit) id m96E2jvE044155; Mon, 6 Oct 2008 17:02:45 +0300 (EEST) (envelope-from keramida@freebsd.org) From: Giorgos Keramidas To: "James Seward" References: <200810051753.m95Hr3N5014872@mp.cs.niu.edu> <20081006003601.GA5733@icarus.home.lan> <48E9BBED.7090607@infracaninophile.co.uk> <20081006072611.GA13147@icarus.home.lan> <871vyuj6ul.fsf@kobe.laptop> <20081006115101.GA19442@icarus.home.lan> <720051dc0810060644n14495ee4k8f2942d16e634c78@mail.gmail.com> Date: Mon, 06 Oct 2008 17:02:45 +0300 In-Reply-To: <720051dc0810060644n14495ee4k8f2942d16e634c78@mail.gmail.com> (James Seward's message of "Mon, 6 Oct 2008 14:44:54 +0100") Message-ID: <87zllhrfcq.fsf@kobe.laptop> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.0.60 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-MailScanner-ID: m96E2jp9013049 X-Hellug-MailScanner: Found to be clean X-Hellug-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-4.298, required 5, autolearn=not spam, ALL_TRUSTED -1.80, AWL 0.10, BAYES_00 -2.60) X-Hellug-MailScanner-From: keramida@freebsd.org X-Spam-Status: No Cc: Jeremy Chadwick , Scott Bennett , freebsd-questions@freebsd.org Subject: Re: pf vs. RST attack question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Oct 2008 14:03:08 -0000 On Mon, 6 Oct 2008 14:44:54 +0100, "James Seward" wrote: > On Mon, Oct 6, 2008 at 12:51 PM, Jeremy Chadwick wrote: >> I've never gotten a definite answer as to what happens if you use "flags >> S/SA" on a rule that is for UDP, since UDP is a non-negotiated protocol. >> That's why I split them up per protocol on RELENG_6 boxes. > > It intelligently ignores it: > % pfctl -vn -f- > pass out proto { tcp udp } all flags S/SA keep state > > Output: > pass out proto tcp all flags S/SA keep state > pass out proto udp all keep state The ruleset optimizer displays something similar too: > pfctl -sr -o basic shows the same pair of rules :)