From owner-freebsd-security@FreeBSD.ORG  Wed Jun  4 09:43:24 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 54B4437B401
	for <freebsd-security@freebsd.org>;
	Wed,  4 Jun 2003 09:43:24 -0700 (PDT)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C13BB43FFB
	for <freebsd-security@freebsd.org>;
	Wed,  4 Jun 2003 09:42:22 -0700 (PDT)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id h54GedLh032268;
	Wed, 4 Jun 2003 13:40:39 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Wed, 4 Jun 2003 13:40:39 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: Vandyuk Eugene <duke@irpen.kiev.ua>
In-Reply-To: <20030604185259.E29212@irpen.kiev.ua>
Message-ID: <20030604133021.H24576-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-120.1 required=5.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      QUOTE_TWICE_1,REPLY_WITH_QUOTES,USER_IN_WHITELIST
	version=2.53
X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
cc: freebsd-security@freebsd.org
Subject: Re: Statefull filtering with IPFW + IPFilter (was: Packet flow
 through IPFW+IPF+IPNAT)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Jun 2003 16:43:24 -0000

On Wed, 4 Jun 2003, Vandyuk Eugene wrote:

>
> I have done some tests with IPFW and IPF compiled in kernel and I was
> confused. Packet flow was:
>
>    OUTGOING:  IPF -> IPNAT -> IPFW
>    INCOMING:  IPNAT -> IPF -> IPFW

Yes. from ip_input.c:

iphack:
        /*
         * Check if we want to allow this packet to be processed.
         * Consider it to be bad if not.
         */
        if (fr_checkp) {
                struct  mbuf    *m1 = m;

                if ((*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0, &m1) || !m1)
                        return;
                ip = mtod(m = m1, struct ip *);
        }
        if (fw_enable && IPFW_LOADED) {


the first 'if' checks if ipf is loaded, and calls the filter function if it
is. The second one does the same for ipfw

and for outgoing packets, from ip_output.c :

       if (fr_checkp) {
                struct  mbuf    *m1 = m;

                if ((error = (*fr_checkp)(ip, hlen, ifp, 1, &m1)) || !m1)
                        goto done;
                ip = mtod(m = m1, struct ip *);
        }

        /*
         * Check with the firewall...
         * but not if we are already being fwd'd from a firewall.
         */
        if (fw_enable && IPFW_LOADED && !args.next_hop) {

Again, ipf gets called before ipfw.


>
> As the result - both outgoing/incoming packets are NAT'ed _before_ IPFW ?!

Yes, if you use ipnat for NAT.

>    I think it's wrong and it should be corrected in this way:
>
>    OUTGOING:  IPF -> IPNAT -> IPFW
>    INCOMING:  IPFW -> IPNAT -> IPF

There was some discusion some time ago in ipf's mailing list. I don't remember
Darren's position on this.



			Fer