From owner-freebsd-security  Wed Oct 31  5:24:17 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.fdma.com (mail.fdma.com [216.241.67.73])
	by hub.freebsd.org (Postfix) with ESMTP id 1BD9E37B401
	for <freebsd-security@freebsd.org>; Wed, 31 Oct 2001 05:24:13 -0800 (PST)
Received: from MIKELT (mikelt.fdma.lan [10.1.1.40])
	by mail.fdma.com (8.11.3/8.11.3) with SMTP id f9VDO6632205
	for <freebsd-security@freebsd.org>; Wed, 31 Oct 2001 08:24:07 -0500 (EST)
Message-ID: <000901c1620f$51428530$2801010a@MIKELT>
From: "Michael Scheidell" <scheidell@fdma.com>
To: <freebsd-security@freebsd.org>
References: <009c01c16017$dca045d0$0603a8c0@MIKELT> <20011029153954.B224@gohan.cjclark.org> <005501c1613f$dfb46520$0603a8c0@MIKELT> <20011030164253.C223@gohan.cjclark.org>
Subject: Re: can I use keep-state for icmp rules?
Date: Wed, 31 Oct 2001 08:24:05 -0500
Organization: Florida Datamation, Inc.
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

----- Original Message -----
From: "Crist J. Clark" <cristjc@earthlink.net>
To: "Michael Scheidell" <scheidell@fdma.com>
Cc: <freebsd-security@freebsd.org>
Sent: Tuesday, October 30, 2001 7:42 PM
Subject: Re: can I use keep-state for icmp rules?


> On Tue, Oct 30, 2001 at 07:39:09AM -0500, Michael Scheidell wrote:
> > You mean if I send email to your system, you can immediatly connect to
my
> > internal tcp ports that might not normally have external access
available?
>
> No. If you send out a TCP packet to my system that matches your
> 'keep-state' rule,
>
>                    TCP
>   src_ip.src_port ----> dst_ip.dst_port
>
> I can send _any_ TCP packet back,
>
>                    TCP
>   src_ip.src_port <---- dst_ip.dst_port
>
> And it will pass provided the source and destination IP and ports all
> line up. ipfw(8) does not consider the TCP flags, sequence number,


So, is ipfilter MORE statefull? ie, will it check more carefully?
One reason I asked, while testing the ipf icmp rules.

Step 1: ipfw add allow icmp from {thishost} to any out via {oif} keep-state
Step 2: ping remote host
    (works)
Step 3: log on to remote host and ping {thishost} back.  I was able to ping
it.
  Sorta scared me. (no additional ipfw rules)




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message