From owner-freebsd-bugs@FreeBSD.ORG  Fri Apr  8 18:00:21 2005
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6C09316A4EE
	for <freebsd-bugs@hub.freebsd.org>;
	Fri,  8 Apr 2005 18:00:21 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 21C3D43D4C
	for <freebsd-bugs@hub.freebsd.org>;
	Fri,  8 Apr 2005 18:00:21 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j38I0KI7046621
	for <freebsd-bugs@freefall.freebsd.org>; Fri, 8 Apr 2005 18:00:21 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j38I0K6p046620;
	Fri, 8 Apr 2005 18:00:20 GMT
	(envelope-from gnats)
Date: Fri, 8 Apr 2005 18:00:20 GMT
Message-Id: <200504081800.j38I0K6p046620@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Spartak Radchenko <spartak@aif.ru>
Subject: Re: kern/79416: ipf in 4.11 breaks POLA
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Spartak Radchenko <spartak@aif.ru>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Apr 2005 18:00:21 -0000

The following reply was made to PR kern/79416; it has been noted by GNATS.

From: Spartak Radchenko <spartak@aif.ru>
To: freebsd-gnats-submit@FreeBSD.org, devteam@donut.ugcs.caltech.edu
Cc:  
Subject: Re: kern/79416: ipf in 4.11 breaks POLA
Date: Fri, 08 Apr 2005 21:58:19 +0400

 The same applies to tcp rules.
 This ruleset worked OK in 4.8, 4.9, 4.10 (all outbound tcp connections, 
 incoming connections on port 80):
 
 block in log all
 pass in quick proto tcp from any to any port = 80
 pass out proto tcp from any to any keep state
 
 Yes, I know that such ruleset is not recommended in ipfilter how-to, but 
 it worked anyway.
 And I think that "not recommended" doesn't mean "strictly prohibited".
 In 4.11 incoming connections to port 80 do not work any more. The 
 ruleset must be modified:
 
 block in log all
 pass in quick proto tcp from any to any port = 80
 pass out quick proto tcp from any port = 80  to any
 pass out  proto tcp from any to any keep state
 
 --
 Spartak Radchenko SVR1-RIPE