From owner-freebsd-security Sat Jan 22 13: 9:48 2000 Delivered-To: freebsd-security@freebsd.org Received: from mx2.x-treme.gr (mx2.x-treme.gr [212.120.192.15]) by hub.freebsd.org (Postfix) with ESMTP id 8F69814F4C for ; Sat, 22 Jan 2000 13:09:23 -0800 (PST) (envelope-from keramida@diogenis.ceid.upatras.gr) Received: from hades.hell.gr (pat23.x-treme.gr [212.120.197.215]) by mx2.x-treme.gr (8.9.3/8.9.3/IPNG-ADV-ANTISPAM-0.1) with ESMTP id XAA24220; Sat, 22 Jan 2000 23:09:09 +0200 Received: (from charon@localhost) by hades.hell.gr (8.9.3/8.9.3) id SAA30080; Sat, 22 Jan 2000 18:14:29 +0200 (EET) (envelope-from keramida@diogenis.ceid.upatras.gr) Date: Sat, 22 Jan 2000 18:14:29 +0200 From: Giorgos Keramidas To: Warner Losh Cc: Don Lewis , security@FreeBSD.ORG Subject: Re: stream.c worst-case kernel paths Message-ID: <20000122181429.A30060@hades.hell.gr> Reply-To: keramida@ceid.upatras.gr References: <200001220551.VAA15775@salsa.gv.tsc.tdk.com> <200001220609.XAA18444@harmony.village.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre3i In-Reply-To: <200001220609.XAA18444@harmony.village.org> X-PGP-Fingerprint: 62 45 D1 C9 26 F9 95 06 D6 21 2A C8 8C 16 C0 8E X-Phone-Number: +30-94-6203692, +30-93-2886457 X-Address: Theodorou Kirinaiou 61, 26334 Patra, Greece Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Jan 21, 2000 at 11:09:39PM -0700, Warner Losh wrote: > In message <200001220551.VAA15775@salsa.gv.tsc.tdk.com> Don Lewis writes: > : (b) still needs to be generalized to cover other paths that generate > : RST packets. > > I think that the discarding of multi-cast packets is one of those > can't hurt sorts of things. Yup, it didn't hurt me at all when I used the ipfilter rules shown below all day today. I didn't try stream'ing my machines but I suspect these rules will stay with me until I know the kernel does the same thing by default: pass in on ppp0 head 100 block in proto tcp from 224.0.0.0/4 to any group 100 block out proto tcp from any to 224.0.0.0/4 -- Giorgos Keramidas, < keramida @ ceid . upatras . gr > "Don't let your schooling interfere with your education." [Mark Twain] To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message