Date: Thu, 1 Nov 2001 22:24:30 -0800 From: Greg White <gregw-freebsd-security@greg.cex.ca> To: cjclark@alum.mit.edu Cc: Greg White <gregw-freebsd-security@greg.cex.ca>, FreeBSD Security <freebsd-security@FreeBSD.ORG> Subject: Re: can I use keep-state for icmp rules? Message-ID: <20011101222430.O58605@greg.cex.ca> In-Reply-To: <20011101211351.E4360@blossom.cjclark.org>; from cristjc@earthlink.net on Thu, Nov 01, 2001 at 09:13:51PM -0800 References: <009c01c16017$dca045d0$0603a8c0@MIKELT> <20011029153954.B224@gohan.cjclark.org> <005501c1613f$dfb46520$0603a8c0@MIKELT> <20011030164253.C223@gohan.cjclark.org> <000901c1620f$51428530$2801010a@MIKELT> <20011031130817.A246@gohan.cjclark.org> <20011031144209.A89351@bluenugget.net> <20011031160928.H58605@greg.cex.ca> <20011101211351.E4360@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu Nov 11/01/01, 2001 at 09:13:51PM -0800, Crist J. Clark wrote: > On Wed, Oct 31, 2001 at 04:09:28PM -0800, Greg White wrote: > > On Wed Oct 10/31/01, 2001 at 02:42:09PM -0800, Jason DiCioccio wrote: > > > On Wed, Oct 31, 2001 at 01:08:17PM -0800, Crist J. Clark wrote: > > > [snip] > > > > Not sure if checking more "carefully" is an accurate statement, but > > > > IPFilter does only allow TCP packets that it "expects" back in. It > > > > does track sequence numbers which ipfw(8) does not track at all. > > > [snip] > > > > > > Now I'm curious. Will using "flags S" after keep state rules in ipfilter > > > degrade the quality of ipf's stateful inspection? I know it is recommended (at > > > least on the ipfilter webpage) to use flags S for tcp keep state rules if your > > > state table is filling up, if not in all cases. I'm just curious to know > > > whether using that 'flags S' will make the inspection work more like ipfw's. > > > If so, I might have to reconsider my use of it. :-) > > > > No, cannot see how it could. 'flags S' is for the outbound connection, > > not the packets coming back. > > Not really. 'flags S' will match any packet with the SYN flag > set. This would include the initial _reply_ from a remote machine > which will have both the SYN and ACK flags set. > > If you only want to catch an outgoing, initial SYN, you want > 'flags S/SA'. Really? That was not my understanding of the ipfilter docs, nor does it seem to match the output of ipfstat: ipfstat output: root@frodo:~# ipfstat -io | grep tcp | grep state | grep ed0 pass out quick on ed0 proto tcp from any to any flags S/FSRPAU keep state pass in quick on ed0 proto tcp from any to any port = 22 flags S/FSRPAU keep state pass in quick on ed0 proto tcp from any to any port = 80 flags S/FSRPAU keep state pass in quick on ed0 proto tcp from any to any port = 443 flags S/FSRPAU keep state pass in quick on ed0 proto tcp from any to any port = 25 flags S/FSRPAU keep state pass in quick on ed0 proto tcp from any to any port = 53 flags S/FSRPAU keep state ipf.rules that generates that output: root@frodo:~# cat /etc/ipf.rules | grep "flags S" | grep ed0 pass in quick on ed0 proto tcp from any to any port = 22 flags S keep state pass in quick on ed0 proto tcp from any to any port = 80 flags S keep state pass in quick on ed0 proto tcp from any to any port = 443 flags S keep state pass in quick on ed0 proto tcp from any to any port = 25 flags S keep state pass out quick on ed0 proto tcp from any to any flags S keep state The ipf howto also explicitly states that "flags S" means: "flags S actually equates to flags S/AUPRFS and matches against only the SYN packet out of all six possible flags, while flags S/SA will allow packets that may or may not have the URG, PSH, FIN, or RST flags set." Quoted from: http://www.obfuscation.org/ipf/ipf-howto.html#TOC_23 I know you know ipfilter fairly well, Crist, so please feel free to let me know if my understanding is incorrect. -- Greg White To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011101222430.O58605>