Date: Sun, 3 Sep 2000 01:44:53 -0700 From: "Crist J . Clark" <cjclark@reflexnet.net> To: Dragos Ruiu <dr@kyx.net> Cc: Bill Fumerola <billf@chimesnet.com>, Nicolas <list@rachinsky.de>, freebsd-security@FreeBSD.ORG Subject: Re: ipfw and fragments Message-ID: <20000903014453.H62475@149.211.6.64.reflexcom.com> In-Reply-To: <0009022351571F.20066@smp.kyx.net>; from dr@kyx.net on Sat, Sep 02, 2000 at 11:47:29PM -0700 References: <007a01c01457$3b9eff80$e4aa603e@gottt> <00090217534118.20066@smp.kyx.net> <20000903023759.O33771@jade.chc-chimes.com> <0009022351571F.20066@smp.kyx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 02, 2000 at 11:47:29PM -0700, Dragos Ruiu wrote:
> On Sat, 02 Sep 2000, Bill Fumerola wrote:
> > On Sat, Sep 02, 2000 at 05:50:02PM -0700, Dragos Ruiu wrote:
> >
> > > > > Is there a way to make ipfw to reassemble fragmented ip packets before passing them through the rules?
> > > >
> > > > No. The relevant bits are only in the first packet.
> > > >
> > > It could be made to reassemble them,
> > > but it would incurr a performance hit.
> >
> > What do you gain? Nothing that I can think that ipfw currently
> > tests for is in the non-initial fragment.
> >
>
> Correct me if I'm wrong because I havent looked at the ipfw source,
> but fragment's dont get passed. There are some applications that
> like to send big packets (I have a video streaming system for instance
> that sends up to 64K UDP datagrams) that will always get fragmented.
> If I wanted to send such packets unmolested through ipfw it
> would have to "reassemble" them as it were so that once the first
> fragment got through the subsequent ones could follow too.
>
> Or am I missing something here in what you're trying to do?
To pass all fragments,
# ipfw add pass ip from any to any frag
Or you can add specific protocols, source, destination, interface,
etc. If you do not add a rule like that, your fragments will generally
fall through to the last rule which should be a default deny.
Some points from ipfw(8) to remember,
Fragmented packets which have a non-zero offset (i.e. not the
first fragment) will never match a rule which has one or more
port specifications. See the frag option for details on matching
fragmented packets.
frag Match if the packet is a fragment and this is not the
first fragment of the datagram. frag may not be used in
conjunction with either tcpflags or TCP/UDP port specifi-
cations.
There is one kind of packet that the firewall will always discard, that
is an IP fragment with a fragment offset of one. This is a valid packet,
but it only has one use, to try to circumvent firewalls.
Incoming packet fragments diverted by divert or tee are reassembled be-
fore delivery to the socket.
Reassembling packets in general is only really needed for an
application-layer level firewall, which ipfw is not. But as that last
point eludes, that kind of blury once you NAT.
--
Crist J. Clark cjclark@alum.mit.com
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000903014453.H62475>