Date: Wed, 14 Mar 2001 22:06:14 +0100 From: Udo Erdelhoff <ue@nathan.ruhr.de> To: security@FreeBSD.ORG Subject: Re: ipfw rule -1? Message-ID: <20010314220613.L83336@nathan.ruhr.de> In-Reply-To: <20010313232014.B496@cjc-desktop.users.reflexcom.com>; from cjclark@reflexnet.net on Tue, Mar 13, 2001 at 11:20:14PM -0800 References: <20010313084020.A5859@agora.rdrop.com> <20010313232014.B496@cjc-desktop.users.reflexcom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Mar 13, 2001 at 11:20:14PM -0800, Crist J. Clark wrote: > Rule -1 is given for any packet dropped, but not dropped due to a user > rule or the default rule. A quick look at the souce indicates the > above pseudo-rule and some other fragment issues (bogusfrag) are the > only such situations. Hmm, I have the following setup: A -current box mounts /usr/src5 and /usr/obj5 via NFS from a RELENG_4 box. Doing "make installworld" fails as soon there's a fragmented NFS packet - the fragments are dropped by rule -1. I switched to a kernel without ipfw to be able to complete the installworld. The kernel was PRE_SMPNG. Were there any bugfixes in this area or should I try to reproduce the problem with a current -current? /s/Udo -- I figure that if the burned hand teaches best, then the entire scorched epidermis simply has to get its point across. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010314220613.L83336>