Date: Wed, 31 Oct 2001 16:09:28 -0800 From: Greg White <gregw-freebsd-security@greg.cex.ca> To: FreeBSD Security <freebsd-security@FreeBSD.org> Subject: Re: can I use keep-state for icmp rules? Message-ID: <20011031160928.H58605@greg.cex.ca> In-Reply-To: <20011031144209.A89351@bluenugget.net>; from geniusj@bluenugget.net on Wed, Oct 31, 2001 at 02:42:09PM -0800 References: <009c01c16017$dca045d0$0603a8c0@MIKELT> <20011029153954.B224@gohan.cjclark.org> <005501c1613f$dfb46520$0603a8c0@MIKELT> <20011030164253.C223@gohan.cjclark.org> <000901c1620f$51428530$2801010a@MIKELT> <20011031130817.A246@gohan.cjclark.org> <20011031144209.A89351@bluenugget.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed Oct 10/31/01, 2001 at 02:42:09PM -0800, Jason DiCioccio wrote: > On Wed, Oct 31, 2001 at 01:08:17PM -0800, Crist J. Clark wrote: > [snip] > > Not sure if checking more "carefully" is an accurate statement, but > > IPFilter does only allow TCP packets that it "expects" back in. It > > does track sequence numbers which ipfw(8) does not track at all. > [snip] > > Now I'm curious. Will using "flags S" after keep state rules in ipfilter > degrade the quality of ipf's stateful inspection? I know it is recommended (at > least on the ipfilter webpage) to use flags S for tcp keep state rules if your > state table is filling up, if not in all cases. I'm just curious to know > whether using that 'flags S' will make the inspection work more like ipfw's. > If so, I might have to reconsider my use of it. :-) No, cannot see how it could. 'flags S' is for the outbound connection, not the packets coming back. Packets coming back are rigorously checked regardless of the rule that caused the state table entry. 'flags S' merely works around protocols which often 'slip state' -- replies come back out-of-sequence, etc. HTTP is really bad for this, e.g. See the ipfilter archives for _lots_ of discussion on this topic. -- Greg White To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011031160928.H58605>