Date: Sun, 15 Mar 2009 12:38:37 +0300 From: Sergey Matveychuk <sem@FreeBSD.org> To: Dmitriy Demidov <dima_bsd@inbox.lv> Cc: freebsd-ipfw@freebsd.org, Luigi Rizzo <rizzo@iet.unipi.it> Subject: Re: keep-state rules inadequately handles big UDP packets or fragmented IP packets? Message-ID: <49BCCC9D.30109@FreeBSD.org> In-Reply-To: <200903142031.53326.dima_bsd@inbox.lv> References: <200903132246.49159.dima_bsd@inbox.lv> <49BBB94A.7040208@FreeBSD.org> <200903142031.53326.dima_bsd@inbox.lv>
next in thread | previous in thread | raw e-mail | index | archive | help
Dmitriy Demidov wrote: > Hi Luigi. Thank you for answer. > It is a big "surprise" for me that reassembling of IP datagrams is done not *before* they go into firewall, but *after* :( But what's wrong with it? A fragment got from net, pass firewall and store. After all fragments we got, OS reassembly a packet and pass it through firewall again. -- Dixi. Sem.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?49BCCC9D.30109>