On Thu, May 13, 2004 at 05:55:05PM +0800, Eugene Grosbein wrote:
...
> > removing the M_SKIP_FIREWALL would let ipfw process the
> > packet too. HOWEVER: i think it is a bug in the general case
> > to reprocess internally-generated packet, because you would rely
> > on a correct ipfw configuration to avoid loops (which might not
> > be the case).
> >
> > I have no idea how ipfw1 used to do (and i am not goin to check!)
> > but i don't think the generated packet did reenter the firewall.
>
> I use ipfw2.
>
> Please make it possible (using sysctl or any other mean) to
> disable M_SKIP_FIREWALL for such packets (I suppose 'unreach' rules
> are affected too). I DO need to process ALL outgoing packets.
> For exapmle, I must use 'ipfw fwd' (to implement policy routing)
> for the packets with source IP like this.
ok the situation is the following:
1.- unreach rules send packets through send_reject() which in turn
calls icmp_error() which in turn goes through the firewall;
This is safe because ipfw2 will not generate an ICMP reject
in response to an ICMP packets so loops are avoided;
2.- all other firewall-generated TCP packets (rst and keepalives)
go through send_pkt() and then bypass the firewall.
The only way we could safely go through the firewall again is
to make sure that we never send a RST in response to a RST (need
to add an additional check in O_REJECT).
Give me a few days (i.e. ping me again on monday!) to come up with
a safe patch to do this, which does not rely on the programmer to
DTRT and avoid loops.
cheers
luigi
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
