Fwd: Re: Fwd: Re: explanation and code for stream.c issues

Subject: Fwd: Re: Fwd: Re: explanation and code for stream.c issues
From: Tim Yardley (yardleyUIUC.EDU)
Date: Fri Jan 21 2000 - 18:52:54 CST

• Next message: Vanja Hrustic: "Re: Vulnerabilities in Checkpoint FW-1 version 3.x and maybe 4.x"
• Previous message: Haight, Kristofer: "Re: stream.c - new FreeBSD exploit?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

The rulesets that were suggested by Darren Reed forgot to include the
outgoing connections.

this is the updated rulesets...

block in quick proto tcp from any to any head 100
pass in quick proto tcp from any to any flags S keep state group 100
pass out proto tcp from any to any flags S keep state
pass in all

Brian Kraemer <kraemeru.washington.edu> pointed this out with the
following paragraph:

:: FYI this ruleset (with no other rules applied) will also effectively block
:: any outgoing TCP sessions initiated from this machine. The machine will
:: send a SYN, and then get blocked because the input rules never saw an
:: incoming SYN to start keeping state. Thus, the ruleset should be revised.

/tmy

-- Diving into infinity my consciousness expands in inverse
    proportion to my distance from singularity

+-------- ------- ------ ----- ---- --- -- ------ --------+
| Tim Yardley (yardleyuiuc.edu)
| http://www.students.uiuc.edu/~yardley/
+-------- ------- ------ ----- ---- --- -- ------ --------+

• Next message: Vanja Hrustic: "Re: Vulnerabilities in Checkpoint FW-1 version 3.x and maybe 4.x"
• Previous message: Haight, Kristofer: "Re: stream.c - new FreeBSD exploit?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Sun Jan 23 2000 - 17:52:07 CST