Re: IPFW2 versrcreach update

From: Andre Oppermann (andre_at_freebsd.org)
Date: 07/21/04

  • Next message: James: "Re: IPFW2 versrcreach update" 
    Date: Wed, 21 Jul 2004 13:53:28 +0200
To: James <james@towardex.com>

    James wrote:
    >
    > Andre,
    >
    > >
    > > James,
    > >
    > > it just occured to me; but what is the purpose of versrcreach denying a
    > > packet that will be discarded a few cycles later anyway? When I mark
    > > a route with -reject I want the ICMPs go out and still use the versrcreach
    > > functionality in ipfw.
    >
    > The point is to have uRPF loose-check *drop* the packets sourced from IP's that
    > are null-routed. A null route would discard the packet destined *to* the null
    > route, but it would never drop a packet *sourced* with an IP within the null
    > route.

    Yea, sorry, you are right. Wasn't really up to speed this morning... ;-)

    > uRPF should not emit an ICMP when it drops a -reject route. Even with
    > ip unreachables, Cisco won't emit ICMP when uRPF is killing a packet. The source
    > that triggered uRPF drop condition cannot be trusted as it may have spoofed the
    > packet.

    Ok, I'll go ahead and commit this to ipfw2 later today. 

    -- 
Andre
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: James: "Re: IPFW2 versrcreach update"

    Relevant Pages

    • Re: [was] addition to ipfw (read vlans from bridge)..
      ... into the packet as well as the packet, then yes I like that idea, ... At the moment I plan the ipfw code to be unaware of vlan headers. ... What we need to do is make a convention so that vlan tags are always ...
      (freebsd-net)
    • Re: [was] addition to ipfw (read vlans from bridge)..
      ... If what you are suggesting is that we pass into ipfw an 'offset' ... into the packet as well as the packet, then yes I like that idea, ... What vlan tag? ...
      (freebsd-net)
    • FYI: ipfw converted to PFIL_HOOKS
      ... Convert ipfw to use PFIL_HOOKS. ... The ipfw core packet inspection and filtering ... IPDIVERT is entirely handled within the ipfw PFIL handlers. ... with the new destination sockaddr_in. ...
      (freebsd-current)
    • Re: 7.0 BETA3 - slow TCP upload (TSO related?)
      ... I experience very slow TCP upload from this host - cca 50kbps. ... I have some debug prints in kernel (mostly in ip_output and ipfw log) ... 2/ is diverted by firewall ... 3/ Packet appears immediately again in ip_output with ip_len 2924 and ...
      (freebsd-stable)
    • RE: ipfw divert but no packet payload?
      ... Here's the "ipfw -a list" content at the start. ... 04020 divert 55374 tcp from me to any 80 out ... > the full packet including data payload for a packet diverted ... > Everything I've seen about divert seems clearly to expect the ...
      (freebsd-questions)