Re: can I use keep-state for icmp rules?

From: Michael Scheidell (scheidell@fdma.com)
Date: 10/31/01 

From: "Michael Scheidell" <scheidell@fdma.com>
To: <freebsd-security@freebsd.org>
Date: Wed, 31 Oct 2001 08:24:05 -0500

----- Original Message -----
From: "Crist J. Clark" <cristjc@earthlink.net>
To: "Michael Scheidell" <scheidell@fdma.com>
Cc: <freebsd-security@freebsd.org>
Sent: Tuesday, October 30, 2001 7:42 PM
Subject: Re: can I use keep-state for icmp rules?

> On Tue, Oct 30, 2001 at 07:39:09AM -0500, Michael Scheidell wrote:
> > You mean if I send email to your system, you can immediatly connect to
my
> > internal tcp ports that might not normally have external access
available?
>
> No. If you send out a TCP packet to my system that matches your
> 'keep-state' rule,
>
> TCP
> src_ip.src_port ----> dst_ip.dst_port
>
> I can send _any_ TCP packet back,
>
> TCP
> src_ip.src_port <---- dst_ip.dst_port
>
> And it will pass provided the source and destination IP and ports all
> line up. ipfw(8) does not consider the TCP flags, sequence number,

So, is ipfilter MORE statefull? ie, will it check more carefully?
One reason I asked, while testing the ipf icmp rules.

Step 1: ipfw add allow icmp from {thishost} to any out via {oif} keep-state
Step 2: ping remote host
    (works)
Step 3: log on to remote host and ping {thishost} back. I was able to ping
it.
  Sorta scared me. (no additional ipfw rules)

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message