14.11.07 @ 04:39 Curby wrote:
Hi, this is slightly off-topic as it relates to IPFW2 in Mac OS X (as
of Tiger, 10.4.x).
I've read that when a FreeBSD machine running IPFW2 receives a
fragmented TCP packet (and let's say that the machine itself is the
intended destination), the packet is reassembled before it gets to
IPFW2, and IPFW2 sees a single TCP packet. Basically, the (first)
question is whether this is the case in OS X.
Next, and especially if reassembly occurs before the firewall, what is
the point of the frag flag in a rule body, e.g.:
add 04010 deny log all from any to any frag in
Question 2 in a nutshell: what's the point of "frag" if frags are
already being reassembled? Is this meant to reject incoming frags
No, you've read something wrong,. Packets are not reassembled before
firewall. At least they shouldn't do, no documentation says that it must
be. So are that rules - they're really dealing with fragments, no
reassembly. No firewall does reassembly by default, pf also must be told
explicitly to do this by 'scrub' keyword. May be you've misunderstood
somewhat while reading about 'divert', and thought it reassembles all the
time, not only there? But that also occurs _after_ the firewall, anyway...
--
WBR, Vadim Goncharov
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
