Re: [OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-04 Thread Eric Luehrsen
On 07/04/2018 01:39 AM, Alin Năstac wrote: On Tue, Jul 3, 2018 at 11:32 PM Philip Prindeville wrote: On Jul 3, 2018, at 3:22 PM, Alin Năstac wrote: On Tue, Jul 3, 2018 at 6:39 PM Philip Prindeville wrote: Aren’t all inbound SYNs unsolicited by definition? Is there a danger of reflection

Re: [OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-03 Thread Alin Năstac
On Tue, Jul 3, 2018 at 11:32 PM Philip Prindeville wrote: > > On Jul 3, 2018, at 3:22 PM, Alin Năstac wrote: > > > > On Tue, Jul 3, 2018 at 6:39 PM Philip Prindeville > > wrote: > >> > >> Aren’t all inbound SYNs unsolicited by definition? Is there a danger of > >> reflection attacks? > > > >

Re: [OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-03 Thread Philip Prindeville
> On Jul 3, 2018, at 3:22 PM, Alin Năstac wrote: > > On Tue, Jul 3, 2018 at 6:39 PM Philip Prindeville > wrote: >> >> Aren’t all inbound SYNs unsolicited by definition? Is there a danger of >> reflection attacks? > > Not all inbound SYNs are unsolicited. Take for instance active mode > FTP

Re: [OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-03 Thread Alin Năstac
On Tue, Jul 3, 2018 at 6:39 PM Philip Prindeville wrote: > > Aren’t all inbound SYNs unsolicited by definition? Is there a danger of > reflection attacks? Not all inbound SYNs are unsolicited. Take for instance active mode FTP transfers where the client resides on the LAN . In this case the FTP

Re: [OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-03 Thread Philip Prindeville
Aren’t all inbound SYNs unsolicited by definition? Is there a danger of reflection attacks? Sent from my iPhone > On Jul 2, 2018, at 9:29 AM, Alin Nastac wrote: > > From: Alin Nastac > > RFC 6092 recommends in section 3.3.1 that an IPv6 CPE must respond to > unsolicited inbound SYNs with

[OpenWrt-Devel] [PATCH] firewall3: make reject types selectable by user

2018-07-02 Thread Alin Nastac
From: Alin Nastac RFC 6092 recommends in section 3.3.1 that an IPv6 CPE must respond to unsolicited inbound SYNs with an ICMPv6 Destination Unreachable error code 1 (Communication with destination administratively prohibited). Signed-off-by: Alin Nastac --- defaults.c | 21