lkml.org 
[lkml]   [1996]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Firewalling in recent kernels
Date
> >   I'm somewhat unsure whether this is a good idea, since actually
> > the destination host might be reachable through other ports.
> > (And I wouldn't be astonished if some OS takes such an ICMP as
> > a reason to drop all already established connections to that
> > destination.)

Certain 4.2 BSD derived systems do indeed drop all connections to that
destination. Its a bug on their part and very exploitable as Im sure
you can imagine.

> Hmm, shouldn't we be useing one of the higher (uncommented, 6-12) numbers
> in the codes for UNREACH section in <linux/icmp.h> ?

Someone was supposed to be testing the effect of the newer options on old
stacks and seeing what occured. I've not heard anything back yet.

Alan



\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.043 / U:10.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site