lkml.org 
[lkml]   [2000]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: ECN & cisco firewall
On Fri, 8 Sep 2000, David S. Miller wrote:

> The authors of rfc793 probably, in all honesty, really meant
> "must be set to zero by current implementations".

Thats often the problem when interpretations are possible: Different
people see the meaning differently.

> Even though they did not say this, several pages later they bestow
> upon us the concept of being liberal in what one accepts. Perhaps
> Cisco PIX firewall engineers missed this paragraph. :-) Also, there
> is not one part of the packet parsing steps they describe which says
> "if any reserved flag bits are non-zero, drop packet" or "reset" (the
> sites which RST these ECN carrying packets are the ones which disturb
> me the most, in the Cisco PIX case does the firewall send a reset
> back?).

In case i havent sayed this clearly enough: It seems after several
tests: the PIX itself sent the RST (blocking the connection) instead of
letting the SYN pass to the actual host (behind the firewall)

> That's a really anal, zero purpose, check to put into a firewall.
> I don't know of even any embedded printer stacks that puke when
> the reserved flag bits are non-zero. The only things this protects
> anyone from are extensions such as ECN :-)

Yeah, but we will see what cisco has to say about that....

LL&P Ulrich
--
,-, .-.,----,---------------------------------------------------------------
| | / / |,---' Ulrich Kiermayr Inst. for Theoret. Physics, Univ. of Vienna
| |/ /| ||_ eMail: kie@thp.univie.ac.at PGP Key ID: 0xA8D764D8
| ( | | _: ICQ: 17858333 Web: http://www.thp.univie.ac.at/~kie
| |\ \| || @Home: Dampierrestr. 4/5, A-1140 Vienna; +43(699)19671909
| | \ \ |`---, @Work: Boltzmanngasse 5, A-1090 Vienna; +43(1)4277/51555
`-' `-''----'---------------------------------------------------------------

System going down at 5 this afternoon to install scheduler bug.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:38    [W:0.080 / U:6.536 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site