diff options
| author | Calvin Morrison <calvin@pobox.com> | 2026-08-18 23:22:58 -0400 |
|---|---|---|
| committer | Calvin Morrison <calvin@pobox.com> | 2026-08-18 23:22:58 -0400 |
| commit | 1575b83f102060eab99248c8e7660e9f61df1389 (patch) | |
| tree | 26901caeddb9c2133925600a255987e8e0aac6d7 /fw/man/fwrules | |
| parent | 8f5fed654d54a9ae9c4eb95425d857e9524b803c (diff) | |
doc: fragments cross, callers are checked, and the open list is shorter
man/fw said a fragmented datagram does not cross. IPv4 ones now do:
the first piece decides and the train inherits. IPv6 fragments still
do not, because the extension header they live in is not walked, and
that is what the paragraph says now.
The altitude paragraph said request filtering cannot stop an inbound
connection before the handshake. Still true, and still worth saying,
but it now refuses the connection to the program and hangs it up, which
is the difference between a rule that is late and one that does
nothing. fwrules(6) gains the other half of that: an in rule naming an
ip cannot decide an announce, and decides the connection instead.
todo.md loses the six items that are now fixed and gains a third round.
One of them is a correction rather than a fix: the interface tables
being read into fixed buffers was reported as losing the default route,
and it was not -- routes come out sorted and 0.0.0.0 sorts first, so it
was always on the first line. Worth removing the limits anyway; not
worth having claimed it broke something.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Diffstat (limited to 'fw/man/fwrules')
| -rw-r--r-- | fw/man/fwrules | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/fw/man/fwrules b/fw/man/fwrules index 143ac08..2a42fe1 100644 --- a/fw/man/fwrules +++ b/fw/man/fwrules @@ -93,6 +93,12 @@ is matched by and by .B port= never - at that moment nobody has called, so there is no far end. +An +.B in +rule naming an +.B ip +therefore cannot decide an announce; it decides the connection that +arrives, which is asked about separately when there is a caller to name. .TP .BI ip= address the address at the far end, optionally carrying a @@ -158,6 +164,12 @@ ICMP has no ports, so its flows are the two addresses alone, which is enough for a reply to an echo to be recognised, but does not tie an ICMP error to the connection it is about. .PP +A fragmented datagram is a train: only its first piece carries ports, so +that piece is matched against the rules and the rest of the train +inherits the answer. +A train whose first piece was never seen - or was refused - is judged on +its addresses alone. +.PP When the rules change, connections the new rules forbid are dropped rather than left to finish: a block blocks. .SH EXAMPLES |