diff options
Diffstat (limited to 'fw/doc/design.md')
| -rw-r--r-- | fw/doc/design.md | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fw/doc/design.md b/fw/doc/design.md index 1c78db1..c45c86b 100644 --- a/fw/doc/design.md +++ b/fw/doc/design.md @@ -114,6 +114,17 @@ stays an ordered list and not a lookup. An unrecognised attribute is fatal: silently ignoring `prot=tcp` would leave a rule matching every protocol, and a typo that fails open is not something a firewall may do. +**Named, not filtered.** What the synthetic `/net` contains is a list +of what is served, not a list of what to hide. A list of things to deny +was wrong twice: `trans` installs kernel address translations and devip +gates it with `iseve()`, which through a proxy is *fw's* identity and +not the caller's; and `log`, a trace of every connection on the machine, +had only its write refused when reading it was the leak. Both times the +bug was an omission from a list, which is a kind of bug a whitelist +cannot have. A protocol nobody thought to name is a protocol nobody can +reach — the same direction the rule parser fails in when it meets an +attribute it does not know. + **First match wins, default deny.** Firewall matching is a solved interface. Being different about it would be cost for its own sake. |