diff options
Diffstat (limited to 'fw/man')
| -rw-r--r-- | fw/man/fw | 22 | ||||
| -rw-r--r-- | fw/man/fwrules | 12 |
2 files changed, 22 insertions, 12 deletions
@@ -173,8 +173,12 @@ The difference is one of altitude. Packet filtering sees everything, including traffic no local program asked for, but cannot tell one program from another. Request filtering knows exactly who asked, but only ever sees intentions, -so it cannot stop an inbound connection before the handshake and cannot -see traffic that is merely passing through. +and cannot see traffic that is merely passing through. +It cannot stop an inbound connection before the handshake either - the +kernel has answered by the time +.I fw +is asked - but it does refuse the connection to the program and hang it +up, so a rule naming a caller is late rather than decorative. .PP The options are: .TP @@ -474,16 +478,10 @@ IPv6 extension headers are not walked; such packets are matched on their addresses and next-header protocol alone. ICMP has no type or code matching. .PP -A fragmented datagram does not cross. -Only the first fragment carries the transport header, so the rest match -no port, and a rule set written in ports - which is every rule set worth -writing - denies them. -The first fragment arrives and the receiver waits for the others until -it gives up. -Reading ports out of a later fragment, which is what -.I fw -did before, is worse: a fragment whose payload bytes happen to match an -open connection is then let through. +IPv6 fragments are carried in an extension header, which is not walked, +so a fragmented IPv6 datagram does not cross. +IPv4 fragments do: the first one carries the transport header and +decides, and the rest of the datagram inherits what it decided. .PP Taking a card is destructive and is not undone. The interface that replaces it is unbound when diff --git a/fw/man/fwrules b/fw/man/fwrules index 143ac08..2a42fe1 100644 --- a/fw/man/fwrules +++ b/fw/man/fwrules @@ -93,6 +93,12 @@ is matched by and by .B port= never - at that moment nobody has called, so there is no far end. +An +.B in +rule naming an +.B ip +therefore cannot decide an announce; it decides the connection that +arrives, which is asked about separately when there is a caller to name. .TP .BI ip= address the address at the far end, optionally carrying a @@ -158,6 +164,12 @@ ICMP has no ports, so its flows are the two addresses alone, which is enough for a reply to an echo to be recognised, but does not tie an ICMP error to the connection it is about. .PP +A fragmented datagram is a train: only its first piece carries ports, so +that piece is matched against the rules and the rest of the train +inherits the answer. +A train whose first piece was never seen - or was refused - is judged on +its addresses alone. +.PP When the rules change, connections the new rules forbid are dropped rather than left to finish: a block blocks. .SH EXAMPLES |