diff options
Diffstat (limited to 'fw/man')
| -rw-r--r-- | fw/man/fw | 46 |
1 files changed, 45 insertions, 1 deletions
@@ -126,6 +126,39 @@ A refused write fails, and the diagnostic is what .IR dial (2) reports to the program that tried it. .PP +The +.B /net +it serves is named rather than filtered: protocol directories and their +conversations, plus +.BR cs , +.BR dns , +.BR arp , +.BR bootp , +.BR iproute , +.B ipselftab +and +.BR ndb , +of which only +.B cs +and +.B dns +may be written. +Nothing else is there at all - not a card, not +.BR ipmux , +not +.BR log , +not a protocol's +.B trans +file, and not an interface's +.B data +or +.B snoop +file, each of which is a wire. +A protocol +.I fw +has not been told about is one nobody in the namespace can reach, which +is the safe way for this list to be out of date. +.PP Because the policy lives in a namespace, each program can have its own. Filtering a program's requests is not a boundary by itself - see .B CONTAINMENT @@ -441,7 +474,18 @@ IPv6 extension headers are not walked; such packets are matched on their addresses and next-header protocol alone. ICMP has no type or code matching. .PP -Taking a card is destructive and is not undone reliably. +A fragmented datagram does not cross. +Only the first fragment carries the transport header, so the rest match +no port, and a rule set written in ports - which is every rule set worth +writing - denies them. +The first fragment arrives and the receiver waits for the others until +it gives up. +Reading ports out of a later fragment, which is what +.I fw +did before, is worse: a fragment whose payload bytes happen to match an +open connection is then let through. +.PP +Taking a card is destructive and is not undone. The interface that replaces it is unbound when .I fw stops, and the address goes with it, so a |