From 1575b83f102060eab99248c8e7660e9f61df1389 Mon Sep 17 00:00:00 2001 From: Calvin Morrison Date: Tue, 18 Aug 2026 23:22:58 -0400 Subject: doc: fragments cross, callers are checked, and the open list is shorter man/fw said a fragmented datagram does not cross. IPv4 ones now do: the first piece decides and the train inherits. IPv6 fragments still do not, because the extension header they live in is not walked, and that is what the paragraph says now. The altitude paragraph said request filtering cannot stop an inbound connection before the handshake. Still true, and still worth saying, but it now refuses the connection to the program and hangs it up, which is the difference between a rule that is late and one that does nothing. fwrules(6) gains the other half of that: an in rule naming an ip cannot decide an announce, and decides the connection instead. todo.md loses the six items that are now fixed and gains a third round. One of them is a correction rather than a fix: the interface tables being read into fixed buffers was reported as losing the default route, and it was not -- routes come out sorted and 0.0.0.0 sorts first, so it was always on the first line. Worth removing the limits anyway; not worth having claimed it broke something. Co-Authored-By: Claude Opus 5 --- fw/man/fw | 22 ++++++++++------------ fw/man/fwrules | 12 ++++++++++++ 2 files changed, 22 insertions(+), 12 deletions(-) (limited to 'fw/man') diff --git a/fw/man/fw b/fw/man/fw index 1b6b1d3..99ec41f 100644 --- a/fw/man/fw +++ b/fw/man/fw @@ -173,8 +173,12 @@ The difference is one of altitude. Packet filtering sees everything, including traffic no local program asked for, but cannot tell one program from another. Request filtering knows exactly who asked, but only ever sees intentions, -so it cannot stop an inbound connection before the handshake and cannot -see traffic that is merely passing through. +and cannot see traffic that is merely passing through. +It cannot stop an inbound connection before the handshake either - the +kernel has answered by the time +.I fw +is asked - but it does refuse the connection to the program and hang it +up, so a rule naming a caller is late rather than decorative. .PP The options are: .TP @@ -474,16 +478,10 @@ IPv6 extension headers are not walked; such packets are matched on their addresses and next-header protocol alone. ICMP has no type or code matching. .PP -A fragmented datagram does not cross. -Only the first fragment carries the transport header, so the rest match -no port, and a rule set written in ports - which is every rule set worth -writing - denies them. -The first fragment arrives and the receiver waits for the others until -it gives up. -Reading ports out of a later fragment, which is what -.I fw -did before, is worse: a fragment whose payload bytes happen to match an -open connection is then let through. +IPv6 fragments are carried in an extension header, which is not walked, +so a fragmented IPv6 datagram does not cross. +IPv4 fragments do: the first one carries the transport header and +decides, and the rest of the datagram inherits what it decided. .PP Taking a card is destructive and is not undone. The interface that replaces it is unbound when diff --git a/fw/man/fwrules b/fw/man/fwrules index 143ac08..2a42fe1 100644 --- a/fw/man/fwrules +++ b/fw/man/fwrules @@ -93,6 +93,12 @@ is matched by and by .B port= never - at that moment nobody has called, so there is no far end. +An +.B in +rule naming an +.B ip +therefore cannot decide an announce; it decides the connection that +arrives, which is asked about separately when there is a caller to name. .TP .BI ip= address the address at the far end, optionally carrying a @@ -158,6 +164,12 @@ ICMP has no ports, so its flows are the two addresses alone, which is enough for a reply to an echo to be recognised, but does not tie an ICMP error to the connection it is about. .PP +A fragmented datagram is a train: only its first piece carries ports, so +that piece is matched against the rules and the rest of the train +inherits the answer. +A train whose first piece was never seen - or was refused - is judged on +its addresses alone. +.PP When the rules change, connections the new rules forbid are dropped rather than left to finish: a block blocks. .SH EXAMPLES -- cgit v1.2.3