From: Valdis.Kletnieks@vt.edu
To: Al Boldi <a1426z@gawab.com>
Cc: Bill Davidsen <davidsen@tmr.com>,
Patrick McHardy <kaber@trash.net>,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
linux-net@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [RFD] iptables: mangle table obsoletes filter table
Date: Sun, 21 Oct 2007 00:53:59 -0400 [thread overview]
Message-ID: <26984.1192942439@turing-police.cc.vt.edu> (raw)
In-Reply-To: Your message of "Sun, 21 Oct 2007 07:31:58 +0300." <200710210731.58959.a1426z@gawab.com>
[-- Attachment #1: Type: text/plain, Size: 723 bytes --]
On Sun, 21 Oct 2007 07:31:58 +0300, Al Boldi said:
> > Well, for example to stop any transient packets being forwarded. You could
> > probably hack around this using mark's, but you can't stop the implied
> > route lookup, unless you stop it in prerouting.
>
> Basically, you have one big unintended gaping whole in your firewall, that
> could easily be exploited for DoS attacks at the least, unless you put in
> specific rules to limit this.
OK, the light bulb just went on... ;)
We actually *do* have an issue with the flip side of that - it's a frikking
pain to make packets that show up on eth0 with a destination of 127.0.0.1
go away un-noticed - or at least I'm assuming it's the flip side of the same
issue.
[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]
next prev parent reply other threads:[~2007-10-21 4:54 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-11 21:31 Al Boldi
2007-10-12 4:35 ` Patrick McHardy
2007-10-12 5:37 ` Al Boldi
[not found] ` <470F5F19.70606@trash.net>
2007-10-12 12:25 ` Al Boldi
2007-10-12 12:31 ` Patrick McHardy
2007-10-12 13:18 ` Al Boldi
2007-10-12 13:23 ` Patrick McHardy
2007-10-12 22:56 ` Al Boldi
2007-10-17 22:37 ` Bill Davidsen
2007-10-17 23:24 ` Bill Davidsen
2007-10-20 3:40 ` Al Boldi
2007-10-20 4:47 ` Valdis.Kletnieks
2007-10-20 11:10 ` Jan Engelhardt
2007-10-21 4:31 ` Al Boldi
2007-10-21 4:53 ` Valdis.Kletnieks [this message]
2007-10-23 22:27 ` Bill Davidsen
2007-10-12 13:01 ` Jan Engelhardt
2007-10-12 13:30 ` Al Boldi
2007-10-12 13:39 ` Jan Engelhardt
2007-10-12 13:48 ` Patrick McHardy
2007-10-12 14:02 ` Jan Engelhardt
2007-10-12 14:03 ` Patrick McHardy
2007-10-12 22:56 ` Al Boldi
2007-10-12 23:02 ` Patrick McHardy
[not found] <200710120814.23903.a1426z@gawab.com>
2007-10-18 15:41 ` Matthew Faulkner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=26984.1192942439@turing-police.cc.vt.edu \
--to=valdis.kletnieks@vt.edu \
--cc=a1426z@gawab.com \
--cc=davidsen@tmr.com \
--cc=kaber@trash.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-net@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®