Re: FairQ ALTQ for PF - Patch #2

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: Max Laier
Date: Sunday, April 6, 2008 - 5:32 pm

On Monday 07 April 2008 01:48:28 Matthew Dillon wrote:

Right.


See the attached forward from the pf mailinglist.  The referenced paper is 
a good read, too.


Yes, if you also flush states.


Usually you won't drop active states.  You'd simply time them out more 
aggressively (see adaptive.{start,end} in pf.conf(5) if your version has 
that already) or not allow a new state to be created.


It really depends on what you want to achieve.  If you are after security 
for a network of clients with bad/broken TCP stacks then leaving out the 
window checks is not a good idea.  I can see that there are cases where 
you'd want to check only the (src,dst,proto)-tuple and pass every 
matching packet regardless.  Currently pf doesn't allow for this to 
happen statefully and I don't think OpenBSD is going to make that change, 
ever.  If you think of pf as a security first and foremost mechanism this 
makes sense.  I'm also somewhat reluctant to make that change in FreeBSD, 
otoh there are cases where you'd want that rope.

-- 
/"\  Best regards,                      | mlaier@freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
Re: FairQ ALTQ for PF - Patch #2, Matthew Dillon, (Sun Apr 6, 4:48 pm)
Re: FairQ ALTQ for PF - Patch #2, Max Laier, (Sun Apr 6, 5:32 pm)