* STeve Andre'  [2008-06-11 04:34]:

quoted text
> On Tuesday 10 June 2008 20:40:02 you wrote:

> > * Reyk Floeter  [2008-06-11 01:13]:

> > > CVSROOT:	/cvs

> > > Module name:	src

> > > Changes by:	reyk@cvs.openbsd.org	2008/06/10 17:12:36

> > >

> > > Modified files:

> > > 	usr.sbin/relayd: pfe_filter.c relayd.conf.5

> > >

> > > Log message:

> > > set the inactivity timeout of redirections to a shorter timeout of 600

> > > seconds by default (pf's default is 86400s), they can be cranked with

> > > the "session timeout" directive and it is consistent to relay session

> > > timeouts. also remove the hack to modify the closing timeout because

> > > pf's sloppy state handling is taking care about half connection

> > > closing now.

> >

> > can you guess how much reyk was prodding me for the sloppy states? :)

>

> I'm looking around and don't quite get sloppy states.  Looking at the code

> isn't quite helping.  Anything else I can read?

like, pf.conf(5)?
     sloppy

           Uses a sloppy TCP connection tracker that does not check sequence

           numbers at all, which makes insertion and ICMP teardown attacks way

           easier.  This is intended to be used in situations where one does

           not see all packets of a connection, e.g. in asymmetric routing

           situations.  Cannot be used with modulate or synproxy state.
comes down to "do not use them".

there are some very special circumstances where they make things

possible that didn't work before, like relayd setups with that direct

server return stuff (where you should run another pf box with real

state tracking in front of the relayd box) or cases where you only see

half of the connection, and there one stillhas to be very careful.
anyone using sloppy statekeeping on regular firewalls deserves more

than a spanking.
--

Henning Brauer, hb@bsws.de, henning@openbsd.org

BS Web Services, http://bsws.de

Full-Service ISP - Secure Hosting, Mail and DNS Services

Dedicated Servers, Rootservers, Application Hosting - Hamburg & Amsterdam