... > > Something about the sshd's tcp decapsulization or pf's relationship with > ... Without the ability to tag the ssh tunneled traffic post > decapsulization, I don't know ... nice if more userland applications like sshd, spamd, hoststated, etc, could set tags ...

openbsd-misc - Giancarlo Razzolini - Mar 3 2008 - 09:30

... Do you know if the sshd in 4.3 via chroot ... be solvable by > running two sshd instances -- one for the outside ... org > Subject: Re: pf tag goes missing post sshd tcp decapsulization ... if more userland applications like sshd, >>> spamd, hoststated, etc, could set ...

openbsd-misc - Giancarlo Razzolini - Mar 3 2008 - 14:02

... . Do you know if the sshd in 4.3 via chroot affords ... openbsd.org Subject: Re: pf tag goes missing post sshd tcp decapsulization Date ... nice if more userland applications like sshd, >> spamd, hoststated, etc, could set tags too. > > actually, it is not ...

openbsd-misc - scott - Mar 3 2008 - 12:56

... -please dance ... > Respecting the differences between sshd and ipsec implementations and, > now ... .org > Subject: Re: pf tag goes missing post sshd tcp decapsulization > ... if more userland applications like sshd, > >> spamd, hoststated, etc, could set ...

openbsd-misc - Reyk Floeter - Mar 4 2008 - 06:15

... please dance ... Respecting the differences between sshd and ipsec implementations and, now that ... openbsd.org Subject: Re: pf tag goes missing post sshd tcp decapsulization ... if more userland applications like sshd, >> spamd, hoststated, etc, could set ...

openbsd-misc - scott - Mar 3 2008 - 12:41

... Something about the sshd's tcp decapsulization or pf's relationship with > it is loosing the tag SSHVPN. yes, since that happens in userland, tags are lost. nothing you can do about it ... that socket gets a specified tag, but that functionality isn't ...

openbsd-misc - Henning Brauer - Mar 3 2008 - 09:08

... want to keep the application/kernel tag name spaces > > distinct though. Otherwise it ... /program > > to mess with pf.conf generated tags and bypass filtering ... ("APP_" ?) to all application generated > > tags. > > > > > > Can > > > > I'm not sure ...

openbsd-misc - Can Erkin Acar - Mar 6 2008 - 19:14

... want to keep the application/kernel tag name spaces > >> distinct though. Otherwise it ... user/program > >> to mess with pf.conf generated tags and bypass filtering etc ... ("APP_" ?) to all application generated > >> tags. > >actually you have a point here ...

openbsd-misc - Henning Brauer - Mar 7 2008 - 10:07

... a tag on > the packet. It would be nice if more userland applications like sshd, > spamd, hoststated, etc, could set tags too. actually, it is not ftp-proxy that sets tags. ftp-proxy dynamically inserts ...

openbsd-misc - Henning Brauer - Mar 3 2008 - 11:19

... a tag on >> the packet. It would be nice if more userland applications like sshd, >> spamd, hoststated, etc, could set tags too. > > actually, it is not ftp-proxy that sets tags. ftp-proxy dynamically > ...

openbsd-misc - Giancarlo Razzolini - Mar 3 2008 - 12:02

... a setsockopt(2) option to > assign a pf tag to a running session. I ... far. It work till now for tcp but it should be no problem ... : setsockopt( create_socket, SOL_SOCKET, SO_PFTAG, tag, strlen(tag) + 1); getsockopt( create_socket, SOL_SOCKET, SO_PFTAG ...

openbsd-misc - Konrad - Mar 6 2008 - 02:08

... a setsockopt(2) option to > > assign a pf tag to a running session. I ... far. It work till > now for tcp but it should be no problem ... : > setsockopt( create_socket, SOL_SOCKET, SO_PFTAG, tag, strlen(tag) + 1); > getsockopt( create_socket, SOL_SOCKET, ...

openbsd-misc - Theo de Raadt - Mar 6 2008 - 02:35

... want to keep the application/kernel tag name spaces > distinct though. Otherwise it ... user/program > to mess with pf.conf generated tags and bypass filtering etc. It ... ("APP_" ?) to all application generated > tags. > > > Can > I'm not sure if ...

openbsd-misc - Konrad - Mar 6 2008 - 17:49

... want to keep the application/kernel tag name spaces >> >>> distinct though. Otherwise it ... /program >> >>> to mess with pf.conf generated tags and bypass filtering ... ("APP_" ?) to all application generated >> >>> tags. >> > >> >>actually you have a point ...

openbsd-misc - Dave Anderson - Mar 7 2008 - 20:15

... routing keeps a refcount for the name<->tag-id mapping and removes it when the ... socket is destroyed. -when we set a tag, and there was already a tag set ... on accept()? also, as you already mentioned, the non-tcp cases are missing yet. but this is a ...

openbsd-misc - Henning Brauer - Mar 6 2008 - 09:40

... want to keep the application/kernel tag name spaces >> distinct though. Otherwise it ... user/program >> to mess with pf.conf generated tags and bypass filtering etc. ... ("APP_" ?) to all application generated >> tags. >actually you have a point here... ...

openbsd-misc - Konrad - Mar 7 2008 - 09:38

... > > so now I changed the tagging from tcp_output to ip_output. > I also put ... probably want to keep the application/kernel tag name spaces distinct though. Otherwise it would ... local user/program to mess with pf.conf generated tags and bypass filtering etc. ...

openbsd-misc - Can Erkin Acar - Mar 6 2008 - 17:22

... want to keep the application/kernel tag name spaces > distinct though. Otherwise it ... user/program > to mess with pf.conf generated tags and bypass filtering etc. ... prefix ("APP_" ?) to all application generated > tags. actually you have a point here... ...

openbsd-misc - Henning Brauer - Mar 7 2008 - 08:22

... want to keep the application/kernel tag name spaces >>> distinct though. Otherwise it ... user/program >>> to mess with pf.conf generated tags and bypass filtering etc. ... ("APP_" ?) to all application generated >>> tags. > >>actually you have a point here ...

openbsd-misc - Dave Anderson - Mar 7 2008 - 12:15

... want to keep the application/kernel tag name spaces > >>> distinct though. Otherwise it ... user/program > >>> to mess with pf.conf generated tags and bypass filtering ... ("APP_" ?) to all application generated > >>> tags. > > > >>actually you have a point ...

openbsd-misc - Henning Brauer - Mar 7 2008 - 14:29