From land@squid.dnepr.net  Sun Feb  4 07:06:23 2001
Return-Path: <land@squid.dnepr.net>
Received: from squid.dnepr.net (squid.dnepr.net [195.24.156.115])
	by hub.freebsd.org (Postfix) with ESMTP id E3B1437B491
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Feb 2001 07:06:19 -0800 (PST)
Received: (from land@localhost)
	by squid.dnepr.net (8.11.2/8.11.1) id f12Ei8E01711;
	Fri, 2 Feb 2001 16:44:08 +0200 (EET)
	(envelope-from land)
Message-Id: <200102021444.f12Ei8E01711@squid.dnepr.net>
Date: Fri, 2 Feb 2001 16:44:08 +0200 (EET)
From: land@dnepr.net
Reply-To: land@dnepr.net
To: FreeBSD-gnats-submit@freebsd.org
Subject: broken firewall (ipfw established bug)
X-Send-Pr-Version: 3.2

>Number:         24849
>Category:       kern
>Synopsis:       "ipfw add allow tcp from any to any established" rule passes TCP setup
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Feb 04 07:10:00 PST 2001
>Closed-Date:    Sun Feb 4 09:26:48 PST 2001
>Last-Modified:  Sun Feb 04 09:30:37 PST 2001
>Originator:     Andrey Lakhno
>Release:        FreeBSD 4.2-STABLE i386
>Organization:
>Environment:
	FreeBSD squid.dnepr.net 4.2-STABLE FreeBSD 4.2-STABLE #0: Fri Feb  2 13:25:58 EET 2001   land@host.net:/usr/obj/usr/src/sys/HOST  i386



>Description:

	0100 allow tcp from any to any established
	0200 deny  tcp from any to any setup
	0300 allow ip  from any to any

	TCP setup connection match rule 100.

>How-To-Repeat:

	Use previous ruleset and try to establish TCP connection.

>Fix:

	


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: dwmalone 
State-Changed-When: Sun Feb 4 09:26:48 PST 2001 
State-Changed-Why:  
I believe a fix for this bug was committed a few hours ago.  Most 
of the cvsup mirrors should have the fix by now. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=24849 
>Unformatted:
