>А как работает keep-state для icmp, где понятия порта вообще нет?
>Или там все привязывается к icmp type ?
Выдержка из ман-а по PF
For UDP, which is stateless by nature, keep state will create state as
well. UDP packets are matched to states using only host addresses and
ports.
ICMP messages fall into two categories: ICMP error messages, which always
refer to a TCP or UDP packet, are matched against the referred to connec-
tion. If one keeps state on a TCP connection, and an ICMP source quench
message referring to this TCP connection arrives, it will be matched to
the right state and get passed.
For ICMP queries, keep state creates an ICMP state, and pf(4) knows how
to match ICMP replies to states. For example,
pass out inet proto icmp all icmp-type echoreq keep state
allows echo requests (such as those created by ping(8)) out, creates
state, and matches incoming echo replies correctly to states.
Note: nat, binat and rdr rules implicitly create state for connections.
К сожалению, такого же подробного описания для ipfiler нет. Сзано лишь, что
state keeps information about the flow of a communication session.
State can be kept for TCP, UDP, and ICMP packets.
Вариант для распечатки
Информационная безопасность (Public)
(??) on
21-Янв-05, 18:07 (MSK)
