From owner-doc-jp@jp.freebsd.org  Mon Jan 29 11:50:51 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id LAA66200;
	Mon, 29 Jan 2001 11:50:51 +0900 (JST)
	(envelope-from owner-doc-jp@jp.FreeBSD.org)
Received: from research.gate.nec.co.jp (research.gate.nec.co.jp [202.247.6.217])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id LAA66195
	for <doc-jp@jp.freebsd.org>; Mon, 29 Jan 2001 11:50:50 +0900 (JST)
	(envelope-from hino@nwk.cl.nec.co.jp)
Received: from leek.nwk.cl.nec.co.jp (IDENT:EmL89WTPhWd3rCx4oCoB8I5c0SrS4++W@leek.nwk.cl.nec.co.jp [10.56.32.7]) by research.gate.nec.co.jp (8.9.3+3.2W/000323) with ESMTP id LAA21975 for <doc-jp@jp.freebsd.org>; Mon, 29 Jan 2001 11:50:49 +0900 (JST)
Received: from localhost by leek.nwk.cl.nec.co.jp (8.11.0/NWKM20000322) with ESMTP
	id f0T2onE45837 for <doc-jp@jp.freebsd.org>; Mon, 29 Jan 2001 11:50:49 +0900 (JST)
To: doc-jp@jp.freebsd.org
From: hino@ccm.cl.nec.co.jp
X-In-Reply-To: hrs@eos.ocn.ne.jp's message of
	"Sat, 27 Jan 2001 15:12:45 +0900 (JST)"
In-Reply-To: <20010127.151245.71082207.hrs@eos.ocn.ne.jp>
References: <20010127.151245.71082207.hrs@eos.ocn.ne.jp>
X-Mailer: Mew version 1.93 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Message-Id: <20010129115049Q.hino@nwk.cl.nec.co.jp>
Date: Mon, 29 Jan 2001 11:50:49 +0900
X-Dispatcher: imput version 980905(IM100)
Lines: 23
Reply-To: doc-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: doc-jp 7958
Subject: [doc-jp 7958] Re: ANNOUNCE: FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org
X-Originator: hino@nwk.cl.nec.co.jp

>> On Sat, 27 Jan 2001 15:12:45 +0900 (JST), Hiroki Sato
>> <hrs@eos.ocn.ne.jp> said:
:> $B:4F#!wEl5~M}2JBg3X$G$9!#(B
:>  01:07 $B$+$i(B 01:10 $B$^$G$G$9!#(B

:> 01:08)
:>  - $B:G=i$K$"$k!V(BTCP $BM=Ls%U%i%0$N%*!<%P%m!<%I!W$N0UL#$,J,$+$j$^$;$s!#(B
:>    (ipfw $BFbIt$N=hM}J}K!$NOC(B?)
:>    | Due to overloading of the TCP reserved flags field, ipfw and ip6fw
:>    | incorrectly treat all TCP packets with the ECE flag set as being part
:>    | of an established TCP connection, which will therefore match a
:>    | corresponding ipfw rule containing the 'established' qualifier, even
:>    | if the packet is not part of an established connection.

$B!V(BTCP $B$NM=Ls$5$l$?%U%i%0NN0h$K$O$$$/$D$+$NMxMQJ}K!$,$"$k$?$a(B, $B!W$G$7$g(B
$B$&$+$M$'!D!D(B

ECE$B$O(BRFC2884$B$N(BECN-Echo flag$B$N;v$@$H;W$$$^$9$,!"$b$&0l$D(B($B$"$k$$$OJ#?t(B?)
$B$N;H$$J}$NJ}$O$^$@D4$Y$-$C$F$$$^$;$s!#$b$7$/$O(BRFC2884$B$NCf$@$1$N(B
overloading$B$J$N$+(B? ($B%3%M%/%7%g%s3+@_;~$H!"DL>oDL?.;~$K(Bdouble meaning$B$,(B
$B$"$k!"$C$F$3$H$+$J(B?)

$BF|Ln(B
