Re: Security flaw in Stateful filtering ??????

[Guillaume Morin <guillaume@morinfr.org>]

Dans un message du 06 jun à 20:52, Emmanuel Fleury écrivait :
> So, what are the INVALID packets ?????

The INVALID state concerns the connection state. INVALID packets carry
connection flags that are not expected by the conntrack.

e.g syn/ack with a previous syn

> After this, I was assuming that we were in the ESTABLISHED state.

They are.

The ACK packets match as NEW are a special case. It happens when
netfilter can't find a related connection. It has been discussed here
plenty of times. It allows to change NAT easily and to interrupt traffic
if for some reason, your firewall crashes or something.

I agree that it should be documented. I really thought it was in the FAQ
or something. Anyway, it has been discussed here several times. Feel
free to submit some documentation updates.

-- 
Guillaume Morin <guillaume@morinfr.org>

    Last night I saw the face of God, but waking I'd forgotten who she was.
                                    (Addict)