FreeBSD Security Advisories

[rds_correia]

Hi there,
I believe we don't need to worrie about the 11-1-06 SAs, do we?
Namely this one ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:04.ipfw.asc.
Cheers

[sullrich]

Already addressed and will be included in beta2.

[Leoandru]

@sullrich:

Already addressed and will be included in beta2.

I'm not sure im following. Does pfSense include ipfw?

[sullrich]

Yes, for captive portal.

[rds_correia]

@sullrich:

Yes, for captive portal.

Why don't we use pf for captive portal too?
It just doesn't make much sense…

[sullrich]

We had this setup w/ PF but we ran into a problem of not being able to query when the last time a user hit the rule from the webGUI so we put it back to IPFW after everyone kept complaining.

[rds_correia]

I see.
Thanks :).

[Leoandru]

I c. thats interesting, guess I could make use of dummynet then.

Is the ipfw moduled loaded at all times? and if loaded will it be unloaded when captive portal is disabled?

[sullrich]

It's loaded and unloaded as needed.

[billm]

We shouldn't be vulnerable to this anyway as PF loads and will match first before ipfw.  PF will drop or otherwise scrub the ICMP before ipfw ever sees it.

–Bill