At 4:36 PM -0700 11/15/07, Mark Senior wrote:

>All this is an improvement, but IMO it's still not actually good.
>The big improvement one is configd - I gave up on writing a stateful
>ipfw filter for DHCP, because the request goes out to the broadcast,
>but the response is from a non-broadcast source. Application
>awareness is a nice one here

I just realized I had blocked DHCP; this is letting it work,
but I haven't done much testing yet:

# Allow DHCP responses (DHCP broadcasts, which seems to defeat
# keep-state).
add 800 allow udp from any to any src-port 67 dst-port 68 in

http://securosis.com/2007/11/16/ipfw-rules-20071116-revision/

>But, they've missed the big possibility for improvement here - they
>have an application-aware firewall - why on earth would they not
>apply it to outbound connections? No interesting malware requires
>inbound connections anymore; it's already written to get past home
>routers that allow all outbound and deny all inbound connections.
>Ah well.
>
>Incidentally, can anyone with access to a 10.5 system tell me, is
>there a CLI interface to the new application firewall? Is there a
>useful man page?

No manual page; the relevant command is
/usr/libexec/ApplicationFirewall/socketfilterfw.

http://www.extrapepperoni.com/2007/11/10/leopards-socket-firewall/

Chris
--
Chris Pepper: <http://www.reppep.com/~pepper/>
<http://www.extrapepperoni.com/>
The Rockefeller University: <http://www.rockefeller.edu/>

[ reply ]