17 野に咲く名無し@転載禁止 2023/09/10 04:51:32
>>16
Our tests show that FreeBSD handles these atomic fragments by rebuilding the original packet (thanks to the scrubbing process) but fails to apply any rule that applies to layers four and higher (e.g., the 2nd-last rule from the pf configuration above). By doing so, the fragment matches other rules in the firewall configuration, and it is allowed to pass through. Additionally, the scrubbing process has fixed the packet, so now any operating system behind the firewall accepts the packet.
We verified that we could establish a full two-way communication between the attacker and the victim behind the FreeBSD firewall, in addition to UDP traffic and ICMPv6 traffic between them.