OpenBSD's Packet Filter Gains OS Fingerprinting

basilpronoun writes "The PF packet filter / firewall that comes with OpenBSD has just been improved to allow firewalling decisions to take place based not only on the source of a connection, but the operating system of that source. There are both good and evil applications, not the least of which is blocking the spam from infected Windows machines."

This is slick!

[j0nkatz]

Block those bastard Windows users!!!

Windows? SCO!

[Feztaa]

Even better, lets get all the BSD routers out there to implement rules to drop packets coming from a computer running any of SCO's products. That'll show 'em!

Re:Windows? SCO!

[stu_coates]

Yeah, that'll show BOTH of them! ;-)

Many uses

[Hungus]

I like this, amongst other things it will allow me to prevent non HIPAA compliant OSs from accessing my medical sites. After all how many physcians know how to spoof ethernet packets?

Now where did I put that openBSD box?

No thanks to Darren Reed

[QuantumG]

This is one of those features that would have NEVER made it into the kernel if we were still using ipf.

hmmmm...

[dJCL]

almost reason enough to move my firewall over... or see if someone will port it to linux...

Either way, i could see some fun uses for this...

Re:hmmmm...

[CableModemSniper]

iptables + nmap -O? Maybe... You could write some overly-complicated script. When someone goes to connect have nmap do an OS fingerprint scan on them and then if you don't like the results add an iptables rule based on their host.

Re:hmmmm...

[Triumph The Insult C]

or spend an hour and upgrade to openbsd and not fight it.

Worm warning

[ptaff]

Then if there is a Windows worm in the wild, all OpenBSD routers on the net can redirect the Windows traffic to windowsupdate.com ...?

Re:Worm warning

[pmz]

all OpenBSD routers on the net can redirect the Windows traffic to windowsupdate.com ...?

Perhaps better would be to redirect to a warning page that takes the user to their intended website after a few seconds. Simply going to windowsupdate.com would frustrate people who consciously leave their computers unpatched for various valid reasons (Windows Update is a genuine risk in itself).

Re:Worm warning

[nutznboltz]

Perhaps better would be to redirect to a warning page that takes the user to their intended website after a few seconds.

But no one would see the page since the worm is not a web browser, it just sends out HTTP commands similiar to the way a web broweser does.

be nice

[muirhead]

From the article:

Or maybe I think SCO sucks sweaty monkey balls and their customers should be redirected to a web page of ranting and ravings about why they should cancel their contracts or somesuch.

Okay, so they made a mistake, be nice.
Don't you think that SCO's customers are suffering enough already?

Re:be nice

[Anonymous Coward]

NO!

Re:be nice

[innosent]

SCO has customers? IIRC, SCO made money for the first time in their history the last 2 quarters. Before M$ started pouring in money, SCO never turned a profit.

Technically SCO didn't develop anything that they sell right now. SCO Unix (and project Monterrey) came from old SCO, which became Tarantella. SCO/Caldera just bought it from them. Old SCO had customers, New SCO has lawsuits.