From owner-freebsd-security@FreeBSD.ORG Tue Mar 2 15:33:07 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 34B5916A4CE for ; Tue, 2 Mar 2004 15:33:07 -0800 (PST) Received: from caligula.anu.edu.au (caligula.anu.edu.au [150.203.224.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id AB71743D39 for ; Tue, 2 Mar 2004 15:33:06 -0800 (PST) (envelope-from avalon@caligula.anu.edu.au) Received: from caligula.anu.edu.au (localhost [127.0.0.1]) by caligula.anu.edu.au (8.12.9/8.12.9) with ESMTP id i22NX5bF019072; Wed, 3 Mar 2004 10:33:05 +1100 (EST) Received: (from avalon@localhost) by caligula.anu.edu.au (8.12.9/8.12.8/Submit) id i22NX4qb019047; Wed, 3 Mar 2004 10:33:04 +1100 (EST) From: Darren Reed Message-Id: <200403022333.i22NX4qb019047@caligula.anu.edu.au> To: silby@silby.com (Mike Silbersack) Date: Wed, 3 Mar 2004 10:33:04 +1100 (Australia/ACT) In-Reply-To: <20040302145808.R715@odysseus.silby.com> from "Mike Silbersack" at Mar 02, 2004 02:59:25 PM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org Subject: Re: mbuf vulnerability X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Mar 2004 23:33:07 -0000 In some mail from Mike Silbersack, sie said: > On Wed, 3 Mar 2004, Darren Reed wrote: > > > > "strict" requires that the sequence number in packet n should match > > > > what that sequence number of the last byte in packet n-1 - i.e. no > > > > out of order delivery is permitted. > > > > > > > > Darren > > Right, so your comment about it "not working" applies to 3.x (which > > is what comes with freebsd, currently), which is what i was hoping :) > > > > My comment was to say that with ipf4, you can address this problem. > > > > darren > > Ok, that sounds correct. However, it would have an adverse performance > impact in the normal case. Have you considered having an "almost strict" > option that would allow maybe 3 or 4 out of order segments through? That > would be a great feature. :) Indeed, there is the potential for adverse impact on TCP and hence so it is an option. But if I adopted your suggestion, it would be like saying it was "almost secure". It is primarily intended for things like, as an example, FTP command channels or telnet or (maybe) SMTP. Darren