Date: Sun, 03 Jul 2005 00:06:37 +0200 From: Jesper Wallin <jesper@hackunite.net> To: freebsd-security@freebsd.org Subject: packets with syn/fin vs pf_norm.c Message-ID: <42C70FED.8080003@hackunite.net>
next in thread | raw e-mail | index | archive | help
Hi,
First of all, I know that not dropping SYN/FIN isn't really a big deal, it
just makes no sense. But since it doesn't make any sense, I don't see
the reason why not to discard them.
I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've
read some other posts on google and as far as I can tell, clearly invalid
packets (like packets with SYN/RST set) is discared while scrub simply
remove the FIN bit on packets with SYN/FIN.
Note, I have no knowledge about coding in C, so sorry if this is wrong.
I checked the source and this what I found:
/usr/src/sys/contrib/pf/net/pf_norm.c:1424:
---
flags = th->th_flags;
if (flags & TH_SYN) {
/* Illegal packet */
if (flags & TH_RST)
goto tcp_drop;
if (flags & TH_FIN)
flags &= ~TH_FIN;
} else {
/* Illegal packet */
if (!(flags & (TH_ACK|TH_RST)))
goto tcp_drop;
}
---
Wouldn't this code also check if I got TCP_DROP_SYNFIN set in my kernel
and/or if I got the sysctl option for that enabled? Also, what happens if I
run this little patch I 'wrote' (remember, I don't know C ;-D)
---
1427c1427
< if (flags & TH_RST)
---
> if ((flags & TH_RST) || (flags & TH_FIN))
1429,1431d1428
<
< if (flags & TH_FIN)
< flags &= ~TH_FIN;
---
Sorry if I got all this wrong, I'm just curious how I can drop packets
with the
SYN/FIN bit set and still use scrub in pf.. Also, if I apply the patch
above,
do I need to compile the kernel, world or both?
Best regards,
Jesper Wallin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?42C70FED.8080003>