From owner-freebsd-security@FreeBSD.ORG Sat Jul 2 22:06:50 2005 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A551A16A41C for ; Sat, 2 Jul 2005 22:06:50 +0000 (GMT) (envelope-from jesper@hackunite.net) Received: from mxfep02.bredband.com (mxfep02.bredband.com [195.54.107.73]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0546F43D1D for ; Sat, 2 Jul 2005 22:06:49 +0000 (GMT) (envelope-from jesper@hackunite.net) Received: from mail.hackunite.net ([213.112.198.142] [213.112.198.142]) by mxfep02.bredband.com with ESMTP id <20050702220648.DZCP12835.mxfep02.bredband.com@mail.hackunite.net> for ; Sun, 3 Jul 2005 00:06:48 +0200 Received: from [213.112.198.211] (c-d3c670d5.022-45-6f72652.cust.bredbandsbolaget.se [213.112.198.211]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.hackunite.net (Postfix) with ESMTP id 10316616E for ; Sun, 3 Jul 2005 00:07:06 +0200 (CEST) Message-ID: <42C70FED.8080003@hackunite.net> Date: Sun, 03 Jul 2005 00:06:37 +0200 From: Jesper Wallin User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-security@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: amavisd-new at mail.hackunite.net Subject: packets with syn/fin vs pf_norm.c X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Jul 2005 22:06:50 -0000 Hi, First of all, I know that not dropping SYN/FIN isn't really a big deal, it just makes no sense. But since it doesn't make any sense, I don't see the reason why not to discard them. I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've read some other posts on google and as far as I can tell, clearly invalid packets (like packets with SYN/RST set) is discared while scrub simply remove the FIN bit on packets with SYN/FIN. Note, I have no knowledge about coding in C, so sorry if this is wrong. I checked the source and this what I found: /usr/src/sys/contrib/pf/net/pf_norm.c:1424: --- flags = th->th_flags; if (flags & TH_SYN) { /* Illegal packet */ if (flags & TH_RST) goto tcp_drop; if (flags & TH_FIN) flags &= ~TH_FIN; } else { /* Illegal packet */ if (!(flags & (TH_ACK|TH_RST))) goto tcp_drop; } --- Wouldn't this code also check if I got TCP_DROP_SYNFIN set in my kernel and/or if I got the sysctl option for that enabled? Also, what happens if I run this little patch I 'wrote' (remember, I don't know C ;-D) --- 1427c1427 < if (flags & TH_RST) --- > if ((flags & TH_RST) || (flags & TH_FIN)) 1429,1431d1428 < < if (flags & TH_FIN) < flags &= ~TH_FIN; --- Sorry if I got all this wrong, I'm just curious how I can drop packets with the SYN/FIN bit set and still use scrub in pf.. Also, if I apply the patch above, do I need to compile the kernel, world or both? Best regards, Jesper Wallin