Date: Thu, 1 Feb 2018 06:30:14 +0530 From: Brahmanand Reddy <brahma.gdb@gmail.com> To: Peter Jeremy <peter@rulingia.com> Cc: freebsd-security@freebsd.org Subject: Re: Need FreeBSD-SA-00:52(TCP uses weak initial sequence numbers) latest patch Message-ID: <CAKsRH7kr1UEiGRrz3SdTG0P765pmSFbwWAtdp80zsoxESozQVA@mail.gmail.com> In-Reply-To: <20180112074115.GB75633@server.rulingia.com> References: <CAKsRH7nsVmhSMUT7TNzGfuN55_J9BkLBzO=8dvjLGvOZtri%2BuQ@mail.gmail.com> <CAKsRH7nsUfkkLfoEuJXBcVpH%2BgnNRpLNb0fjxkJN-xKQnenuQg@mail.gmail.com> <44k1wnes1w.fsf@be-well.ilk.org> <CAKsRH7=hyRPG6vEUi_tYSUXtSr58WKoegaDhNzG_qSQie=aUpQ@mail.gmail.com> <20180112061425.GA75633@server.rulingia.com> <CAKsRH7k=daNfKzjVoyqhDeXj5Z1G1C5-Xt4uA2LRs3dUsGZKyw@mail.gmail.com> <20180112074115.GB75633@server.rulingia.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Dear Peter/ Team,
My final call on this thread, "RST not happens as quickly in 10.4 and 11
FreeBSD, like 9.2". it takes 10 to 15 seconds delay to reset and generate
new ISN number on 80/443/ports.
Example-
# RST
RST=TCP(sport=sport, dport=dport, flags='R', seq=SYNACK.ack, ack=0)
send(ip/RST)
* time.sleep(15*)
SYN2=TCP(sport=sport,dport=dport,flags='S',seq=random.randint(1024,18576),
ack=0)
Kindly clarify and conclude, 1) it could be the expected behavior or any
new enhancement causes this delay what are those.?
2) we have to be configure any
thing like in 'sysctl.conf 'or corresponding fix is available ?
Note: In 9.2 with out delay . i dint observed any issue. the standards say
it must respond quickly with a RST.
Sincerely,
Brahma
On Fri, Jan 12, 2018 at 1:11 PM, Peter Jeremy <peter@rulingia.com> wrote:
> On 2018-Jan-12 12:33:21 +0530, Brahmanand Reddy <brahma.gdb@gmail.com>
> wrote:
> >TCP uses weak initial sequence numbers
> >https://www.freebsd.org/security/advisories/FreeBSD-
> SA-00%3A52.tcp-iss.asc
>
> As has been pointed out to you several times in this thread, that SA is
> nearly 20 years old and there is no evidence that TCP on any recent FreeBSD
> uses weak ISNs.
>
> >actually "arc4random()" will take care on https://github.com/freebsd/
> >freebsd/blob/master/sys/netinet/tcp_subr.c#L2374
>
> Without studying the code in detail, that code appears to correctly use
> arc4random() to initialise the ISN - which is as expected.
>
> > I suspecting 10.4 already having fix... but i didn't found on exactly
> >which this problem from https://www.freebsd.org/security/patches/
>
> Well, the original patch is
> https://www.freebsd.org/security/patches/SA-00%3A52/ and was committed
> as what is now https://svnweb.freebsd.org/base?view=revision&revision=
> 66433
> Since that patch is integrated into the FreeBSD codebase, there's no need
> to update the contents of https://www.freebsd.org/
> security/patches/SA-00%3A52/
> and it is not relevant to the current codebase.
>
> > i would like expecting where is the fix in 10,4 kernel.
>
> That code was re-written in r82122, retaining the use of arc4random() for
> ISN initialisation. As a result, it's no longer possible to point at
> specific code and say "that code fixes weak TCP ISNs".
>
> --
> Peter Jeremy
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAKsRH7kr1UEiGRrz3SdTG0P765pmSFbwWAtdp80zsoxESozQVA>