Date: Sun, 17 Dec 2000 16:12:19 -0500 (EST) From: Robert Watson <rwatson@FreeBSD.org> To: Jesper Skriver <jesper@skriver.dk> Cc: "Jacques A. Vidrine" <n@nectar.com>, freebsd-net@FreeBSD.org, Poul-Henning Kamp <phk@critter.freebsd.dk>, Kris Kennaway <kris@FreeBSD.org>, security-officer@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_icmp.c tcp_subr.c tcp_var.h Message-ID: <Pine.NEB.3.96L.1001217161038.48123W-100000@fledge.watson.org> In-Reply-To: <20001217220852.A20296@skriver.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 17 Dec 2000, Jesper Skriver wrote: > - ip source and destination addresses > - tcp source and destination ports > - tcp sequence number > > Can we make it zap the sessions regardless of the current state ? > > And perhaps enable it by default ? I admit that I had assumed, from the commit message, that that was the way it would be done, because anything else would be silly :-). If all of these conditions hold (and ICMP messages are correctly ignored if they are truncated too early to include the info (rather than wild-carding), and IP + TCP options are correctly handled without alignment problems), then I see no reason not to turn this on by default. Robert N M Watson FreeBSD Core Team, TrustedBSD Project robert@fledge.watson.org NAI Labs, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.3.96L.1001217161038.48123W-100000>