Date: Tue, 05 Jul 2005 11:11:57 -0400 From: Richard Coleman <rcoleman@criticalmagic.com> To: Darren Reed <avalon@caligula.anu.edu.au> Cc: freebsd-security@freebsd.org, Garrett Wollman <wollman@csail.mit.edu>, Jesper Wallin <jesper@www.hackunite.net>, =?ISO-8859-1?Q?Dag-Erling_?= =?ISO-8859-1?Q?Sm=F8rgrav?= <des@des.no> Subject: Re: packets with syn/fin vs pf_norm.c Message-ID: <42CAA33D.9080505@criticalmagic.com> In-Reply-To: <200507051428.j65ESjJu001522@caligula.anu.edu.au> References: <200507051428.j65ESjJu001522@caligula.anu.edu.au>
next in thread | previous in thread | raw e-mail | index | archive | help
Darren Reed wrote: > No, you're wrong on this. > > Packets for TCP with SYN + FIN set are valid under T/TCP. > T/TCP is documented under RFC 1644. To claim that these, earlier, > documents render it ... "dead" is to argue that SACK and all other > TCP enhancements since also fall into that bucket. > > Very few people use T/TCP, although I believe FreeBSD is the only > one of the BSDs that has done anything serious with it. pf is wrong > to unconditionally clear the FIN flag. So there are a number of > options here: > - fix pf to not remove the FIN flag in FreeBSD > - don't use T/TCP > - don't use scrub in pf > - don't use pf > > I think this is a bug in the scrub implementation and should be > fixed. > > Darren 1. I thought that T/TCP was being removed from FreeBSD (already happened?). 2. It's trivial to predict Theo's response to this. 3. Since T/TCP is rare, there is little motivation to alter scrub to function differently than OpenBSD with respect to these packets. If someone really needs this, there are plenty of alternatives. But more importantly, the original question has been lost. The original question was what should the various firewalls do when the kernel has been compiled with TCP_DROP_SYNFIN. Regardless of whether those packets are valid or not, a person may have reason to compile this feature into the kernel. So, should the firewalls acts differently if this kernel option is used? Richard Coleman rcoleman@criticalmagic.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?42CAA33D.9080505>