Date: Sat, 24 Apr 2004 01:31:20 +1000 (Australia/ACT) From: Darren Reed <avalon@caligula.anu.edu.au> To: mipam@ibb.net (Mipam) Cc: freebsd-security@freebsd.org Subject: Re: use keep state(strict) to mitigate tcp issues? Message-ID: <200404231531.i3NFVK9m026622@caligula.anu.edu.au> In-Reply-To: <Pine.LNX.4.33.0404231502170.611-100000@ux1.ibb.net> from "Mipam" at Apr 23, 2004 03:17:32 PM
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Mipam, sie said: > > Hi, > > When deploying a BSD with IPF in at the network perimeter > and using rules like these: > > pass in .. proto tcp ... keep state(strict) > > it's possible to refuse tcp packets which arrive out of order. > This would increase the difficulty doing blind attack resets and blind > data injection attack, cause then you'd have to "guess" the exact expected > number. Checpoint has a similar feature (is that right?) which is > described here as the answer to the mentioned attacks: > > http://www.checkpoint.com/techsupport/alerts/tcp_dos.html > > Allthough this is nice, there is also the risk of breaking > connection because it's not unlikely that packets arrive out of order. > At least, that's what i think, any thoughts upon this? My thoughts are that if the TCP on both ends is having trouble, it will eventually fall back and get packets through that match the state entries for "strict". I would not, for example, advise using "strict" for state connections where you intend on sending 100s of megabytes over fast networks,. In IPFilter, the "strict" applies to all TCP packets for a connection, not just the SYNs or RSTs. Darren
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200404231531.i3NFVK9m026622>