From owner-cvs-sys  Tue Jan 20 18:07:28 1998
Return-Path: <owner-cvs-sys>
Received: (from daemon@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id SAA29859
          for cvs-sys-outgoing; Tue, 20 Jan 1998 18:07:28 -0800 (PST)
          (envelope-from owner-cvs-sys)
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id SAA29831;
          Tue, 20 Jan 1998 18:07:02 -0800 (PST)
          (envelope-from fenner@FreeBSD.org)
From: Bill Fenner <fenner@FreeBSD.ORG>
Received: (from fenner@localhost)
	by freefall.freebsd.org (8.8.8/8.8.5) id SAA06196;
	Tue, 20 Jan 1998 18:06:00 -0800 (PST)
Date: Tue, 20 Jan 1998 18:06:00 -0800 (PST)
Message-Id: <199801210206.SAA06196@freefall.freebsd.org>
To: cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, cvs-sys@FreeBSD.ORG
Subject: cvs commit: src/sys/netinet tcp_input.c
Sender: owner-cvs-sys@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

fenner      1998/01/20 18:06:00 PST

  Modified files:
    sys/netinet          tcp_input.c 
  Log:
  A more complete fix for the "land" attack, removing the "quick fix" from
  rev 1.66.  This fix contains both belt and suspenders.
  
  Belt: ignore packets where src == dst and srcport == dstport in TCPS_LISTEN.
   These packets can only legitimately occur when connecting a socket to itself,
   which doesn't go through TCPS_LISTEN (it goes CLOSED->SYN_SENT->SYN_RCVD->
   ESTABLISHED).  This prevents the "standard" "land" attack, although doesn't
   prevent the multi-homed variation.
  
  Suspenders: send a RST in response to a SYN/ACK in SYN_RECEIVED state.
   The only packets we should get in SYN_RECEIVED are
   1. A retransmitted SYN, or
   2. An ack of our SYN/ACK.
   The "land" attack depends on us accepting our own SYN/ACK as an ACK;
   in SYN_RECEIVED state; this should prevent all "land" attacks.
  
  We also move up the sequence number check for the ACK in SYN_RECEIVED.
   This neither helps nor hurts with respect to the "land" attack, but
   puts more of the validation checking in one spot.
  
  PR:             kern/5103
  
  Revision  Changes    Path
  1.68      +25 -20    src/sys/netinet/tcp_input.c