From owner-freebsd-security  Fri Jan 21 22:11:11 2000
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2])
	by hub.freebsd.org (Postfix) with ESMTP id 7CFDD155DF
	for <security@FreeBSD.ORG>; Fri, 21 Jan 2000 22:11:00 -0800 (PST)
	(envelope-from brett@lariat.org)
Received: from workhorse (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2])
	by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id XAA29922;
	Fri, 21 Jan 2000 23:09:47 -0700 (MST)
Message-Id: <4.2.2.20000121230038.019685e0@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 
Date: Fri, 21 Jan 2000 23:09:47 -0700
To: gdonl@tsc.tdk.com (Don Lewis),
	Matthew Dillon <dillon@apollo.backplane.com>,
	Giorgos Keramidas <charon@hades.hell.gr>
From: Brett Glass <brett@lariat.org>
Subject: Re: stream.c worst-case kernel paths
Cc: Warner Losh <imp@village.org>,
	Darren Reed <avalon@coombs.anu.edu.au>, security@FreeBSD.ORG
In-Reply-To: <200001220551.VAA15775@salsa.gv.tsc.tdk.com>
References: <Matthew Dillon <dillon@apollo.backplane.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

At 10:51 PM 1/21/2000 , Don Lewis wrote:

>+       if ((thflags & (TH_ACK|TH_SYN)) == TH_SYN)
>+               wildcard = 1;

Looks good! But wouldn't it be better to do:

        if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN)
                wildcard = 1;

to make sure it's really a legitimate SYN? And what
about SYN-FIN packets? (If we want to avoid looking
for a listener on those, we need to "or" TH_FIN into the
inntermost constant expression too.)

--Brett





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message