From owner-freebsd-security Fri Jan 21 22:32:50 2000 Delivered-To: freebsd-security@freebsd.org Received: from gatekeeper.tsc.tdk.com (gatekeeper.tsc.tdk.com [207.113.159.21]) by hub.freebsd.org (Postfix) with ESMTP id 3D46A14D17 for ; Fri, 21 Jan 2000 22:32:47 -0800 (PST) (envelope-from gdonl@tsc.tdk.com) Received: from imap.gv.tsc.tdk.com (imap.gv.tsc.tdk.com [192.168.241.198]) by gatekeeper.tsc.tdk.com (8.8.8/8.8.8) with ESMTP id WAA18922; Fri, 21 Jan 2000 22:32:17 -0800 (PST) (envelope-from gdonl@tsc.tdk.com) Received: from salsa.gv.tsc.tdk.com (salsa.gv.tsc.tdk.com [192.168.241.194]) by imap.gv.tsc.tdk.com (8.9.3/8.9.3) with ESMTP id WAA53342; Fri, 21 Jan 2000 22:32:16 -0800 (PST) (envelope-from Don.Lewis@tsc.tdk.com) Received: (from gdonl@localhost) by salsa.gv.tsc.tdk.com (8.8.5/8.8.5) id WAA15894; Fri, 21 Jan 2000 22:32:16 -0800 (PST) Message-Id: <200001220632.WAA15894@salsa.gv.tsc.tdk.com> From: gdonl@tsc.tdk.com (Don Lewis) Date: Fri, 21 Jan 2000 22:32:15 -0800 In-Reply-To: Brett Glass "Re: stream.c worst-case kernel paths" (Jan 21, 11:09pm) X-Mailer: Mail User's Shell (7.2.6 beta(5) 10/07/98) To: Brett Glass , gdonl@tsc.tdk.com (Don Lewis), Matthew Dillon , Giorgos Keramidas Subject: Re: stream.c worst-case kernel paths Cc: Warner Losh , Darren Reed , security@FreeBSD.ORG Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Jan 21, 11:09pm, Brett Glass wrote: } Subject: Re: stream.c worst-case kernel paths } At 10:51 PM 1/21/2000 , Don Lewis wrote: } } >+ if ((thflags & (TH_ACK|TH_SYN)) == TH_SYN) } >+ wildcard = 1; } } Looks good! But wouldn't it be better to do: } } if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) } wildcard = 1; } } to make sure it's really a legitimate SYN? That's a fairly minor optimization because the code that handles listening sockets does a check for TH_RST right off the bat, but since this particular optimization has zero cost ... Actually, I think TH_SYN+TH_RST should immediately go to "drop", do not pass GO, do not collect $200 ... } And what } about SYN-FIN packets? (If we want to avoid looking } for a listener on those, we need to "or" TH_FIN into the } inntermost constant expression too.) They need to look for listening sockets in the T/TCP case. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message