From owner-cvs-all Sun Dec 17 13:51: 7 2000 From owner-cvs-all@FreeBSD.ORG Sun Dec 17 13:51:02 2000 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from emu.prod.itd.earthlink.net (emu.prod.itd.earthlink.net [207.217.121.31]) by hub.freebsd.org (Postfix) with ESMTP id D580637B400; Sun, 17 Dec 2000 13:51:01 -0800 (PST) Received: from mobile.wemm.org (pool0115.cvx20-bradley.dialup.earthlink.net [209.179.250.115]) by emu.prod.itd.earthlink.net (8.9.3-EL_1_3/8.9.3) with ESMTP id NAA02223; Sun, 17 Dec 2000 13:50:43 -0800 (PST) Received: from netplex.com.au (localhost [127.0.0.1]) by mobile.wemm.org (8.11.1/8.11.1) with ESMTP id eBHLoYL91037; Sun, 17 Dec 2000 13:50:40 -0800 (PST) (envelope-from peter@netplex.com.au) Message-Id: <200012172150.eBHLoYL91037@mobile.wemm.org> X-Mailer: exmh version 2.2 06/23/2000 with nmh-1.0.4 To: Kris Kennaway Cc: Poul-Henning Kamp , jesper@skriver.dk, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org, security-officer@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_icmp.c tcp_subr.c tcp_var.h In-Reply-To: <20001217015414.A18302@citusc.usc.edu> Date: Sun, 17 Dec 2000 13:50:34 -0800 From: Peter Wemm Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Kris Kennaway wrote: > On Sun, Dec 17, 2000 at 10:24:12AM +0100, Poul-Henning Kamp wrote: > > >> We currently does not react to ICMP administratively prohibited > > >> messages send by routers when they deny our traffic, this causes > > >> a timeout when trying to connect to TCP ports/services on a remote > > >> host, which is blocked by routers or firewalls. > > > > > >This sounds like a security hole since ICMP messages don't have a TCP > > >sequence number meaning they can be trivially spoofed - am I wrong? > >=20 > > There was some discussion on the list, and the result was that the > > default is this behaviour is "off" for now. > >=20 > > Since we only react to this in "SYN-SENT" I think the window of > > opportunity is rather small in the first place... > > The attack I'm thinking of involves flooding a machine with (possibly > spoofed) ICMP packets which would effectively deny the ability for > that machine to connect to its destination. Well, sure, one could flood ICMP filtered messages with a source address of 212.242.40.147 (flutter.freebsd.dk), dest addr 216.136.204.21 (freefall), dest port = 22 (ssh), but the missing part is the source port. You still have to do quite a bit of guessing/work to block phk from ssh'ing to freefall. In fact, it would probably end up looking more like a plain old DoS in order to cover the RTT for all possible source ports that might be in use. (remember, you'd have to clobber correct the source port before the SYN/SYN-ACK round trip, *and* you'd have to know that they were trying to connect in the first place.) > If this attack is possible then I'm unhappy having this code in > FreeBSD, even disabled by default..RFC be damned :-) Well, yes, but still hard... but not as hard as having to guess sequence numbers as well. > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.4 (GNU/Linux) ^^^^^^^^^ What's this? :-) Cheers, -Peter -- Peter Wemm - peter@FreeBSD.org; peter@yahoo-inc.com; peter@netplex.com.au "All of this is for nothing if we don't go to the stars" - JMS/B5 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message