From owner-freebsd-security@FreeBSD.ORG Mon Jul 4 00:53:39 2005 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ACD5416A41C for ; Mon, 4 Jul 2005 00:53:39 +0000 (GMT) (envelope-from des@des.no) Received: from tim.des.no (tim.des.no [194.63.250.121]) by mx1.FreeBSD.org (Postfix) with ESMTP id 65CA243D45 for ; Mon, 4 Jul 2005 00:53:39 +0000 (GMT) (envelope-from des@des.no) Received: from tim.des.no (localhost [127.0.0.1]) by spam.des.no (Postfix) with ESMTP id 2C7BB6192; Mon, 4 Jul 2005 02:53:34 +0200 (CEST) Received: from xps.des.no (des.no [80.203.228.37]) by tim.des.no (Postfix) with ESMTP id 1853C6191; Mon, 4 Jul 2005 02:53:34 +0200 (CEST) Received: by xps.des.no (Postfix, from userid 1001) id 0D52633D38; Mon, 4 Jul 2005 02:53:34 +0200 (CEST) To: Jesper Wallin References: <42C70FED.8080003@hackunite.net> From: des@des.no (=?iso-8859-1?q?Dag-Erling_Sm=F8rgrav?=) Date: Mon, 04 Jul 2005 02:53:33 +0200 In-Reply-To: <42C70FED.8080003@hackunite.net> (Jesper Wallin's message of "Sun, 03 Jul 2005 00:06:37 +0200") Message-ID: <86fyuvv1bm.fsf@xps.des.no> User-Agent: Gnus/5.110002 (No Gnus v0.2) Emacs/21.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Spam-Tests: ALL_TRUSTED,AWL,BAYES_00 X-Spam-Learn: ham X-Spam-Score: -5.2/5.0 X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on tim.des.no Cc: freebsd-security@freebsd.org Subject: Re: packets with syn/fin vs pf_norm.c X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jul 2005 00:53:39 -0000 Jesper Wallin writes: > First of all, I know that not dropping SYN/FIN isn't really a big deal, it > just makes no sense. But since it doesn't make any sense, I don't see > the reason why not to discard them. It is not invalid for a TCP segment to have both SYN and FIN set. See for instance RFC 1644. > I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've > read some other posts on google and as far as I can tell, clearly invalid > packets (like packets with SYN/RST set) is discared while scrub simply > remove the FIN bit on packets with SYN/FIN. It shouldn't, at least not unconditionally. DES --=20 Dag-Erling Sm=F8rgrav - des@des.no