Date: Mon, 04 Jul 2005 02:53:33 +0200 From: des@des.no (=?iso-8859-1?q?Dag-Erling_Sm=F8rgrav?=) To: Jesper Wallin <jesper@hackunite.net> Cc: freebsd-security@freebsd.org Subject: Re: packets with syn/fin vs pf_norm.c Message-ID: <86fyuvv1bm.fsf@xps.des.no> In-Reply-To: <42C70FED.8080003@hackunite.net> (Jesper Wallin's message of "Sun, 03 Jul 2005 00:06:37 %2B0200") References: <42C70FED.8080003@hackunite.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Jesper Wallin <jesper@hackunite.net> writes: > First of all, I know that not dropping SYN/FIN isn't really a big deal, it > just makes no sense. But since it doesn't make any sense, I don't see > the reason why not to discard them. It is not invalid for a TCP segment to have both SYN and FIN set. See for instance RFC 1644. > I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've > read some other posts on google and as far as I can tell, clearly invalid > packets (like packets with SYN/RST set) is discared while scrub simply > remove the FIN bit on packets with SYN/FIN. It shouldn't, at least not unconditionally. DES --=20 Dag-Erling Sm=F8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86fyuvv1bm.fsf>