"Li, Qing" wrote: > > http://www.kb.cert.org/vuls/id/464113 > > http://www.linuxsecurity.com/content/view/104980/98/ > > Ran the packet tests against FreeBSD 5.3 and 6-CURRENT and both > respond to the SYN+FIN packets with SYN+ACK. This is expected behaviour because of FreeBSD used to implement T/TCP according to RFC1644. I haven't removed this part from TCP because I have a better reincarnation of T/TCP without the previous shortcomings almost ready which uses this again. The CERT article describes how dumb firewalls with poor stateful inspection may get fooled by this and other flag combinations. All I can say is it's not our fault. The SYN+FIN combination is described in RFC1644 and if the firewall gets it wrong... Well, the real world sucks. > Should I file a PR if there isn't one already ?? No action required here. What you could check is whether our firewalls packages in stateful mode (ipfw, pf, ipfilter) can be fooled by this. I doubt it but if you can verify it, that would be great. -- AndreReceived on Fri Feb 11 2005 - 19:19:19 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:28 UTC